3 ms·

I think the author is missing the point of the ksplice article ( http://news.ycombinator.com/item?id=1231961 http://news.ycombinator.com/item?id=1231961 ), whic

I think the author is missing the point of the ksplice article ( http://news.ycombinator.com/item?id=1231961 http://news.ycombinator.com/item?id=1231961 ), which is that you can exploit NULL pointer de-references in the kernel to gain privilege escalation.

deleted 17y ago
[deleted]
wheels 17y ago
That's not actually the point of that article; it's the point of their next one. The linked article basically said nothing about security exploits other than "they happen and we'll talk about them next time". It's a pretty general introduction to virtual memory and a way in user space to avoid crashing dereferencing a null pointer. That said, the post is as much a response to the title on HN as anything: Dereferencing a NULL pointer always segfaults, right? Not if you're clever... Now, I don't actually know enough about the exploits they're talking about to know if handling the signal would avoid them or if the null pointer dereference has to actually be in kernel space and they were just starting with examples from user space, which was my assumption on the first pass of reading the article.
- scott_s 17y ago
  Sorry, but the point of the article is clearly not "Here's a useful way to avoid having null pointer dereferences crash your program." They start out talking about kernel vulnerabilities in general and the null pointer dereferences specifically.
  - wheels 17y ago
    Can you paste some part where they actually talk about the vulnerability? I assume that the title quoted above was the original title of the post since that's what's used on HN and Reddit.
    - scott_s 17y ago
      The first two paragraphs clearly talk about it in the context of a security vulnerability. They don't explain how to exploit the vulnerability, but one versed in systems programming should either realize what it is, or be able to easily find it through Google or the pages they referenced in those paragraphs. If you Google "linux kernel null pointer exploit" you will find many examples.
      - wheels 17y ago
        So you think most people found the post interesting because of the thing that they're actually going to talk about next time rather than the actual content? I believe that it's been widely read because of the novelty of avoiding crashes when dereferencing null pointers; in fact, for anyone who could have jumped to the conclusions about how the exploit would work, they could have reduced it to one line: "You can map address 0x0 with mmap and then segfaults on deferencing null don't happen." All of the rest of the article is only useful to people who don't know systems programming. At any rate, I'm not sure that our fundamental disagreement is that wide; clearly the article is laying down a building block for a later piece on the security exploit and it was written to serve that purpose. This seems to be your point. My point is the actual content can stand alone and, in fact does, and is not about security.
        scott_s 17y ago
        That is my point, and because of that, I find your blog post disingenuous. You ignored the stated purpose of their post and presented it as something it was not.
        Locke1689 17y ago
        So you think most people found the post interesting because of the thing that they're actually going to talk about next time rather than the actual content? Actually, yes. I posted a comment on the previous article saying so. The information in the current article is rather trite. The intricacies of kernel privilege escalation is a different story.
xpaulbettsx 17y ago
This was used in several Linux drivers (PPPoE if I recall..?) as an EoP exploit - mmap low addresses, then get the kernel to jump to a null pointer. This is one of the reasons that all addresses <= 0x10000 in Windows NT are invalid, regardless of user/kernel mode.

deleted 17y ago

[deleted]

wheels 17y ago

That's not actually the point of that article; it's the point of their next one. The linked article basically said nothing about security exploits other than "they happen and we'll talk about them next time". It's a pretty general introduction to virtual memory and a way in user space to avoid crashing dereferencing a null pointer. That said, the post is as much a response to the title on HN as anything: Dereferencing a NULL pointer always segfaults, right? Not if you're clever... Now, I don't actually know enough about the exploits they're talking about to know if handling the signal would avoid them or if the null pointer dereference has to actually be in kernel space and they were just starting with examples from user space, which was my assumption on the first pass of reading the article.

scott_s 17y ago
Sorry, but the point of the article is clearly not "Here's a useful way to avoid having null pointer dereferences crash your program." They start out talking about kernel vulnerabilities in general and the null pointer dereferences specifically.
- wheels 17y ago
  Can you paste some part where they actually talk about the vulnerability? I assume that the title quoted above was the original title of the post since that's what's used on HN and Reddit.
  - scott_s 17y ago
    The first two paragraphs clearly talk about it in the context of a security vulnerability. They don't explain how to exploit the vulnerability, but one versed in systems programming should either realize what it is, or be able to easily find it through Google or the pages they referenced in those paragraphs. If you Google "linux kernel null pointer exploit" you will find many examples.
    - wheels 17y ago
      So you think most people found the post interesting because of the thing that they're actually going to talk about next time rather than the actual content? I believe that it's been widely read because of the novelty of avoiding crashes when dereferencing null pointers; in fact, for anyone who could have jumped to the conclusions about how the exploit would work, they could have reduced it to one line: "You can map address 0x0 with mmap and then segfaults on deferencing null don't happen." All of the rest of the article is only useful to people who don't know systems programming. At any rate, I'm not sure that our fundamental disagreement is that wide; clearly the article is laying down a building block for a later piece on the security exploit and it was written to serve that purpose. This seems to be your point. My point is the actual content can stand alone and, in fact does, and is not about security.
      - scott_s 17y ago
        That is my point, and because of that, I find your blog post disingenuous. You ignored the stated purpose of their post and presented it as something it was not.
      - Locke1689 17y ago
        So you think most people found the post interesting because of the thing that they're actually going to talk about next time rather than the actual content? Actually, yes. I posted a comment on the previous article saying so. The information in the current article is rather trite. The intricacies of kernel privilege escalation is a different story.

xpaulbettsx 17y ago

This was used in several Linux drivers (PPPoE if I recall..?) as an EoP exploit - mmap low addresses, then get the kernel to jump to a null pointer. This is one of the reasons that all addresses <= 0x10000 in Windows NT are invalid, regardless of user/kernel mode.