To all the kernel programmers out there, can we get a HN-level ELI5 for this?
It looks like a total system compromise is possible. Under what conditions? Any ways to ensure we don't get pwned?
It looks like a total system compromise is possible. Under what conditions? Any ways to ensure we don't get pwned?
Not sure if this is HN-level, but... I hope it's understandable.
Have Mac users finally started running antivirus?
I haven't completed reading this one thoroughly but one example like this is kernel performing access checks on user requests asking it to perform some action - user space would ask for something it is permitted to do at first, kernel would read it and proceed to perform access check. User space meanwhile writes something different to the original memory area that specified the action - this time something privileged - kernel comes back successfully performing the access check for the older action and now executes the privileged action from the overwrite.
j00ru/project zero used modified Bochs (BochsPWN) to detect double memory fetch patterns to find similar vulnerabilities in the Windows kernel.