{
  "id": 9081969,
  "title": "stack unwinding can lead to leakless code execution",
  "url": "https://urgent.news/2026/09/21/stack-unwinding-can-lead-to-leakless-code-execution",
  "topic": "tech",
  "section": "Tech",
  "published": "2026-09-21T23:01:34.000Z",
  "source": {
    "name": "Lobsters",
    "slug": "lobsters",
    "url": "https://pepsipu.com/blog/2026-09-dwarf/"
  },
  "original_language": "en",
  "account": "The stack unwinding process can lead to leakless code execution. Enzo Cut, after seeing a writeup from a challenge, shared a solution involving byte swapping relative to the stack. This allowed unvariant to control arguments to the read function. The read function is a POSIX cancellation point, which means it can be postponed until the next cancellation point, such as when a thread is canceled using pthread_cancel. However, canceling a thread is complicated, particularly if the thread has C++ objects allocated on its stack. Destructing these objects is not a simple task, as it may involve running destructors, which could leave file descriptors open or mutexes locked. To circumvent this complexity, unvariant employed a technique known as a \"forced unwind\" or \"forced stack unwinding\". By hijacking the DWARF (Debugging With Aid Of Runtime Frame) VM and manipulating the .eh_frame_hdr section, it was possible to control the contents of a large malloc and perform out-of-bounds null byte writes. These two primitives enabled the attacker to execute arbitrary code, even in a sandboxed environment where traditional methods like one_gadget or system() calls may not be feasible.",
  "summary": null,
  "key_points": [],
  "editors_take": null,
  "illustration": null,
  "coverage": {
    "outlets": 1,
    "also_reported_by": []
  },
  "ai_generated": true,
  "disclaimer": "Summaries, key points and the editor’s take are written by software from other outlets’ reporting and may contain errors — always check the linked original."
}