Re: Security fix for remapping of page 0 (was [PATCH] Change ZERO_SIZE_PTR to point at unmapped space)

Linus Torvalds
2009-06-03T18:45:57Z

On Wed, 3 Jun 2009, Larry H. wrote:
> >
> > The fact, the NULL pointer attack is neither easy nor common. It's
> > perfectly reasonable to say "we'll allow mmap at virtual address zero".
>
> And how could you calibrate if this attack venue isn't easy to take
> advantage of? Or not commonly abused? What empirical results led you to this
> conclusion?

It's not a primary attack vector. You need to have already broken local
security to get there - you need to be able to execute code.

That means that you've already by-passed all the main security. It's thus
by definition less common than attack vectors like buffer overflows that
give you that capability in the first place.

Linus