Wanted to download an ISO, ended up writing a kernel exploit

Posted 2 days ago by 0xdeafbeef
332 points

https://blog.dfb.sh/blog/eap770-root-for-two-zeros/

Author here. Does anyone know what to do with the rest of the drivers? I found at least 13 in-tree drivers with the same bug class. The nasty part is they work fine on x86 and silently corrupt data on arm and other non-coherent archs, and I don't have the hardware to test them.

I'd guess that's what the DMA API is for and drivers shouldn't be doing cache maintenance by hand, but I'm not a kernel dev, so maybe I'm missing something.

Wanted to download an ISO, ended up writing a kernel exploit

31 comments