3 ms·
A follow-up comment describes how it works: http://seclists.org/oss-sec/2014/q2/469 http://seclists.org/oss-sec/2014/q2/469
by scott_s 12y ago
A follow-up comment describes how it works: http://seclists.org/oss-sec/2014/q2/469 http://seclists.org/oss-sec/2014/q2/469
- haberman 12y agoNice. I didn't quite understand though: > Specifically, the futex syscall can leave a queued kernel waiter hanging on the stack. By manipulating the stack with further syscalls, the waiter structure can be altered. Is the bug that the waiter is left on the stack, or that other syscalls can alter the stack? Allowing syscalls to alter the stack seems like a vulnerability regardless of what happens to be on the stack when it's altered.