Conversation

Andrey Konovalov

Exploit for CVE-2017-18344: github.com/xairy/kernel-e Details: openwall.com/lists/oss-secu

kernel-exploits/poc.c at master · xairy/kernel-exploits

My proof-of-concept exploits for the Linux kernel. Contribute to xairy/kernel-exploits development by creating an account on GitHub.

2

86

146

Replying to

Neat tricks! Sad that SMAP breaks them :(

1

Andrey Konovalov

Replying to

Thanks! If there's a way to set some 8 byte kernel global variable from an unprivileged user, it could be used to bypass SMAP (by storing the pointer to the data you want to leak in this variable), but nothing really came to mind when I've been thinking about this

7:08 PM · Aug 9, 2018Twitter Web Client

Replying to

Yeah, having an unprivileged user store a kernel address on a global variable would resolve the whole problem. And I assume with heap spraying it would still be very hard to guess right