Ggthjy

Obtaining a matrix of complex values from associations giving the real and imaginary parts of each element?

Finding the number of integers that are a square and a cube at the same time

Can I retract my name from an already published manuscript?

Is my plan for fixing my water heater leak bad?

If I delete my router's history can my ISP still provide it to my parents?

Word to be used for "standing with your toes pointing out"

Called into a meeting and told we are being made redundant (laid off) and "not to share outside". Can I tell my partner?

How to avoid being sexist when trying to employ someone to function in a very sexist environment?

What are these green text/line displays shown during the livestream of Crew Dragon's approach to dock with the ISS?

How to satisfy a player character's curiosity about another player character?

Find the number of ways to express 1050 as sum of consecutive integers

Removing debris from PCB

How to mitigate "bandwagon attacking" from players?

Can the Count of Monte Cristo's calculation of poison dosage be explained?

Meaning of すきっとした

What is better: yes / no radio, or simple checkbox?

Do my Windows system binaries contain sensitive information?

How to define a macro with multiple optional parameters?

If all harmonics are generated by plucking, how does a guitar string produce a pure frequency sound?

Why is this code uniquely decodable?

Finding an integral using a table?

Why do members of Congress in committee hearings ask witnesses the same question multiple times?

What's a good word to describe a public place that looks like it wouldn't be rough?

If a druid in Wild Shape swallows a creature whole, then turns back to her normal form, what happens?

Is divide-by-zero a security vulnerability?

I've found security vulnerability in current linux distribution. What next?Vulnerability exploitation in Javawhere can I find list of zero day vulnerability?web security testing - vulnerability issueTrusted vulnerability database sourcevulnerability scanning softwareHow to detect Rowhammer vulnerability?Educational Security VulnerabilityIs there an estimation of the amount of zero-days out there?is SSRF attack or vulnerability?

1

Even though sometimes software bugs and vulnerabilities are deemed as the same concept, there must be at least one distinct aspect between them, and I think the most prominent one is exploitability (the latter one having the property).

What I'm curious about is, even after seeing many cases that divide-by-zero bugs are reported as software problems, I can hardly come up with any attack (other than DoS) using divide-by-zero bugs. I know not all kinds of bugs have the same impact upon a system in terms of security, but is there any attack method that uses divide-by-zero bugs to achieve something different than DoS, like privilege escalation for example?

exploit attacks vulnerability

share|improve this question

asked 4 hours ago

Gwangmu LeeGwangmu Lee

1063

add a comment | 

1

Even though sometimes software bugs and vulnerabilities are deemed as the same concept, there must be at least one distinct aspect between them, and I think the most prominent one is exploitability (the latter one having the property).

What I'm curious about is, even after seeing many cases that divide-by-zero bugs are reported as software problems, I can hardly come up with any attack (other than DoS) using divide-by-zero bugs. I know not all kinds of bugs have the same impact upon a system in terms of security, but is there any attack method that uses divide-by-zero bugs to achieve something different than DoS, like privilege escalation for example?

exploit attacks vulnerability

share|improve this question

asked 4 hours ago

Gwangmu LeeGwangmu Lee

1063

add a comment | 

Even though sometimes software bugs and vulnerabilities are deemed as the same concept, there must be at least one distinct aspect between them, and I think the most prominent one is exploitability (the latter one having the property).

What I'm curious about is, even after seeing many cases that divide-by-zero bugs are reported as software problems, I can hardly come up with any attack (other than DoS) using divide-by-zero bugs. I know not all kinds of bugs have the same impact upon a system in terms of security, but is there any attack method that uses divide-by-zero bugs to achieve something different than DoS, like privilege escalation for example?

exploit attacks vulnerability

share|improve this question

asked 4 hours ago

Gwangmu LeeGwangmu Lee

1063

share|improve this question

asked 4 hours ago

Gwangmu LeeGwangmu Lee

1063

share|improve this question

asked 4 hours ago

Gwangmu LeeGwangmu Lee

1063

asked 4 hours ago

Gwangmu LeeGwangmu Lee

1063

asked 4 hours ago

Gwangmu LeeGwangmu Lee

1063

3 Answers
3

active

oldest

votes

3

Division by zero is not inherently a security vulnerability.

However, if you can make an application server crash and stay offline by making it divide by zero, this may constitute a denial of service vulnerability.

share|improve this answer

answered 3 hours ago

duskwuffduskwuff

1,211410

add a comment | 

1

I think ultimately your answer’s going to come down to the individual system in play. How does the system handle trying to divide by 0? If it’s elegant, then your attack options are limited or nonexistent. If it does something funky you can probably get in there with something.

