Hi,

We've published a paper about using 1 or 4 byte write-what-where
condition to convert a custom Data-Segment Descriptor entry in LDT of
a process into a Call-Gate (with DPL set to 3 and RPL to 0).
The paper also contains information about a possible LDT redirecting
into user-land memory.

The paper is Windows NT family (starting from Windows 2000 and XP) and
x86 protected mode specific.

The paper DOES NOT contain information about new or old
vulnerabilities. It only proposes a way to convert a potential
write-what-where vulnerability into code execution, in a stable
manner.

http://vexillium.org/dl.php?call_gate_exploitation.pdf 

More information is available on our blogs:
http://gynvael.coldwind.pl/?id=274 
http://j00ru.vexillium.org/?p=290&lang=en 

Comments are welcomed :)

Take care,
-- 
gynvael.coldwind//vx and j00ru//vx