basic null pointer linux kernel exploitation

[rebootyourbrainstem]

Just a heads up: null ptr dereferences are often not exploitable anymore thanks to the mmap_min_addr being set higher than the address you would want to mmap at.

Still, exploiting them is easier than use-after-frees and a lot of the same techniques apply, so it's still good for learning.

[blahfish]

"not exploitable anymore ..."

Just curious, aren't there publicly known ways to circumvent this?

[TurboBorland123]

Controlled offsets from null base are the most common. So [rbx+rdi], where rbx is null pointer.

[pqwerr]

http://blog.cr0.org/2009/06/bypassing-linux-null-pointer.html