I have no experience of kernel programming or anything low level. I just watched this video and at 21:10 the presenter started to talk about modifying kernel memory using two pointers.

From my understanding he simply points pointer A to some user memory t1 and B to some kernel memory t2, and after a syscall (which looks like memset) contents of t1 is copied to t2.

My question is: since this is mostly a concept demonstration, how does it work, and why the syscall does not check memory address? P.S. this is Cisco Unix 4.1.

  • 1
    "We discuss a set of 0-day kernel vulnerabilities in CNU..." We present the ... process which led to the discovery of the vulnerabilities described below. We also present methods of exploiting the following vulnerabilities remotely." -- that means nothing here is normal. These are demonstrations of bugs.
    – schroeder
    Commented Nov 17, 2022 at 14:37

1 Answer 1


Well, the presenter mentioned it: It is/was a security bug. Obviously the kernel didn't refuse to copy data into kernel memory - there was no check implemented.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .