Shawn Webb is a user on You can follow them or interact with them if you have an account anywhere in the fediverse. If you don't, you can sign up here.
Shawn Webb @lattera

Remember, kids, that ASLR wasn't designed to protect against local attacks. Cache attacks that require local code execution are irrelevant.

· Web · 2 · 0

For those that say ASLR is useless due to cache/timing attacks:

Show me a reliable, working remote exploit for OpenVPN compiled as a PIE that works due to cache/timing attacks rendering ASLR useless.

ASLR was not meant to protect against runtimes that actively work against security (like Javascript).

So to say ASLR is useless because of some attack vector ASLR wasn't even meant to protect against is to throw everything else under the bus.

Remember: browsers introduce remote code execution as a feature. This is not what ASLR was meant to protect against.