TGViewer
Channel Public Channel
Linux Kernel Security

Linux Kernel Security

@linkersec

Links related to Linux kernel security and exploitation | Chat @linkersec_chat | @xairy @a13xp0p0v | Mirrors on https://xairy.io/linkersec
Open in Telegram
Subscribers
4.74K
Photos
123
Videos
0
Links
356

Showing posts older than #44 · Back to latest

Older Posts 20 shown
Post #42 685
Exploiting a Single Instruction Race Condition in Binder

Yet another exploitable use-after-free in Binder. By Maxime Peterlin, Philip Pettersson, Alexandre Adamski, and Alex Radocea.

https://blog.longterm.io/cve-2020-0423.html
Post #40 674
Kernel Integrity Enforcement with HLAT

Protecting the kernel from page-tables–based attacks with Hypervisor-managed Linear Address Translation Intel VT-x extension. A concept by Gao Chao from Intel.

Video: https://www.youtube.com/watch?v=N8avvE_neV0
Slides: https://static.sched.com/hosted_files/osseu2020/ce/LSSEU20_kernel%20integrity%20enforcement%20with%20HLAT%20in%20a%20virtual%20machine_v3.pdf
YouTube Kernel Integrity Enforcement with HLAT In a Virtual Machine - Chao Gao, Intel Corporation
Post #34 877
Linux kernel heap quarantine versus use-after-free exploits

An article summarizing the experiment.

If TLDR, see the poem at the end :)

https://a13xp0p0v.github.io/2020/11/30/slab-quarantine.html
Alexander Popov Linux kernel heap quarantine versus use-after-free exploits It's 2020. Quarantines are everywhere – and here I'm writing about one, too. But this quarantine is of a different kind. In this article I'll describe the Linux Kernel Heap Quarantine that I developed for mitigating kernel use-after-free exploitation.
Post #33 741
HITCON CTF 2020 — Linux kernel tasks

There were two kernel-related tasks: spark and atoms. spark required exploiting a memory corruption (see the writeups). atoms required causing a soft lockup and triggering the watchdog.

Sources and solutions: https://github.com/david942j/ctf-writeups/tree/master/hitcon-2020/
Mini-writeup and exploit for spark #1: https://github.com/BrieflyX/ctf-pwns/tree/master/kernel/spark
Mini-writeup (at the end) and exploit for spark #2: https://gist.github.com/sampritipanda/9fb8f1f92aef6591246e74ed5847c910
GitHub ctf-writeups/hitcon-2020 at master · david942j/ctf-writeups Collection of scripts and writeups. Contribute to david942j/ctf-writeups development by creating an account on GitHub.
Post #30 745
Kernel Exploitation With A File System Fuzzer

Another research about fuzzing the kernel via mounting corrupted filesystems. In the first part they describe the approach, but the slides could be better, so it's hard to understand what exactly they're doing (something based on Janus [1]?). The second part discusses the exploitability of some of the found bugs and demos RIP control for one of them.

Slides: https://cyberweek.ae/materials/2020/D1T2%20-%20Kernel%20Exploitation%20with%20a%20File%20System%20Fuzzer.pdf
Video: https://www.youtube.com/watch?v=95f1b4FcrQ4

[1] https://taesoo.kim/pubs/2019/xu:janus.pdf
Post #28 859
Brandon Falk continues hacking an old Motorola phone

The first two streams that included writing a kernel exploit to get arbitrary code execution were posted above. These few cover extracting a phone snapshot including all physical memory and register states and running it in QEMU. The streams are quite long, but can be partially skipped through to get an idea of what he's doing.

Stream 3: https://www.youtube.com/watch?v=RLzZPSPI8ds
Stream 4: https://www.youtube.com/watch?v=NJjpkzuc1k4
Stream 5, part 1: https://www.youtube.com/watch?v=6TzdYokXoF8
Stream 5, part 2: https://www.youtube.com/watch?v=hlW8ktQkyPA
Stream 6: https://www.youtube.com/watch?v=kATF_EIltHc
YouTube Dumping register and physical memory state with our Android exploit In this video we dump register and physical memory state "atomically" from the kernel with our exploit to get ready to lift the kernel into QEMU for fuzzing or analysis.
Post #24 1.25K
Linux Kernel Heap Quarantine testing and review

Kees Cook is testing Linux Kernel Heap Quarantine developed by Alexander Popov (me).

I'll post an article about the kernel heap experiment soon.

Recording: https://youtube.com/watch?v=1sBMwnKNSw0
Patch series:
https://www.openwall.com/lists/kernel-hardening/2020/09/29/2
YouTube 2020-10-06: Tooling, SLAB quarantine Stream 5: 2020-10-06 Twitch Stream https://twitch.tv/keescook/about Topics - Tooling https://github.com/kees/kernel-tools - SLAB quarantine https://lore.kernel.org/lkml/20200929183513.380760-1-alex.popov@linux.com/
Older posts →
Threads Profile ViewerView any public Threads profile without an account.Open ThreadLook →Writing with AI? Make it sound human.Metric37 rewrites AI drafts so they read naturally. Free AI detector, 1,500 words free.Try Metric37 →