Which attacks can be executed with a leaked pointer?

  • That depends entirely upon the pointer being leaked. – MechMK1 Sep 17 '19 at 11:35
  • Could you list some of the main cases? – Maicake Sep 17 '19 at 11:42
  • There are kernels where making the addresses of anyways accessable structures is a primary mean of protection. My first opinion was that it is a crap solution, but it is being done also by OSes developed by competent people. – peterh - Reinstate Monica Sep 17 '19 at 12:07
  • We can't really give a useful answer unless you tell us more about the threat model (who is the attacker and what do they want?), the attack surface (which kernel are we talking about?), and the security model (what is the attacker already allowed to do, and what are you trying to prevent them from doing?). – Kevin Sep 17 '19 at 21:46

Browse other questions tagged or ask your own question.