SETTLERS OF NETLINK: Exploiting a limited UAF in nf_tables (CVE-2022-32250)

A detailed write-up by Cedric Halbronn, Alex Plaskett, and Fidgeting Bits about exploiting a slab use-after-free bug in the netfilter subsystem.

Sanitizing the Linux kernel: On KASAN and other Dynamic Bug-finding Tools

Slides from a talk by Andrey Konovalov about Sanitizers — a family of Linux kernel bug detectors.

The talk covers:

🐧 Implementation of the Generic mode of KASAN
🔥 Brief overview of other Sanitizers
🗡 Tips on extending KASAN and KMSAN to find more bugs

How I started chasing speculative type confusion bugs in the kernel and ended up with 'real' ones

Jakob Koschel gave a talk (slides, video) at the Linux Plumbers Conference about the tool for discovering speculative type confusion bugs in the Linux kernel. He described how this research suddenly led to the kernel upgrading from C89 to C11.

Attacking the Android kernel using the Qualcomm TrustZone

An article by Tamir Zahavi-Brunner about exploiting the Android kernel via a memory corruption in the Qualcomm's TrustZone implementation.

[CVE-2022-1786] A Journey To The Dawn

A thrilling article by kylebot about exploiting a race condition that leads to a double-free in the io_uring subsystem and winning a kCTF bounty.

The exploit uses novel techniques: overwriting binfmt structures instead of modprobe_path and using fork and msleep to safely return to userspace after executing a ROP chain.

pipe_buffer arbitrary read write

Awarau published an article describing the arbitrary read/write technique using pipe_buffer.

Canary in the Kernel Mine: Exploiting and Defending Against Same-Type Object Reuse

An article by Mathias Krause about creating a mitigation for same-type same-address use-after-free bugs affecting the file and cred structures. Mathias also provided a set of exploits that was used to test the mitigation.

A Very Powerful Clipboard: Analysis of a Samsung in-the-wild exploit chain

An article by Maddie Stone covering an exploit chain for Exynos-based Samsung phones that relies on two kernel bugs.

The exploit bypasses KASLR by triggering a warning and reading the report from the kernel log. The exploit then uses a use-after-free of the file structure in the DECON driver to gain AARW by controlling addr_limit.

Exploiting CVE-2022-42703 - Bringing back the stack attack

An article by Seth Jenkins about exploiting a slab use-after-free side effect of a logical bug in the memory subsystem found by Jann Horn.

Seth used a cross-cache attack to overwrite an anon_vma structure and gain a limited arbitrary-write primitive. Seth then modified the context saved to the fixed-address cpu_entry_area region during a hardware exception. This allowed to corrupt the size passed to copy_to/from_user calls and thus get controlled stack read and write buffer overflows.

The article additionally expands on how KASLR is useless against local attackers due to side-channel vulnerabilities.

EntryBleed: Breaking KASLR under KPTI with Prefetch (CVE-2022-4543)

An article about using Meltdown to bypass KASLR despite enabled KPTI.

This bypass method has been known for a while.

Linux Kernel: Exploiting a Netfilter Use-after-Free in kmalloc-cg

Sergi Martinez published an article about exploiting CVE-2022-32250, a slab use-after-free in the netfilter subsystem. Unlike the existing public exploits for this bug, Sergi's exploit targets the kernel version 5.18.1, where both the vulnerable object and msg_msg are allocated in kmalloc-cg-* slab caches.

DirtyCred Remastered: how to turn an UAF into Privilege Escalation

LukeGix and Alessandro Groppo published two articles about exploiting CVE-2022-2602, another use-after-free in the io_uring subsystem.

They used inode locking for pausing a kernel thread during UAF exploitation. To escalate privileges, the researchers employed the DirtyCred file exploitation technique.

Exploiting null-dereferences in the Linux kernel

Seth Jenkins published an article about turning a refcount incrementing side-effect of a null-deref kernel bug into a slab double-free.

Pwning the all Google phone with a non-Google bug

An article by Man Yue Mo about getting root from the untrusted app domain on Pixel 6 via a slab use-after-free in the Arm Mali GPU driver.

The researcher also points out a patch gap in Android and provides a list of bugs that were exploitable for months after becoming public.

The code that wasn't there: Reading memory on an Android device by accident

An article by Man Yue Mo about exploiting a missing cache flush in the Qualcomm Adreno GPU driver.

The author showed how to use the bug to leak kernel memory and bypass KASLR on Android.

Rooting the FiiO M6

Jack Maginnes published two articles about finding and exploiting a stack buffer-overflow in the old Android-based FiiO M6 MP3 player.

Pwning Pixel 6 with a leftover patch

An article by Man Yue Mo about exploiting a logical bug in the Arm Mali GPU driver on Pixel 6.

Man Yue Mo used the bug to make GPU access freed memory and gained root from the untrusted_app context.

Linux IPv6 "Route of Death" 0day

Max VA @maxpl0it published an article describing remote DoS vulnerability in the code handling IPv6 routing headers.

Privilege escalation exploit for CVE-2023-0386 in OverlayFS

A privilege escalation exploit by xkaneiki for a logical bug in OverlayFS. Exploitation requires unprivileged user namespaces enabled.

Following the exploit, Ryan Simon et al. published an article describing the exploitation process.

Racing Against the Lock: Exploiting Spinlock UAF in the Android Kernel

A talk (slides) by Moshe Kol about exploiting a slab use-after-free bug in the Android Binder IPC.

The exploit achieves kernel arbitrary read/write primitives from the unstrusted_app context and obtains root privileges on Pixel 6.

Moshe also published an article about their exploit.

Exploit Engineering – Attacking the Linux Kernel

A talk (slides) by Alex Plaskett and Cedric Halbronn about approaches to finding, triaging, and exploiting Linux kernel bugs.

During the talk, the speakers announced libslub — a GDB extension for examining SLUB object addresses and metadata.