From 84cc7fee1c84611f866fa6ef637967e62b220139 Mon Sep 17 00:00:00 2001 From: Andrew Lin <35786166+classAndrew@users.noreply.github.com> Date: Sun, 21 Jul 2024 12:56:37 -0500 Subject: [PATCH] Fix typo (#265) Change return-object programming to return-oriented programming. --- lkmpg.tex | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/lkmpg.tex b/lkmpg.tex index 1f83fc8c..56c8b36a 100644 --- a/lkmpg.tex +++ b/lkmpg.tex @@ -1760,7 +1760,7 @@ \subsection{Flashing keyboard LEDs} Keyboard LEDs are present on every hardware, they are always visible, they do not need any setup, and their use is rather simple and non-intrusive, compared to writing to a tty or a file. From v4.14 to v4.15, the timer API made a series of changes to improve memory safety. -A buffer overflow in the area of a \cpp|timer_list| structure may be able to overwrite the \cpp|function| and \cpp|data| fields, providing the attacker with a way to use return-object programming (ROP) to call arbitrary functions within the kernel. +A buffer overflow in the area of a \cpp|timer_list| structure may be able to overwrite the \cpp|function| and \cpp|data| fields, providing the attacker with a way to use return-oriented programming (ROP) to call arbitrary functions within the kernel. Also, the function prototype of the callback, containing a \cpp|unsigned long| argument, will prevent work from any type checking. Furthermore, the function prototype with \cpp|unsigned long| argument may be an obstacle to the forward-edge protection of \textit{control-flow integrity}. Thus, it is better to use a unique prototype to separate from the cluster that takes an \cpp|unsigned long| argument.