how2heap

modern mitigations have made exploits much more difficult, however researchers continue to find bypasses to these mitigations. there are "classic" techniques to bypass most of the modern protections and if there isn't then researchers often come up with novel attacks / bypasses. for example for heap protections you can see how2heap to bypass heap protections[0]. another example is an exploit which allows bypass of KASLR (which has since been patched)[1]. it looks like this exploit comes up with a "dirty pagetable" technique[2]. it's always a game of cat and mouse with more mitigations always being added while researchers constantly look to bypass them. [0] https://github.com/shellphish/how2heap [1] https://www.willsroot.io/2022/12/entrybleed.html [2] https://pwning.tech/nftables/#452-the-technique