Basically, no standard attacks can come out of this - that I’m aware of anyway - but computers can always handle bugs badly, and bad handling of bugs is the source of many vulnerabilities.

share|improve this answer

answered 4 hours ago

securityOrangesecurityOrange

61215

add a comment | 

1

At issue is that an exception handler will be invoked to handle the division by zero. In general, attackers know that exception handlers are not as well-tested as regular code flows. Your main logic flow might be sound and thoroughly tested, but an exception handler can be triggered by interrupts occurring anywhere in the code within its scope.

int myFunction(int a, int b, SomeState state) {



    state(UNINITIALIZED);

    try {

        state.something(a/b);

        state(NORMAL);

    }

    catch () {

        state.something(b/a);

        state(INVERTED);

    }

    return retval;

}

This horrible pseudocode sort of illustrates one way the flaw could be exploited. Let's say that an uninitialized state is somehow vulnerable. If this routine is called, the state is first uninitialized. If b is zero, it catches the exception and tries to do some other logic. But if both a and b are zero, it throws again, leaving state uninitialized.

The division by zero itself wasn't the vulnerability, it's the bad code around it that's possible to exploit.

share|improve this answer

answered 2 hours ago

John DetersJohn Deters

27.8k24191

add a comment | 

Your Answer

StackExchange.ready(function() {
var channelOptions = {
tags: "".split(" "),
id: "162"
};
initTagRenderer("".split(" "), "".split(" "), channelOptions);

StackExchange.using("externalEditor", function() {
// Have to fire editor after snippets, if snippets enabled
if (StackExchange.settings.snippets.snippetsEnabled) {
StackExchange.using("snippets", function() {
createEditor();
});
}
else {
createEditor();
}
});

function createEditor() {
StackExchange.prepareEditor({
heartbeatType: 'answer',
autoActivateHeartbeat: false,
convertImagesToLinks: false,
noModals: true,
showLowRepImageUploadWarning: true,
reputationToPostImages: null,
bindNavPrevention: true,
postfix: "",
imageUploader: {
brandingHtml: "Powered by u003ca class="icon-imgur-white" href="https://imgur.com/"u003eu003c/au003e",
contentPolicyHtml: "User contributions licensed under u003ca href="https://creativecommons.org/licenses/by-sa/3.0/"u003ecc by-sa 3.0 with attribution requiredu003c/au003e u003ca href="https://stackoverflow.com/legal/content-policy"u003e(content policy)u003c/au003e",
allowUrls: true
},
noCode: true, onDemand: true,
discardSelector: ".discard-answer"
,immediatelyShowMarkdownHelp:true
});


}
});

draft saved

draft discarded

Sign up or log in

StackExchange.ready(function () {
StackExchange.helpers.onClickDraftSave('#login-link');
});

Sign up using Google

Sign up using Facebook

Sign up using Email and Password

Post as a guest

Name

Email

Required, but never shown

StackExchange.ready(
function () {
StackExchange.openid.initPostLogin('.new-post-login', 'https%3a%2f%2fsecurity.stackexchange.com%2fquestions%2f204669%2fis-divide-by-zero-a-security-vulnerability%23new-answer', 'question_page');
}
);

Post as a guest

Name

Email

Required, but never shown

3

Division by zero is not inherently a security vulnerability.

However, if you can make an application server crash and stay offline by making it divide by zero, this may constitute a denial of service vulnerability.

share|improve this answer

answered 3 hours ago

duskwuffduskwuff

1,211410

add a comment | 

3

Division by zero is not inherently a security vulnerability.

However, if you can make an application server crash and stay offline by making it divide by zero, this may constitute a denial of service vulnerability.

share|improve this answer

answered 3 hours ago

duskwuffduskwuff

1,211410

add a comment | 

Division by zero is not inherently a security vulnerability.

However, if you can make an application server crash and stay offline by making it divide by zero, this may constitute a denial of service vulnerability.

share|improve this answer

answered 3 hours ago

duskwuffduskwuff

1,211410

share|improve this answer

answered 3 hours ago

duskwuffduskwuff

1,211410

answered 3 hours ago

duskwuffduskwuff

1,211410

answered 3 hours ago

duskwuffduskwuff

1,211410

1

I think ultimately your answer’s going to come down to the individual system in play. How does the system handle trying to divide by 0? If it’s elegant, then your attack options are limited or nonexistent. If it does something funky you can probably get in there with something.

