ICYMI RAP bypass for root -> kernel exploits on grsec. I did find the angry grsec/PaX replies entertaining too. Remember when grsec had to pay out a quarter mil because he couldn't handle critique? H/T @silviocesare nitter.vloup.ch/uid1000/status/1… theregister.co.uk/2018/06/11…
"Control-Flow Integrity for the Linux kernel: A Security Evaluation" is the work I've done for my Masters thesis where I analyze how the PaX Team's (public) RAP holds up to stop ROP when applied to the Linux kernel. You may want to check out chapter 3. alunos.dcc.fc.up.pt/~up20140…
1
6
This Post was deleted by the Post author.
This Post was deleted by the Post author.
This Post was deleted by the Post author.
This Post was deleted by the Post author.
This Post was deleted by the Post author.
"The Guaranteed End of Arbitrary Code Execution" is the title of a talk I gave in 2003. The title was referring to userland (PAGEEXEC+MPROTECT), was correct in 2003, and is correct today. The presentation discusses all nuance. Seems your problem is perhaps ignorance/laziness.
This Post was deleted by the Post author.
that's pretty rich from someone whose openning salvo was about 'entertaining himself with angry replies'. maybe try something with more substance, like technical info next time?

Dec 3, 2019 · 8:23 PM UTC

1
as for the point of his research, why not let him tell you exactly (from his 2nd mail to me over a year ago): "My goal is to exploit the kernel[...]". you tell me how to pull that off without a single bug...
1
This Post was deleted by the Post author.
quotes are a literary device used for diverse purposes, so instead of assuming any, maybe you could have asked what i meant? and still not a technical argument, i note.