From fefb8a39e14d43d7a275fcf25c2f893d15f04490 Mon Sep 17 00:00:00 2001 From: helloexp <21156949+helloexp@users.noreply.github.com> Date: Mon, 18 Apr 2022 13:08:31 +0800 Subject: [PATCH] update README.md --- 98-Linux提权/CVE-2022-0847-DirtyPipe提权/README.md | 11 ++++------- 1 file changed, 4 insertions(+), 7 deletions(-) diff --git a/98-Linux提权/CVE-2022-0847-DirtyPipe提权/README.md b/98-Linux提权/CVE-2022-0847-DirtyPipe提权/README.md index d75bba6..26270c7 100644 --- a/98-Linux提权/CVE-2022-0847-DirtyPipe提权/README.md +++ b/98-Linux提权/CVE-2022-0847-DirtyPipe提权/README.md @@ -4,13 +4,10 @@ 漏洞类似于 脏牛:CVE-2016-5195 “Dirty Cow”,但是更加容易利用 ## 提权限制 -the attacker must have read permissions (because it needs to splice() a page into a pipe) - -the offset must not be on a page boundary (because at least one byte of that page must have been spliced into the pipe) - -the write cannot cross a page boundary (because a new anonymous buffer would be created for the rest) - -the file cannot be resized (because the pipe has its own page fill management and does not tell the page cache how much data has been appended) +1. the attacker must have read permissions (because it needs to splice() a page into a pipe) +2. the offset must not be on a page boundary (because at least one byte of that page must have been spliced into the pipe) +3. the write cannot cross a page boundary (because a new anonymous buffer would be created for the rest) +4. the file cannot be resized (because the pipe has its own page fill management and does not tell the page cache how much data has been appended) ## 使用方法 ```shell