3 ms·
If I'm reading the patch right, you allocate a buffer at a random address and pass a pointer to the kernel, and then you don't have to hold on to a pointer to t
by geofft 8y ago
If I'm reading the patch right, you allocate a buffer at a random address and pass a pointer to the kernel, and then you don't have to hold on to a pointer to that address any more, right? So unlike with the stack, it should be hard for an attacker who can only writes to figure out where to write. (Maybe this isn't true in a 2 GB address space given enough attempts?)
- saagarjha 8y agoYeah, I missed the part where the address is given by the user space thread to the kernel instead of the other way around. That being said, I’m not sure as to the amount of entropy the address can have: it might end up being bruteforceable on 32-bit without having to query the full address space (the memory region might be a whole page?). The best solution, of course, is to not have any RWX segments at all.