Dirty Pagetable: A Novel Exploitation Technique To Rule Linux Kernel

An article by Nicolas Wu about the Dirty Pagetable exploitation technique.

Dirty Pagetable enables using a slab bug to overwrite userspace Page Table Entries and gain arbitrary read/write access to physical memory.

To demonstrate the technique, Nicolas Wu and Ye Zhang wrote a few exploits, including one for CVE-2023-21400, a racy slab double-free in the io_uring subsystem. The exploit gains root on Pixel 7.