TE
科技回声
首页24小时热榜最新最佳问答展示工作
GitHubTwitter
首页

科技回声

基于 Next.js 构建的科技新闻平台,提供全球科技新闻和讨论内容。

GitHubTwitter

首页

首页最新最佳问答展示工作

资源链接

HackerNews API原版 HackerNewsNext.js

© 2025 科技回声. 版权所有。

Exploiting null-dereferences in the Linux kernel

158 点作者 kuter超过 2 年前

6 条评论

mappu超过 2 年前
See also this recent (Nov 2022) LWN article regarding the new oops limit: <a href="https:&#x2F;&#x2F;lwn.net&#x2F;Articles&#x2F;914878&#x2F;" rel="nofollow">https:&#x2F;&#x2F;lwn.net&#x2F;Articles&#x2F;914878&#x2F;</a>
high_byte超过 2 年前
8 days to exploit :) pretty neat.<p>and 2 years on servers? still worth a shot. I bet it can be much faster in certain scenarios.
评论 #34447402 未加载
azakai超过 2 年前
IIUC steps 5-7 in the exploit cause around 2^32 oopses. I don&#x27;t know much about the Linux kernel - could it perhaps have a limit on the number of oopses before it halts the entire system?<p>The article explains why it is important to not do that in general, as an oops allows debugging and recovery etc. But 2^32 of them seems suspicious.
评论 #34445788 未加载
Vecr超过 2 年前
When they say &quot;map the zero page&quot; in the article, it appears they are talking about the page with index zero, not the page with all zeros in it. Does anyone know if this is correct?
评论 #34464862 未加载
评论 #34451332 未加载
评论 #34453017 未加载
评论 #34451637 未加载
nineteen999超过 2 年前
I&#x27;m really curious why there aren&#x27;t more enterprise-grade, production ready kernels at this point. Isn&#x27;t Rust nearing maturity? Doesn&#x27;t the community have tonnes of enterprise ready C code that could be used as a reference (ie. Linux, BSD) of &quot;what not to do&quot;?<p>I&#x27;m not trying to start an argument here, I think the world knows that C&#x2F;C++ make it way too easy to shoot ourselves in the foot by now. I know that writing operating systems is hard and takes a long time, i&#x27;ve written my own prototype single and multitasking operating systems for x86_32, 68k, Z80, 6502 etc. I&#x27;m aware that Rust support has been added to recent Linux kernels, for the limited use case of writing secure device drivers. None of these things are news to me, so please don&#x27;t regurgitate these points.<p>But given the great body of reference that is available, the enthusiasm in the Rust community for the promise of more secure operating system kernels, I&#x27;m genuinely suprised that things aren&#x27;t further along. Yes I&#x27;m aware of Redox, but it seems more aimed at desktop use, and last time I tried it didn&#x27;t even boot.<p>Projects in C&#x2F;C++ seem to be making much faster progress eg. SerenityOS than the Rust community. What is holding Rust back in this area? This is a genuine question, not intending to inflame the discussion. I&#x27;m spending some time learning Rust as I can afford, but am not opinionated one way or the other yet.<p>Where are all the Linux replacements that I would have imagined to be up and running by now given Rust&#x27;s maturity? What am I missing here? Happy to be genuinely informed.<p>I kind of expected there to be a bunch of projects in flight by now, ala bazaar style, with the Rust community starting to conglomerate around the strongest contenders and move them forward at a rapid pace.
评论 #34447888 未加载
评论 #34448477 未加载
评论 #34449714 未加载
评论 #34450169 未加载
评论 #34491986 未加载
评论 #34450745 未加载
评论 #34450621 未加载
评论 #34449436 未加载
评论 #34449890 未加载
评论 #34447850 未加载
评论 #34448801 未加载
jeffbee超过 2 年前
The article is about the exploitability of the flaw but really the flaw should not exist. Printing &#x2F;proc&#x2F;$pid&#x2F;smaps is not on any conceivable performance-critical hot path. It can stand to have bounds checks and safety. The call to print out smaps should be well-encapsulated in some non-C language.
评论 #34445043 未加载
评论 #34445236 未加载
评论 #34445767 未加载
评论 #34446426 未加载
评论 #34445654 未加载
评论 #34444751 未加载