Linux Kernel Security

CVE-2022-0435: Linux Kernel Remote Stack Overflow

Samuel Page disclosed remotely and locally reachable stack overflow in Transparent Inter-Process Communication (TIPC).

This bug exists since kernel version 4.8. For RCE, a vulnerable system must have TIPC module loaded and TIPC bearer enabled.

Samuel also posted a funny overview of his experience in disclosing Linux kernel vulnerabilities.

CVE-2022-0185: Linux kernel slab out-of-bounds write: exploit and writeup

An article by @lockedbyte with another write-up for the slab-out-of-bounds bug in the fsconfig syscall handler. The exploit is attached to the oss-security post.

CVE-2022-0185 - Winning a $31337 Bounty after Pwning Ubuntu and Escaping Google's KCTF Containers

An article describing an exploit for a slab-out-of-bounds bug in the fsconfig syscall handler. By FizzBuzz101, @clubby789, @ryaagard, @Chronos190, @ginkoid, and @chop0_.

Authors managed to both get LPE on the Ubuntu kernel and escape the kCTF infrastructure container, and thus claim the kCTF VRP bounty.

The bug was found with syzkaller, and it was also reported by syzbot.

CVE-2021-45608: NetUSB RCE Flaw in Millions of End User Routers

Max Van Amerongen published an analysis of a vulnerability in the NetUSB proprietary driver, which is used in products of many network device vendors.

The researcher briefly describes the exploitation strategy but does not share many details.

Linux kernel exploit development tutorial

ChrisTheCoolHut published a GitBook tutorial about writing Linux kernel exploits along with the source code for tasks and their solutions.

Automated RE of Kernel Configurations

Brandon Miller published an article about his Binary Ninja plugin that analyzes Linux kernel binaries to recover kernel configuration options.

This tool is called bn-kconfig-recover. It can help when a kernel binary has CONFIG_IKCONFIG disabled.

Not all kconfig options are supported. Work on this tool is in progress.

CVE-2021-44733: Fuzzing and exploitation of a use-after-free in the Linux kernel TEE subsystem

An article about a bug in the Trusted Execution Environment subsystem. By Patrik Lantz.

The bug was found by syzkaller; descriptions are included in the article. An exploit for controlling PC is also provided along with instructions for reproducing. The exploit does not bypass PAN.

Usenix 2021

Papers on Linux kernel security presented at Usenix back in August:

— SyzVegas: Beating Kernel Fuzzing Odds with Reinforcement Learning [paper] [slides] [video] presented by Daimeng Wang.

— ExpRace: Exploiting Kernel Races through Raising Interrupts [paper] [slides] [video] presented by Yoochan Lee.

— SHARD: Fine-Grained Kernel Specialization with Context-Aware Hardening [paper] [slides] [video] presented by Muhammad Abubakar.

— Detecting Kernel Refcount Bugs with Two-Dimensional Consistency Checking [paper] [slides] [video] presented by Xin Tan.

— An Investigation of the Android Kernel Patch Ecosystem [paper] [slides] [video] presented by Zheng Zhang.

— Undo Workarounds for Kernel Bugs [paper] [slides] [video] presented by Seyed Mohammadjavad Seyed Talebi.

— An Analysis of Speculative Type Confusion Vulnerabilities in the Wild [paper] [slides] [video] presented by Ofek Kirzner.

Attacking Samsung RKP

An article by Alexandre Adamski about vulnerabilities in Real-time Kernel Protection of Samsung phones. Two of the found bugs allow bypassing certain RKP restrictions, and the third one allows to compromise RKP itself.

The article is a follow-up to A Samsung RKP Compendium, which describes the internals of Samsung RKP.

Nice improvement in my Linux Kernel Defence Map.

See how the Control Flow Hijack part looks now ⬆️

I'd appreciate your feedback.

Ubuntu LPE exploit from Pwn2Own

Flatt Security published a whitepaper on exploiting Linux kernel eBPF vuln leading to OOB RW primitive.

They used it against Ubuntu Desktop 20.10 at Pwn2Own 2021.

Struggle with slab freelist hardening in a CTF task

Kileak described the solution of a kernel task IPS from VULNCON CTF. The researcher had a hard fight against SLAB_FREELIST_RANDOM and SLAB_FREELIST_HARDENED.

CVE-2021-1048: refcount increment on mid-destruction file

This vuln analysis was published by Jann Horn in the "0-days In-the-Wild" blog maintained by Google Project Zero. However, they have no exploit sample to analyze.

This is an object state confusion with UAF that was patched in the upstream Linux kernel but forgotten by some Android vendors.

Jann says this situation is similar to the "Bad Binder" case.

[CVE-2021-42008] Exploiting a 16-Year-Old Vulnerability in the Linux 6pack Driver

The researcher D3v17 published an article about exploiting an old heap OOB write in the N_6PACK tty line discipline. This bug has been reported by syzbot.

Exploiting CVE-2021-43267 — a bug in the TIPC module

Blasty published an article on how to escalate privileges via the slab-buffer-overflow in the Transparent Inter-Process Communication (TIPC) module. A PoC is provided as well.

The vulnerability was previously discovered by maxpl0it, and it's claimed to be exploitable both locally and remotely.

Fuzzing the Linux kernel yet again

A text version of my PHDays "Fuzzing the Linux kernel" talk is now available in both English and Russian.

Contains an overview of Linux kernel fuzzing approaches and related tips.

Thanks to folks from @xakep_ru for transcribing and translating!

Links to the original talk: slides, video (ru), video (en-dub).

Fall of the machines: Exploiting the Qualcomm NPU kernel driver

An article about exploiting a use-after-free and two info-leaks in the Qualcomm Neural Processing Unit driver. By Man Yue Mo.

The exploit leaks pointers via info-leaks, overwrites and triggers a function pointer via a racy CPU/NPU use-after-free, runs arbitrary eBPF code via __bpf_prog_run32, disables SELinux by overwriting unprotected selinux_enforcing, and launches a shell via call_usermodehelper.

The article mentions that while Samsung's NPU driver is now restricted by SELinux, the Qualcomm's one is not. This makes the latter a target for untrusted_app->root exploits on devices with Qualcomm chipsets.

Deep discussion of my pkill_on_warn version 2 on LKML

Topics:
⚙️ Fail-Fast principle
⚙️ Kernel error handling policy
⚙️ Safety-critical system design
⚙️ BUG_ON() vs WARN_ON()
⚙️ Brainstorming ideas

See this email thread if you're interested in system software development.

I don't think that pkill_on_warn version 3 will appear, though.

This year's education module on kernel security at pwn.college

Agenda of lectures and exercises:
🔘 Introduction
🔘 Environment Setup
🔘 Kernel Modules
🔘 Privilege Escalation
🔘 Escaping Seccomp
🔘 Memory Management

See more details in the announcement by Zardus.

SLUB overflow CVE-2021-42327

A concise article about exploiting a slab buffer-overflow bug in the AMD GPU driver. By Thelford Williams.

The author didn't have access to an AMD GPU, so they manually replicated the vulnerable code. The exploit uses msg_msg elastic objects to leak the kernel address, overwrite slab freelist pointer, allocate memory containing modprobe_path, and overwrite it for code execution.