3 ms·
the point of this is simple: if you have a kernel vulnerability that allows you to construct a write-what-where primitive (or even something lower like an arbit
by pwnfl4k3s 12y ago
the point of this is simple: if you have a kernel vulnerability that allows you to construct a write-what-where primitive (or even something lower like an arbitrary inc/dec, although it is most of the time possible to transform vulnerabilities into the former mentioned), you are able to turn it into a fully blown kernel-mode code-execution using that technique. this is what bypassing mitigation-techniques is all about: turning a vulnerability into code-execution. in particular, the technique eliminates the need to use ROP in order to bypass SMEP and DEP, this is why it is a big deal. the only reason that it was not considered eligible for microsofts Bluehat-Program is the fact that it is a kernel-land mitigation bypass, not a userland one.
- drvdevd 12y agoWhat seems even more interesting about it, is that it's directly related to the paging structures in x64, making it potentially applicable to kernel mode exploit mitigations on any OS running there (MacOS X for example). It's a great example of why kernel mode exploit mitigation is unlikely to ever reach the same level of effectiveness as in user mode.