 | This articleneeds additional citations forverification. Please helpimprove this article byadding citations to reliable sources. Unsourced material may be challenged and removed. Find sources: "Arbitrary code execution" – news ·newspapers ·books ·scholar ·JSTOR(March 2019) (Learn how and when to remove this message) |
Incomputer security,arbitrary code execution (ACE) is an attacker's ability to run any commands or code of the attacker's choice on a target machine or in a targetprocess.[1] Anarbitrary code executionvulnerability is a security flaw insoftware or hardware allowing arbitrary code execution. A program that is designed to exploit such a vulnerability is called anarbitrary code executionexploit. The ability to trigger arbitrary code execution over a network (especially via a wide-area network such as the Internet) is often referred to asremote code execution (RCE orRCX).
Arbitrary code execution signifies that if someone sends a specially designed set of data to a computer, they can make it do whatever they want. Even though this particular weakness may not cause actual problems in the real world, researchers have discussed whether it suggests a natural tendency for computers to have vulnerabilities that allow unauthorized code execution.[2]
There are a number of classes of vulnerability that can lead to an attacker's ability to execute arbitrary commands or code. For example:
Arbitrary code execution is commonly achieved through control over theinstruction pointer (such as a jump or abranch) of a runningprocess. The instruction pointer points to the next instruction in the process that will be executed. Control over the value of the instruction pointer therefore gives control over which instruction is executed next. In order to execute arbitrary code, many exploitsinject code into the process (for example by sending input to it which gets stored in aninput buffer inRAM) and use a vulnerability to change the instruction pointer to have it point to the injected code. The injected code will then automatically get executed. This type of attack exploits the fact that most computers (which use aVon Neumann architecture) do not make a general distinction betweencode and data,[7][8] so that malicious code can be camouflaged as harmless input data. Many newer CPUs have mechanisms to make this harder, such as ano-execute bit.[9][10]
On its own, an arbitrary code execution exploit will give the attacker the sameprivileges as the target process that is vulnerable.[11] For example, if exploiting a flaw in aweb browser, an attacker could act as the user, performing actions such as modifying personal computer files or accessing banking information, but would not be able to perform system-level actions (unless the user in question also had that access).
To work around this, once an attacker can execute arbitrary code on a target, there is often an attempt at aprivilege escalation exploit in order to gain additional control. This may involve thekernel itself or an account such as Administrator, SYSTEM, or root. With or without this enhanced control, exploits have the potential to do severe damage or turn the computer into azombie—but privilege escalation helps with hiding the attack from the legitimate administrator of the system.
Retrogaming hobbyists have managed to find vulnerabilities in classic video games that allow them to execute arbitrary code, usually using a precise sequence of button inputs in atool-assisted superplay to cause abuffer overflow, allowing them to write toprotected memory. AtAwesome Games Done Quick 2014, a group ofspeedrunners managed to code and run versions of the gamesPong,Snake andSuper Mario Bros. on a copy ofSuper Mario World[12] by utilizing an out-of-bounds read of a function pointer that points to a user controlled buffer to execute arbitrary code.
On June 12, 2018, Bosnian security researcher Jean-Yves Avenard ofMozilla discovered an ACE vulnerability inWindows 10.[13]
On May 1, 2018, a security researcher discovered an ACE vulnerability in the7-Zipfile archiver.[14]
PHP has been the subject of numerous ACE vulnerabilities.[15][16][17]
On December 9, 2021, an RCE vulnerability called "Log4Shell" was discovered in popularlogging frameworkLog4j, affecting many services includingiCloud,Minecraft: Java Edition andSteam, and characterized as "the single biggest, most critical vulnerability of the last decade".[18][19]
