Whitepaper discussing how Linux 2.6.x vsyscalls may be used as powerful attack vectors.
You can download it from the following link: https://packetstormsecurity.com/files/download/37791/ret-onto-ret_en.txt
Source: https://packetstormsecurity.com/files/37791/ret-onto-ret_en.txt.html