Comment by userbinator
2 days ago
Map 127 SysV shared memory segments, unmap them via munmap(), and fork 259 processes to wrap the shared memory attach count to -32,643.
LOL. The actual exploit code at https://news.ycombinator.com/item?id=24456247
2 days ago
Map 127 SysV shared memory segments, unmap them via munmap(), and fork 259 processes to wrap the shared memory attach count to -32,643.
LOL. The actual exploit code at https://news.ycombinator.com/item?id=24456247
?? it seems pretty well documented code? sure a bunch refers to internals of what the exploit is touching, that might be tricky to follow but you cant expect comments to go and explain all touched subsystems etc. that documentation is in the software being targeted.... openBSD has really good docs..
Do you really consider "The SHM attachment-counter wrap and detach race publish NEW with a freed UAO." a valid sentence? It has hints of what it does, but is otherwise nearly undecipherable.
Later on, there's "Three additional children compensate for banking 127 rather than 128 records per vmspace and still cross the signed 16-bit boundary." which at first glance appears to be something about bank-switching, but isn't.
I fond some llms gemerate awful code comments. Claude is the worst offender I use.