Total pwnage

I'm wondering why kernel developers (or vendors?) continue to claim that kernel memory corruption are just Denial of Service. Most of the times they _are_ exploitable... yes, even when the vulnerability is remotely triggered, yes... even when the corruption takes place in a freaking slub in the middle of a kernel _heap_ ... yes even when you have kernel data pages marked NX and the kernel .text read-only and yes, absolutely yes even when you start only with a 16-bit displacement...

That particular vulnerability is long fixed in the kernel, but the whole posting is worth a read for those interested in how a kernel buffer overflow can become a remote root exploit