> The hardware - it's an attribute on the page table. And the only way to make the page writable again is to clear the page first. Am I correct? > You can avo

> The hardware - it's an attribute on the page table. And the only way to make the page writable again is to clear the page first. Am I correct? > You can avoid all of these protections if you can inject new code into an existing privileged process or SUID executable, which is how DirtyCOW worked. It can happen if either one of these is true: 1) the existing privileged process or SUID executable is vulnerable; 2) the kernel is vulnerable. DirtyCOW is interesting because it's the case #2. The case #1 is not that interesting, because targeting vulnerable privileged executables is a known attack vector.