Changes

'''Publicly exploited''': No (but easy to exploit)

'''Publicly exploited''': No (but easy to exploit)

'''Discovered by''': plutoo, Mrrraou (independently, on October 31th 2016)

'''Discovered by''': plutoo (on September 11th, 2015), Mrrraou (independently, on October 31th, 2016)

get_process_name (syscall 0x6) does a signed comparison for the pid parameter (r0) and does not check if the pid is negative, which allows an arbitrary 0x20 bytes kernel read to userland memory.

get_process_name (syscall 0x6) does a signed comparison for the pid parameter (r0) and does not check if the pid is negative, which allows an arbitrary 0x20 bytes kernel read to userland memory.