Also: very worth reading Tavis' advisory:<p><a href="http://archives.neohapsis.com/archives/fulldisclosure/2010-01/0346.html" rel="nofollow">http://archives.neohapsis.com/archives/fulldisclosure/2010-0...</a><p>This is an awesome bug; he had to use CreateRemoteThread to jump into a process with special permissions, then exploit the difference in the way segment selectors are handled from normal 32 bit code and simulated real mode, and finally write code that would make the iret instruction fail to get a trap frame to play with.