| |||||||||||
vmsplice(): the making of a local root exploitvmsplice(): the making of a local root exploitPosted Feb 12, 2008 0:48 UTC (Tue) by jwb (guest, #15467)Parent article: vmsplice(): the making of a local root exploit
Can anyone explain why the fix only applied to len and not off? Is it because the base address does not come from userspace?
(Log in to post comments)
vmsplice(): the making of a local root exploit Posted Feb 12, 2008 9:11 UTC (Tue) by and (subscriber, #2883) [Link] If my understanding of this is correct, then off is the offset within the first page (i.e. off is always smaller than PAGE_SIZE).
vmsplice(): the making of a local root exploit Posted Feb 12, 2008 22:48 UTC (Tue) by jd (subscriber, #26381) [Link] If it's just casting, then fixing an unexploitable casting bug is tidier than leaving it, explicitly states intention, and prevents these souped-up aggressive optimizing compilers used on the kernel from optimizing in a problem sometime down the road. On the other hand, unnecessary changes introduce risks of adding as many problems as they fix.
|
|||||||||||