At 01:09 AM 12/2/03 -0800, Eric Cordian wrote:

As reported today on Slashdot, in linux kernels prior to 2.4.23, it is possible to map the kernel into user space with brk(), since apparently no one ever bothered to check that the argument passed was in the lower 3 gig of the address space.

Question from a BSDer: Was this bug in the NSA's secure version?