News for hackers. Stuff that matters.

A comment on 0patching a 0-day: Windows gdi32.dll memory disclosure. Parent comment

Re:0patching a 0-day: Windows gdi32.dll memory disclosure by dielel on Friday March 03, 2017 @08:58AM (#13782830)
Hi, Stanka from 0patch here. If you want to enable or disable (aka "patch" or "unpatch" the application) you don't need do restart the application. Not even if your app is running and you've just install 0patch agent. This is how it is designed to work in user space. When the official MS patch is installed (hopefully with the fix) this particular 0patch won't apply anymore.

As we try to make 0patch agent robust and reliable we don't support kernel mode at this moment - we will make this step slow and with great caution.

[ Parent | on HN ]
Re:0patching a 0-day: Windows gdi32.dll memory disclosure by j_s on Friday March 03, 2017 @09:32AM (#13783051)
Can you please clarify whether or not this specific patch is user mode or kernel mode? @johntb86 mentioned GDI is split and this is the user mode part.
[ Parent | on HN ]
Re:0patching a 0-day: Windows gdi32.dll memory disclosure by dielel on Friday March 03, 2017 @09:45AM (#13783152)
Our micropatch (7 of them, really, for 4 different Windows OS versions) for CVE-2017-0038 is user-mode. As are currently all our micropatches. Processes using gdi32.dll do not need to be relaunched to have it applied.
[ Parent | on HN ]