4 ms·
Newbie question: multiple articles on this topic state that "even the kernel cannot access this memory" [because it is not in the direct map]. But surely, unde
by eigma 5y ago
Newbie question: multiple articles on this topic state that "even the kernel cannot access this memory" [because it is not in the direct map].
But surely, under assumption of arbitrary kernel code execution, a determined payload could restore the relevant direct map mappings, and still access this memory?
- simcop2387 5y agoCorrect. The idea tthough is thay th4 mapping isn't in the places that are usually accessible so the normal gadgets thay get used won't work. In the future combinjng this with something like sev would make even more difficult to exploit.
- cmeacham98 5y agoMy understanding is this would protect against arbitrary reads in the kernel (but not arbitrary code execution as you pointed out).