Which attacks can be executed with a leaked pointer?

closed as too broad by MechMK1, Conor Mancone, Xander, Mark, Lie Ryan Sep 18 at 0:53

Please edit the question to limit it to a specific problem with enough detail to identify an adequate answer. Avoid asking multiple distinct questions at once. See the How to Ask page for help clarifying this question. If this question can be reworded to fit the rules in the help center, please edit the question.

  • That depends entirely upon the pointer being leaked. – MechMK1 Sep 17 at 11:35
  • Could you list some of the main cases? – Maicake Sep 17 at 11:42
  • There are kernels where making the addresses of anyways accessable structures is a primary mean of protection. My first opinion was that it is a crap solution, but it is being done also by OSes developed by competent people. – user259412 Sep 17 at 12:07
  • We can't really give a useful answer unless you tell us more about the threat model (who is the attacker and what do they want?), the attack surface (which kernel are we talking about?), and the security model (what is the attacker already allowed to do, and what are you trying to prevent them from doing?). – Kevin Sep 17 at 21:46

Browse other questions tagged or ask your own question.