3 ms·

Thanks for taking time to answer my questions. > Kernel code is mapped read only What part of the system makes sure that read-only kernel code stays read-only

• mjg59 10y ago
  The hardware - it's an attribute on the page table. You could certainly monitor that from the hypervisor as well, although there'd be some performance overhead. You can avoid all of these protections if you can inject new code into an existing privileged process or SUID executable, which is how DirtyCOW worked. The blog points out that this class of vulnerability isn't covered.
  • xkxx 10y ago
    > The hardware - it's an attribute on the page table. And the only way to make the page writable again is to clear the page first. Am I correct? > You can avoid all of these protections if you can inject new code into an existing privileged process or SUID executable, which is how DirtyCOW worked. It can happen if either one of these is true: 1) the existing privileged process or SUID executable is vulnerable; 2) the kernel is vulnerable. DirtyCOW is interesting because it's the case #2. The case #1 is not that interesting, because targeting vulnerable privileged executables is a known attack vector.