Recent Features
| |||||||||||||
Fun with NULL pointers, part 1Fun with NULL pointers, part 1Posted Jul 20, 2009 21:38 UTC (Mon) by spender (subscriber, #23067)In reply to: Fun with NULL pointers, part 1 by clugstj Parent article: Fun with NULL pointers, part 1
I could have written to the 2nd byte instead (choose your endianness) and the resulting address would be aligned.
The kernel actually being able to use that address directly would depend on the architecture.
I only chose the first byte because I already had my mapping at NULL, so it was easy to reuse it. The exploit primitive there though allows an arbitrary OR of 0x1 to any byte in memory.
-Brad
(Log in to post comments)
Fun with NULL pointers, part 1 Posted Jul 20, 2009 22:27 UTC (Mon) by spender (subscriber, #23067) [Link]
Clarification/fix: Since the OR is performed on an unsigned long instead of a single byte, then the address of the target may be subject to whatever alignment on architectures that care.
-Brad
|
|||||||||||||