The flag that outlived the data.
Three lines from Dirty Pipe’s original exploit PoC drain a pipe. A live bit-level model shows why security-relevant state can survive—and how initialization breaks the chain.
public proof of concept
unsigned n = r > sizeof(buffer) ? sizeof(buffer) : r;
read(p[0], buffer, n);
r -= n;Source revision: Original disclosure / 2022-03-07. Exact source
The interactive browser model is an original bounded reconstruction; it does not execute the original source.
Inspect the model module · Read the mechanism, preconditions, defenses and limits