[Collaborative post by Mateusz 'j00ru' Jurczyk & Gynvael Coldwind]
Early Sunday morning discussion has resulted in j00ru coming up with an idea to mitigate some variants of kernel exploitation techniques by introducing a CPU feature that would disallow execution control transfers in kernel-mode to code residing in user memory area pages (e.g. addresses < 0x80000000 on a 32-bit Windows with default settings). The idea was that the system would mark every page as either being allowed to execute code in ring-0 or not. And hey, guess what... Intel has already proposed such a feature a month ago! Furthermore, it seems that this exact idea was already described in 2008 by Joanna Rutkowska, and two days ago she has published a follow up post on her blog.
Pełna wersja posta jest dostępna po angielskiej stronie lustra (zgodnie z poprzednimi ustaleniami).
Links / Blogs
- → dragonsector.pl
- → vexillium.org
- Security/Hacking:
- Reverse Eng./Low-Level:
- Programming/Code:
Posts
- Making numbers out of thin air, Python bytecode edition,
- ClickMeeting minor privacy weakness (fixed),
- popen+cat explained,
- Gears of Chaos vulnerability chain (NETGEAR WAC104 access point),
- WAC104 vulnerabilities - please go patch (details on Monday),
- FAQ: Difference between vulnerability, exploit and CVE,
- Feral Terror vulnerability (some NETGEAR smart switches) [UPDATED 3],
- Just another Null Byte Poison via Unicode variant (MuPDF mutool RCE),
- How to document your knowledge (in a CV/resume),
- What's the probability of a downloaded ZIP being broken?,
- → see all posts on main page
Add a comment: