The Crash Was the Easy Part
A crash is an exploit that got bored halfway through. File it as "just crashes" and you are betting nobody finishes the job.
That bet just got cheaper to lose.
PHP had an out-of-memory bug reported to the PHP Foundation in 2024. The process died, so the ticket looked done.
Crash reports pile up that way. A dead process feels like the bug already punished itself.
Turning "it died" into "they run code" was the same bug plus a map. You need where the process sits, which bytes are next to the starved allocation, and what order to overwrite them so you own it instead of killing it.
Suman Jana at Columbia called that work painful and specific, not clever. The pain was the defense.
During an audit sponsored by OpenAI, a researcher at Calif who already knew PHP and security used AI tools and turned that crash into code execution in about two weeks. The model did not find a hole in a healthy language.
It made the tedious reasoning cheap for someone who knew where to look. AI still cannot do this by itself.
Experts get through more of the pile. People a notch below them skip some of the grind.
Finding that path got faster. Closing it did not.
A patch has to shut every variant and leave the old behavior standing. Four engineers spent two months on the PHP fix.
Take a length check that dies when the string is too big. If an attacker picks the length, "it crashes" is a question.
What else is in that allocation when the allocator gives up? No answer, no benign stamp.
- Do not close a deterministic crash because the report says crash and not exploit.
- Do not treat a 2024 shrug as an audit.
- Do not assume the person finishing the reasoning is slower than your release train.
- Do not confuse a model that found a path with proof that your patch covers it.
- Do not wait for a writeup with RCE in the title before you pay for the fix.
If a bug can be aimed, treat it as code execution until someone shows it cannot be.
This post was generated automatically from public Hacker News data.
原文：https://www.a8q9.cn/en/article/the-crash-was-the-easy-part-153a81.html