Recently I have been reading about the implications of NULL pointer dereferences in kernel code (often LKMs/modules), specifically escalating privileges to root via
mmap()ing the NULL page and then
memcpy()ing some shellcode which calls
commit_creds(prepare_kernels_cred(0)); (or whatever else) from user-land to cause subsequent code to be executed in context of the root user (usually to spawn a root shell). This was a very popular exploitation method around over a decade ago.
mmap_min_addr, which prevents
mmap()ing of low pages was introduced, and people (of course) found ways to bypass it (the articles I read were all in 2009). However, there are (seemingly) no (known or public) methods of bypassing this mitigation (and of course other kernel-hardening causes memory-corruption bugs such as this to become more difficult or completely infeasible too).
Given this, just how detrimental are NULL pointer dereferences today? It seems as though the best one can leverage is denial-of-service (in a modern kernel with
mmap_min_addr enabled [perhaps neglecting ASLR, DEP/NX, SELinux/AppArmor/PaX/grsec, etc.]). Is it possible to leverage privilege escalation in particular environments? (Excluding disabling of
mmap_min_addr, of course). And if so, what are some examples?