Conversation

Replying to
Yeah, having an unprivileged user store a kernel address on a global variable would resolve the whole problem. And I assume with heap spraying it would still be very hard to guess right