Kernel security, year to date

The bugclass is larger than just allocating at 0, it involves all invalid
userland dereferences. So for example, there have been bugs where a
pointer was used which had a magic poison value in it, and this poison
value resulted in an address which was located somewhere in the middle of
the userland address space.

Openwall implemented HARDENED_PAGE0, and a derivative of it has been
implemented in the mainline Linux kernel (after looking at the Openwall
code and fixing the following trivial bypass in the original version
http://www.frsirt.com/english/advisories/2007/4200, which sat around in
their codebase for 6 months). These solutions only
protect against the 0+small offset variety of the bug, and obviously only
for people who actually have it set to a meaningful value, and it also
isn't enabled for all applications (it can break wine, for example). PaX
has UDEREF which prevents exploitation of the entire class of bugs, not
just the 0+small offset in protected apps.

-Brad