Post Syndicated from daroc original https://lwn.net/Articles/1105134/

The

Node.js project recently had a

security vulnerability that
affected its

Brotli decoder. The bug

was a buffer overflow,
but the particular way that official Node.js binaries are built for Linux meant that one of the
main protections against turning a buffer overflow into remote code execution,

address space layout randomization (ASLR) could not be turned on. If ASLR had been
enabled, the bug would still be exploitable in theory, but much more difficult
to exploit in practice. In response, the GNU C Library (glibc) is

considering a new set of

tunable settings to allow administrators to forbid programs that do not
support ASLR. The new settings, while a welcome hardening measure, may not
address the root problem.