Messages in this thread | | | Date | Sun, 5 Dec 2010 09:08:55 +0100 | From | Samuel Thibault <> | Subject | Re: mmap to address zero with MAP_FIXED returns ENOPERM for non-root users? |
| |
Eric Smith, le Sat 04 Dec 2010 23:47:18 -0800, a écrit : > I'm curious, though. How likely are exploits where I can trick the > kernel into calling a function at 0 in my virtual address space, but not > trick it into calling a function at some non-zero address of my choosing?
NULL pointers are everywhere in function pointers structures & such.
About translation, maybe you could use an LDT entry to make the processor do the translation? (additional 1-byte fs: prefix).
Samuel -- To unsubscribe from this list: send the line "unsubscribe linux-kernel" in the body of a message to majordomo@vger.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html Please read the FAQ at http://www.tux.org/lkml/
| |