TGViewer
Channel Public Channel
Linux Kernel Security

Linux Kernel Security

@linkersec

Links related to Linux kernel security and exploitation | Chat @linkersec_chat | @xairy @a13xp0p0v | Mirrors on https://xairy.io/linkersec
Open in Telegram
Subscribers
4.74K
Photos
123
Videos
0
Links
356

Showing posts older than #86 · Back to latest

Older Posts 20 shown
Post #85 1.02K
A foray into Linux kernel exploitation on Android

An article describing an attempt to exploit the pvrsrvkm driver on an Alcatel 1S 2019.

https://mcyoloswagham.github.io/linux/
mcyoloswagham.github.io A foray into Linux kernel exploitation on Android In November of 2020, I decided to dive into the world of Android, more specifically the linux kernel. I did this because earlier in the year, around February, I broke my old phone during a skiing trip and hastily bought a cheap android phone, the Alcatel…
  • 🔥 1
Post #84 2.81K
Stealthily Introducing Vulnerabilities in Open-Source Software via Hypocrite Commits

A research about introducing vulnerabilities into the kernel while pretending to fix bugs. The researchers succeeded.

This research was done last year, but subsequent (seemingly unrelated) work by the same authors is now causing a lot of drama in the Linux kernel community.

Paper: https://github.com/QiushiWu/QiushiWu.github.io/blob/main/papers/OpenSourceInsecurity.pdf
Drama: https://twitter.com/gregkh/status/1384785747874656257
GitHub qiushiwu.github.io/papers/OpenSourceInsecurity.pdf at main · QiushiWu/qiushiwu.github.io Contribute to QiushiWu/qiushiwu.github.io development by creating an account on GitHub.
Post #83 900
Rust in the Linux kernel

An RFC patch series that adds Rust support to the kernel has been posted. It aims to provide wrappers for the core kernel APIs and allow implementing kernel modules in safe Rust.

The series includes a work-in-progress Rust implementation of the Android binder driver.

See the cover letter for the high-level design outline and the blog post for a deeper explanation of the implementation of an example module.

Cover letter: https://lore.kernel.org/lkml/20210414184604.23473-1-ojeda@kernel.org/
Blog post: https://security.googleblog.com/2021/04/rust-in-linux-kernel.html
Google Online Security Blog Rust in the Linux kernel Posted by Wedson Almeida Filho, Android Team In our previous post , we announced that Android now supports the Rust programming language...
Post #82 929
Four Bytes of Power: exploiting CVE-2021-26708 in the Linux kernel

I've published the article about exploiting CVE-2021-26708 for local privilege escalation on Fedora 33 Server for x86_64, bypassing SMEP and SMAP.

https://a13xp0p0v.github.io/2021/02/09/CVE-2021-26708.html

PoC exploit demo video: https://www.youtube.com/watch?v=EC8PFOYOUgU
Alexander Popov Four Bytes of Power: Exploiting CVE-2021-26708 in the Linux kernel CVE-2021-26708 is assigned to five race condition bugs in the virtual socket implementation of the Linux kernel. I discovered and fixed them in January 2021. In this article I describe how to exploit them for local privilege escalation on Fedora 33 Server…
Post #81 1.41K
BleedingTooth: Exploiting Bluetooth RCE in the Linux kernel

BleedingTooth is a set of zero-click vulnerabilities in the Linux Bluetooth subsystem that can allow an unauthenticated remote attacker in short distance to execute arbitrary code with kernel privileges on vulnerable devices.

https://google.github.io/security-research/pocs/linux/bleedingtooth/writeup
security-research BleedingTooth: Linux Bluetooth Zero-Click Remote Code Execution This project hosts security advisories and their accompanying proof-of-concepts related to research conducted at Google which impact non-Google owned code.
Post #78 896
KFENCE — Detecting memory bugs in production kernels

A blog post about KFENCE, a low-overhead sampling-based memory safety error detector for the Linux kernel.

https://thomasw.dev/post/kfence/
Thomas KFENCE - Detecting memory bugs in production kernels On February 26 this year KFENCE was merged into the upstream kernel source, ready for release in Linux 5.12. KFENCE is basically a low-overhead address sanitizer, but actually so low-overhead that it can run in production kernels on live systems whereas the…
Post #77 834
Android Security Bulletin — January 2021

A fix for an uninitialized memory disclosure in core files, two fixes for speculative execution bugs, and a bunch of fixes for Qualcomm drivers.

A note regarding one of the latter: "There are indications that CVE-2020-11261 may be under limited, targeted exploitation."

https://source.android.com/security/bulletin/2021-01-01#kernel-compoents
https://source.android.com/security/bulletin/2021-01-01#qualcomm-components
  • 👍 1
Post #72 827
Exploiting Kernel Races Through Taming Thread Interleaving

A Black Hat talk about using interrupts to widen race windows when exploiting race conditions. By Yoochan Lee.

Video: https://www.youtube.com/watch?v=5M3WhLVLCzs
Slides: https://i.blackhat.com/USA-20/Thursday/us-20-Lee-Exploiting-Kernel-Races-Through-Taming-Thread-Interleaving.pdf
YouTube Exploiting Kernel Races through Taming Thread Interleaving A kernel race condition vulnerability is difficult to exploit, because thread interleaving is non-deterministic and cannot be controlled. Thus, conventional exploitation techniques against kernel races simply attempt to brute force, i.e., keep exploiting…
Post #67 759
Dynamic Program Analysis for Fun and Profit

Dmitry Vyukov talks about dynamic bug-detection tools for the Linux kernel. Part of the Linux Foundation Mentorship Series.

Video: https://www.youtube.com/watch?v=ufcyOkgFZ2Q
Slides: https://linuxfoundation.org/wp-content/uploads/Dynamic-program-analysis_-LF-Mentorship.pdf
YouTube Mentorship Session: Dynamic Program Analysis for Fun and Profit Enjoy the videos and music you love, upload original content, and share it all with friends, family, and the world on YouTube.
Older posts →
Threads Profile ViewerView any public Threads profile without an account.Open ThreadLook →Writing with AI? Make it sound human.Metric37 rewrites AI drafts so they read naturally. Free AI detector, 1,500 words free.Try Metric37 →