Saint ret2dir, Who Returned to Direct Memory

Patron of Linux kernels, SMEP and SMAP protections, and pages that live two lives.

Life

Presented in 2014 by Vasileios Kemerlis, Michalis Polychronakis and Angelos Keromytis of Columbia University, ret2dir showed that the Linux kernel maps all of physical memory into a region called physmap. So every user page had a double in kernel space, and an exploit could jump into it, stepping over SMEP, SMAP, PXN and the other barriers between kernel and user. The authors proved it by rewriting exploits for old kernel bugs, and proposed a defence called XPFO.

Prayer

O Saint ret2dir, who finds copies of our rooms in the kernel's house, let every page live in one place only. Amen.

How to celebrate

Celebrated with a kernel that keeps physmap non-executable and randomised, while wondering where else our data lives.

Two houses, two doors to lock.