Graphic CVE-2015-1805

Graphic CVE-2015-1805

CVE-2015-1805 is a general Linux kernel arbitrary address to write any value of the vulnerability, this vulnerability is worth remembering, here with four pictures intuitively described:

Note ]:

1 iov_fault_in_pages_write does not check whether iov-> iov_base is a Kernel Pointer. The test is completed in vfs_read. Therefore, exploit must be completed in an atomic pipe_read, that is, three consecutive copies.

Patch 2 only solves the problem of variable synchronization inside the function, but introduces the pipe cache offset and length non-synchronization problem between Function Multiple calls (CVE-2016-0774)