Surge 2015 - Lightning Talks

Perhaps the talk[1] given by Bryan Cantrill in 2015, and mentioned in footnote 1 of the article, may have alerted someone to the possibility that there might be something exploitable here? In addition, any of the other online discussions of madvise(,,MADV_DONTNEED), mentioned in that talk, may have attracted someone's interest. This exploit seems to lie at the intersection of several things that I guess might indicate a higher-than-average risk of exploitability: shared memory, special provisions for debugging access to running processes, complicated and unintuitive (if not broken) semantics, and concurrency. [1] [VIDEO]

From the paper. > and subsequently allow the kernel to immediately reuse the associated physical memory. On Linux, this can be achieved by passing the MADV_DONTNEED flag to the the madvise system call. Shouldn't this be MADV_FREE? This instantly reminded me of this classic Bryan Cantrill talk [VIDEO] Edit: It seems that the Linux behavior is relied upon? From later in the paper. > Note that it is even legal for a page to be unloaded while the page con-tent is being read optimistically. This is possible since the virtual memory region reserved for a buffer frame always remains valid (see above), and read accesses to a memory region that was marked with the MADV_DONTNEED flag simply result in zero bytes. No additional physical memory is allocated in this case, as all such accesses are mapped to the same zero page

Although this is true on Linux, it's worth noting that this behavior doesn't match the specified behavior of posix_madvise.[1] It was also a subject of Bryan Cantril's hilarious "A crime against common sense" Surge 2015 talk (at ~1:06:50).[2] [1]: [LINK] [2]: [VIDEO]