Linux Kernel ptrace/sysret Local Privilege Escalation

/ CVE-2014-4699 ptrace/sysret PoC by Vitaly Nikolenko [email protected] gcc -O2 pocv0.c This code is kernel specific. On Ubuntu 12.04.0 LTS 3.2.0-23-generic, the following will trigger the GP in sysret and overwrite the PF handler so we can land to our NOP sled mapped at 0x80000000. However, onc...

Linux Kernel ptrace/sysret - Local Privilege Escalation Exploit

The Linux kernel before 3.15.4 on Intel processors does not properly restrict use of a non-canonical value for the saved RIP address in the case of a system call that does not use IRET, which allows local users to leverage a race condition and gain privileges, or cause a denial of service double...