Thanks. > There is no driver code involved. Yea I see that step #1 in the 'exploit algo' is to remove the e1000, I missed that earlier: > An attacker unloads

Thanks. > There is no driver code involved. Yea I see that step #1 in the 'exploit algo' is to remove the e1000, I missed that earlier: > An attacker unloads e1000.ko loaded by default in Linux guests and loads the exploit's LKM.