Hacker News Reader

Analysis of the POC concurs with my tests that confirm that the portion of `su` that gets overwritten does not survive a reboot.

it's living in your page cache, not on your disk. flush the caches and it'll disappear.

Indeed. But it's easier to just kill a container or a k8s node and reprovision than to flush the caches

Should be able to just echo a 1 to /proc/sys/vm/drop_caches.