Linux Local Privilege Escalation via SUID /proc/pid/mem Write (zx2c4)

i understand you're excited but please stick to the facts... ASLR won't make exploitation 'much harder' given the few bits one has to brutefoce, call it a blink of an eye. if you have something like grsecurity's brute force detection and prevention feature then you can at least bound the probability of success (but still not make it 0, and also let's not forget about potential memory leaks one could make use of to avoid brute forcing in the first place although for this particular vulnerability it's very hard to imagine a situation where such leaks could be used by the exploit given how the lseek has to happen before the suid address space even exists).

second, mem_write makes use of the same accessor underneath as ptrace and can therefore write to memory mapped as read-only (whether that capability was intended or not is another question and perhaps a bug itself yet to be fixed). so RELRO/etc won't do anything to prevent this vulnerability from getting exploited. case in point, this exploit modifies the .plt section itself that is mapped as read-only already. i will note again that under grsecurity the technique used in this exploit won't work because PaX prevents said accessor from modifying executable (and hence read-only) mappings, one would need a ret2libc style exploit and most likely brute force (which is then limited by the previously mentioned feature).