Skip to content

Commit 55b27a6

Browse files
committed
Add mnt_parent check to kernel version validation
1 parent b51acfd commit 55b27a6

File tree

1 file changed

+1
-1
lines changed
  • volatility3/framework/symbols/linux/extensions

1 file changed

+1
-1
lines changed

volatility3/framework/symbols/linux/extensions/__init__.py

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1574,7 +1574,7 @@ def _is_kernel_prior_to_struct_mount(self) -> bool:
15741574
'True' if the kernel lacks the 'mount' struct, typically indicating kernel < 3.3.
15751575
"""
15761576

1577-
return not self._context.symbol_space.has_type("mount")
1577+
return (not self._context.symbol_space.has_type("mount")) and self.has_member("mnt_parent")
15781578

15791579
def is_equal(self, vfsmount_ptr) -> bool:
15801580
"""Helper to make sure it is comparing two pointers to 'vfsmount'.

0 commit comments

Comments
 (0)