Re: Re: Linux kernel i386 SMP page fault handler privilege escalation

[Paul Starzetz <ihaquer () isec pl>]

On Thu, 13 Jan 2005, Christophe Devine wrote:

> Exploiting the race condition itself is quite tricky, especially if the
> system load is high. The following proof-of-concept code may be used to
> check if an x86 SMP kernel is vulnerable; it is a bit unreliable though.

That is not really correct. Exploiting this race condition is very easy, 
however it is always difficult to exploit SMP race conditions if the load 
is high, since you must achieve parallel execution of two threads and the 
scheduler may prevent you from parallel execution in that case.

-- 
Paul Starzetz
iSEC Security Research
http://isec.pl/


_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.netsys.com/full-disclosure-charter.html