> separated kernel and process address space This already exists on x86_64 Linux in the form of SMEP and SMAP. > With SMEP enabled, it’s no longer possible to

> separated kernel and process address space This already exists on x86_64 Linux in the form of SMEP and SMAP. > With SMEP enabled, it’s no longer possible to map exploit payloads in userland, as the CPU will trigger a fault if it attempts to execute those user pages in kernel mode http://vulnfactory.org/blog/2011/06/05/smep-what-is-it-and-how-to-beat-it-on-linux/ http://vulnfactory.org/blog/2011/06/05/smep-what-is-it-and-h... > SMEP can be used to prevent supervisor-mode code from unintentionally executing user-space code. SMAP extends this protection to reads and writes https://en.wikipedia.org/wiki/Supervisor_Mode_Access_Prevention https://en.wikipedia.org/wiki/Supervisor_Mode_Access_Prevent... These mitigations aren't overly novel at this point and don't prevent exploits (just complicates them). Here's a recent CVE PoC containing an SMEP and KASLR bypass: https://github.com/xairy/kernel-exploits/blob/master/CVE-2017-1000112/poc.c https://github.com/xairy/kernel-exploits/blob/master/CVE-201... Full memory safety takes this much further, and should be far harder to bypass.