3 ms·

Analysis of the POC concurs with my tests that confirm that the portion of `su` that gets overwritten does not survive a reboot.

• wang_li 5mo ago
  it's living in your page cache, not on your disk. flush the caches and it'll disappear.
  • stackghost 5mo ago
    Indeed. But it's easier to just kill a container or a k8s node and reprovision than to flush the caches
    • wang_li 5mo ago
      Should be able to just echo a 1 to /proc/sys/vm/drop_caches.