Basically, no standard attacks can come out of this - that I’m aware of anyway - but computers can always handle bugs badly, and bad handling of bugs is the source of many vulnerabilities.

share|improve this answer

answered 4 hours ago

securityOrangesecurityOrange

61215

add a comment | 

1

I think ultimately your answer’s going to come down to the individual system in play. How does the system handle trying to divide by 0? If it’s elegant, then your attack options are limited or nonexistent. If it does something funky you can probably get in there with something.

Basically, no standard attacks can come out of this - that I’m aware of anyway - but computers can always handle bugs badly, and bad handling of bugs is the source of many vulnerabilities.

share|improve this answer

answered 4 hours ago

securityOrangesecurityOrange

61215

add a comment | 

I think ultimately your answer’s going to come down to the individual system in play. How does the system handle trying to divide by 0? If it’s elegant, then your attack options are limited or nonexistent. If it does something funky you can probably get in there with something.

Basically, no standard attacks can come out of this - that I’m aware of anyway - but computers can always handle bugs badly, and bad handling of bugs is the source of many vulnerabilities.

share|improve this answer

answered 4 hours ago

securityOrangesecurityOrange

61215

share|improve this answer

answered 4 hours ago

securityOrangesecurityOrange

61215

answered 4 hours ago

securityOrangesecurityOrange

61215

answered 4 hours ago

securityOrangesecurityOrange

61215

1

At issue is that an exception handler will be invoked to handle the division by zero. In general, attackers know that exception handlers are not as well-tested as regular code flows. Your main logic flow might be sound and thoroughly tested, but an exception handler can be triggered by interrupts occurring anywhere in the code within its scope.

int myFunction(int a, int b, SomeState state) {



    state(UNINITIALIZED);

    try {

        state.something(a/b);

        state(NORMAL);

    }

    catch () {

        state.something(b/a);

        state(INVERTED);

    }

    return retval;

}

This horrible pseudocode sort of illustrates one way the flaw could be exploited. Let's say that an uninitialized state is somehow vulnerable. If this routine is called, the state is first uninitialized. If b is zero, it catches the exception and tries to do some other logic. But if both a and b are zero, it throws again, leaving state uninitialized.

The division by zero itself wasn't the vulnerability, it's the bad code around it that's possible to exploit.

share|improve this answer

answered 2 hours ago

John DetersJohn Deters

27.8k24191

add a comment | 

1

At issue is that an exception handler will be invoked to handle the division by zero. In general, attackers know that exception handlers are not as well-tested as regular code flows. Your main logic flow might be sound and thoroughly tested, but an exception handler can be triggered by interrupts occurring anywhere in the code within its scope.

int myFunction(int a, int b, SomeState state) {



    state(UNINITIALIZED);

    try {

        state.something(a/b);

        state(NORMAL);

    }

    catch () {

        state.something(b/a);

        state(INVERTED);

    }

    return retval;

}

This horrible pseudocode sort of illustrates one way the flaw could be exploited. Let's say that an uninitialized state is somehow vulnerable. If this routine is called, the state is first uninitialized. If b is zero, it catches the exception and tries to do some other logic. But if both a and b are zero, it throws again, leaving state uninitialized.

The division by zero itself wasn't the vulnerability, it's the bad code around it that's possible to exploit.

share|improve this answer

answered 2 hours ago

John DetersJohn Deters

27.8k24191

add a comment | 

At issue is that an exception handler will be invoked to handle the division by zero. In general, attackers know that exception handlers are not as well-tested as regular code flows. Your main logic flow might be sound and thoroughly tested, but an exception handler can be triggered by interrupts occurring anywhere in the code within its scope.

int myFunction(int a, int b, SomeState state) {



    state(UNINITIALIZED);

    try {

        state.something(a/b);

        state(NORMAL);

    }

    catch () {

        state.something(b/a);

        state(INVERTED);

    }

    return retval;

}

This horrible pseudocode sort of illustrates one way the flaw could be exploited. Let's say that an uninitialized state is somehow vulnerable. If this routine is called, the state is first uninitialized. If b is zero, it catches the exception and tries to do some other logic. But if both a and b are zero, it throws again, leaving state uninitialized.

The division by zero itself wasn't the vulnerability, it's the bad code around it that's possible to exploit.

share|improve this answer

answered 2 hours ago

John DetersJohn Deters

27.8k24191

int myFunction(int a, int b, SomeState state) {



    state(UNINITIALIZED);

    try {

        state.something(a/b);

        state(NORMAL);

    }

    catch () {

        state.something(b/a);

        state(INVERTED);

    }

    return retval;

}

share|improve this answer

answered 2 hours ago

John DetersJohn Deters

27.8k24191

answered 2 hours ago

John DetersJohn Deters

27.8k24191

answered 2 hours ago

John DetersJohn Deters

27.8k24191