Comment by stackghost
1 day ago
Analysis of the POC concurs with my tests that confirm that the portion of `su` that gets overwritten does not survive a reboot.
1 day ago
Analysis of the POC concurs with my tests that confirm that the portion of `su` that gets overwritten does not survive a reboot.
it's living in your page cache, not on your disk. flush the caches and it'll disappear.
Indeed. But it's easier to just kill a container or a k8s node and reprovision than to flush the caches
Should be able to just echo a 1 to /proc/sys/vm/drop_caches.