3 ms·
Kernel memory disclosure pretty much always provides an easy way to bypass kernel address randomization (KASLR).
by bonzini 9y ago
Kernel memory disclosure pretty much always provides an easy way to bypass kernel address randomization (KASLR).
- tankenmate 9y agoFor those not fully aware of why; if you can get a copy of a section of the kernel stack (which should have been zeroed but wasn't) you'll get the kernel memory (which is different from user memory) addresses of function calls, data structures, etc which then allow you target where to insert your own code / data. In other words it allows you to accurately hijack kernel functions and/or compromise kernel data structures, e.g. change the owner of a kernel object, process or task. It's half of what you need to compromise the kernel (you now know where to inject code/data). The other is having a way to inject code/data. EDIT - grammar fix.