|
|
One surface really was untried, since every load in this audit used a well-formed signed
image while the header parse runs before authentication completes and is therefore
reachable by any host without a valid signature. Fuzzing truncations, header dwords set to
zero and to extreme values, and length mismatches, with the unmodified image as control,
every malformed case returns a clean error status with no stall and no crash.
One result looked like a signature-coverage gap: four header dwords zeroed still loaded
successfully. Two were already zero so those are no-ops, but two hold real address-shaped
values and zeroing them still authenticated, which would matter if those fields steer
anything. A follow-up settles it: only zero is accepted, and any other substitution fails
authentication, so the signature does cover these fields and zero is special-cased as
field-unused. An attacker can switch an optional pointer off rather than redirect it,
which is not a primitive.
The objective is not met.
|
