Linux Kernel Security

Patch-Gapping the Google Container-Optimized OS for $0

Detailed article by h0mbre about exploiting a slab use-after-free in the network scheduler subsystem to target the COS 105 kernelCTF instance.

Mali-cious Intent: Exploiting GPU Vulnerabilities (CVE-2022-22706 / CVE-2021-39793)

Article by Ng Zhi Yang about exploiting a logical bug in the Arm Mali GPU driver discovered a few years ago.

The bug allows gaining write permissions to a read-only memory region. The article explains how to exploit this bug from the untrusted_app context on Pixel 6 to load an arbitrary kernel module to disable SELinux and spawn a root reverse shell.

Accidentally uncovering a seven years old vulnerability in the Linux kernel

Article by Anderson Nascimento about finding and analyzing a slab use-after-free vulnerability in the TCP sockets implementation.

ksmbd vulnerability research

Article by Norbert Szetei about fuzzing the ksmbd module with syzkaller and finding a few memory corruption vulnerabilities.

KernelSnitch: Side-Channel Attacks on Kernel Data Structures

Paper by Lukas Maar et al. about using a timing side-channel for leaking addresses of exploitation-relevant kernel structures.

Finding Bugs in Kernel series

A series of introductory articles by Slava Moskvin about using KASAN and syzkaller for finding kernel vulnerabilities.

The Qualcomm DSP Driver — Unexpectedly Excavating an Exploit

An article by Seth Jenkins about investigating kernel crash logs produced by an In-The-Wild exploit that targeted the adsprpc Qualcomm driver and finding several vulnerabities in that driver.

Bootkitty: Analyzing the first UEFI bootkit for Linux

Martin Smolár and Peter Strýček published a report about a PoC UEFI bootkit targeting Linux systems. The bootkit patches GRUB, disables the signature checking for Linux kernel modules, and loads malicious userspace libraries into the init process.

This bootkit turned out to be created by Korean cybersecurity students.

Diving into Linux kernel security

Alexander Popov (me) published his H2HC talk slides that describe how to get started with learning Linux kernel security and knowingly configure the security parameters of Linux-based systems.

OtterRoot: Netfilter Universal Root 1-day

An article by Pedro Pinto about exploiting a slab double-free bug in the netfilter subsystem.

Pedro wrote two exploits for this bug: one that relies on ROP and that was used to exploit a kernelCTF instance, and the other that gets physical memory arbitrary read/write without relying on any offsets.

Novel approach to exploit a limited OOB on Ubuntu at Pwn2Own Vancouver 2024

Slides from a talk by Pumpkin Chang about exploiting a stack out-of-bounds write bug in the traffic control subsystem.

Pumpkin shaped vmalloc memory to make the stack out-of-bounds access land in an eBPF bytecode allocation and used the write primitive to overwrite the eBPF bytecode as it was being JITed.

Defects-in-Depth: Analyzing the Integration of Effective Defenses against One-Day Exploits in Android Kernels

An outstanding paper by Lukas Maar et al. about analyzing the exploitation techniques used in public 1-day Android kernel exploits over the last few years and cross-referencing them with the mitigations implemented by various Android vendors 🔥

1day vuln dev: DirtyCOW

A video by SideQuest covering the author's approach to analyzing the DirtyCow vulnerability.

Restricting Unprivileged User Namespaces In Ubuntu

A talk (video) by John Johansen and Maxime Bélair about restricting capabilities within user namespaces in Ubuntu 24.04.

Utilizing Cross-CPU Allocation to Exploit Preempt-Disabled Linux Kernel

A talk (video) by Mingi Cho and Wongi Lee about exploiting a slab use-after-free bug in the netfilter subsystem and an out-of-bounds bug in the traffic control subsystem.

The researchers managed to exploit both bugs on the kernelCTF migitation instance. Notably, they relied on cross-CPU slab/page_alloc shaping techniques in both exploits.

Unleashing a 0day: Pivoting Capabilities and Conquering the Linux Kernel

A talk (video) by Pedro Pinto about exploiting a slab use-after-free bug in the traffic control subsystem.

The author performed multiple cross-cache attacks to ultimately get an arbitrary read/write primitive via pipe_buffer->page and escalate privileges via modprobe_path.

Pedro also shared his experience submitting this bug to the KernelCTF bug bounty program.

More Bang for Your Bug!

Slides for the talk at the Linux Plumbers conference by Eduardo Vela and Space Meyer about kernelCTF, kernel attack surface, and exploit mitigations.