Exploiting CVE-2022-42703 - Bringing back the stack attack

An article by Seth Jenkins about exploiting a slab use-after-free side effect of a logical bug in the memory subsystem found by Jann Horn.

Seth used a cross-cache attack to overwrite an anon_vma structure and gain a limited arbitrary-write primitive. Seth then modified the context saved to the fixed-address cpu_entry_area region during a hardware exception. This allowed to corrupt the size passed to copy_to/from_user calls and thus get controlled stack read and write buffer overflows.

The article additionally expands on how KASLR is useless against local attackers due to side-channel vulnerabilities.