I want to demonstrate an out-of-bound memory read exploit for a global variable inside the Linux Kernel's fs module. For this purpose, I want the virtual address space of fs to be static (i.e. not randomized).

I have already disabled CONFIG_RANDOMIZE_BASE. As a result, the physical address of the global variable variable will always be the same. However, since I am executing this exploit through a system call, I can only interact with the virtual address. So I will like the virtual addresses to be deterministic as well.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.