Much ado about NULL: Exploiting a kernel NULL dereference

“Last time, we took a brief look at virtual memory and what a
NULL pointer really means, as well as how we can use the mmap(2)
function to map the NULL page so that we can safely use a NULL
pointer. We think that it’s important for developers and
system administrators to be more knowledgeable about the attacks
that black hats regularly use to take control of systems, and so,
today, we’re going to start from where we left off and go all
the way to a working exploit for a NULL pointer dereference in a
toy kernel module.

“A quick note: For the sake of simplicity, concreteness, and
conciseness, this post, as well as the previous one, assumes Intel
x86 hardware throughout. Most of the discussion should be
applicable elsewhere, but I don’t promise any of the details
are the same.”

Complete Story