Andreas Kling cbcf891040 Kernel: Move select Process members into protected memory ...

Process member variable like m_euid are very valuable targets for
kernel exploits and until now they have been writable at all times.

This patch moves m_euid along with a whole bunch of other members
into a new Process::ProtectedData struct. This struct is remapped
as read-only memory whenever we don't need to write to it.

This means that a kernel write primitive is no longer enough to
overwrite a process's effective UID, you must first unprotect the
protected data where the UID is stored. :^)

2021-03-10 22:30:02 +01:00

22 KiB

Raw Blame History

View Raw