maestro
maestro copied to clipboard
MemSpace::map can overwrite kernel pages
When run with MAP_FIXED
, MemSpace::map
has no limits to where a page is requested. Furthermore, it will always unmap any pre-existing page. This means that a user can hijack kernel pages (and thus execution) with mmap
or the ELF parser.