Messages in this thread | | | From | "PaX Team" <> | Date | Fri, 24 Feb 2012 23:59:47 +0200 | Subject | Re: [kernel-hardening] Re: Add overflow protection to kref |
| |
On 24 Feb 2012 at 23:13, Vasiliy Kulikov wrote:
> > But in this case, the principle does not apply because we can recover. > > The reason we cannot recover from the stack protector case is because > > the stack protector is reacting after the fact, which is not the case > > here. Simply peg the reference count at the maximum value, neither > > incrementing it nor decrementing it further. > > ...and simply loose one reference, which leads to use-after-free.
saturating the refcount keeps the protected object allocated, so it is a memory leak, but it is not a use-after-free.
| |