Fun with NULL pointers, part 1
Fun with NULL pointers, part 1
Posted Jul 20, 2009 21:38 UTC (Mon) by spender (guest, #23067)In reply to: Fun with NULL pointers, part 1 by clugstj
Parent article: Fun with NULL pointers, part 1
I could have written to the 2nd byte instead (choose your endianness) and the resulting address would be aligned.
The kernel actually being able to use that address directly would depend on the architecture.
The kernel actually being able to use that address directly would depend on the architecture.
I only chose the first byte because I already had my mapping at NULL, so it was easy to reuse it. The exploit primitive there though allows an arbitrary OR of 0x1 to any byte in memory.
-Brad
Posted Jul 20, 2009 22:27 UTC (Mon)
by spender (guest, #23067)
[Link]
-Brad
Fun with NULL pointers, part 1
Clarification/fix: Since the OR is performed on an unsigned long instead of a single byte, then the address of the target may be subject to whatever alignment on architectures that care.