Comment on Null pointer dereference – new security bug for OpenSSLComments−eyeareque12yAre there any write ups for this yet? I can't find a CVE or anything on this one. No word from OpenSSL yet either.−Moral_12yThis shouldn't be exploitable on modern linux machines due to https://wiki.debian.org/mmap_min_addrWho knows for embedded devices.−lawnchair_larry12yIt wouldn't be exploitable even without that, due to it being a userland dereference. The mmap 0 trick really only applies to kernel exploits. If you're in a position to mmap anything, you can already execute code.
Comments
Are there any write ups for this yet? I can't find a CVE or anything on this one. No word from OpenSSL yet either.
This shouldn't be exploitable on modern linux machines due to https://wiki.debian.org/mmap_min_addr
Who knows for embedded devices.
It wouldn't be exploitable even without that, due to it being a userland dereference. The mmap 0 trick really only applies to kernel exploits. If you're in a position to mmap anything, you can already execute code.