Hacker News new | ask | show | jobs
by stackghost 46 days ago
Analysis of the POC concurs with my tests that confirm that the portion of `su` that gets overwritten does not survive a reboot.
1 comments
wang_li 46 days ago
it's living in your page cache, not on your disk. flush the caches and it'll disappear.
link
stackghost 46 days ago
Indeed. But it's easier to just kill a container or a k8s node and reprovision than to flush the caches
link
wang_li 46 days ago
Should be able to just echo a 1 to /proc/sys/vm/drop_caches.
link