3 ms·
This type of exploit is useful as part of a chain of exploits; it defeats a defense-in-depth protection.
by MattSteelblade 1y ago
This type of exploit is useful as part of a chain of exploits; it defeats a defense-in-depth protection.
- twoodfin 1y agoSpecifically, it leaks a kernel address inside a security-sensitive structure, which is supposed to be unpredictable / unknowable because the layout of kernel memory is randomized. If you have another exploit that will write bytes under the attacker’s control to an attacker-supplied kernel address, you will be able to do the Windows equivalent of escalate to root.