Unleashing a 0day: Pivoting Capabilities and Conquering the Linux Kernel

A talk (video) by Pedro Pinto about exploiting a slab use-after-free bug in the traffic control subsystem.

The author performed multiple cross-cache attacks to ultimately get an arbitrary read/write primitive via pipe_buffer->page and escalate privileges via modprobe_path.

Pedro also shared his experience submitting this bug to the KernelCTF bug bounty program.