RetSpill: Igniting User-Controlled Data to Burn Away Linux Kernel Protections

A paper by Kyle Zeng et al. about techniques for saving controlled data on the kernel stack for exploiting control flow hijacking primitives.

The paper also gives an overview of the previously existing approaches for using controlled data with control flow hijacking primitives and the mitigations that affect them.

The authors also developed a semi-automated framework for turning control flow hijacking crashers into privilege escalation exploits based on their techniques.

Understanding Dirty Pagetable - m0leCon Finals 2023 CTF Writeup

ptr-yudai published a write-up about exploiting a slab use-after-free on the file structure provided in a CTF challenge.

The researcher used a cross-cache attack and the Dirty Pagetable technique to execute a shellcode in the kernel space, which allowed to gain root privileges and escape from nsjail.

Linux Kernel GSM Multiplexing Race Condition Local Privilege Escalation Vulnerability (CVE-2023-6546)

An article by Nassim Asrir about exploiting a race condition that leads to a kmalloc-1k use-after-free in the n_gsm TTY line discipline module.

In the exploit, the researcher overwrote the freed object, gained an arbitrary function call with a controlled argument primitive, and escalated privileges by spawning a userspace process via run_cmd.

The exploit bypasses KASLR by leaking the kernel address from world-readable /sys/kernel/notes. This is a separate vulnerability that still affects up-to-date kernels that enable CONFIG_XEN_PV.

To bypass SMAP, the author used a novel technique of filling the kernfs_pr_cont_buf global variable with controlled data from userspace. The data is supplied as the path to a cgroup filter created via iptables, whose use requires unprivileged user namespaces.

The repository with the exploit also contains a set of noscripts for automatically extracting symbol offsets for Ubuntu, CentOS, and RHEL kernels.

KernelGPT: Enhanced Kernel Fuzzing via Large Language Models

A paper by Chenyuan Yang et. al about using the GPT4 LLM neural network for automatically generating syzkaller denoscriptions.

CodeQL query to find interesting objects for slab exploitation

A CodeQL noscript by Jordy Zomer for finding slab allocations of particular size or type.

Eduardo Vela also made a dynamic dashboard based on this noscript.

Linux is a CNA

Greg Kroah-Hartman announced that the Linux kernel project has been accepted as a CVE Numbering Authority (CNA) for vulnerabilities found in Linux.

In his post, Greg referenced the patch documenting the process of CVE allocation and the mailing list where the announcement are published.

SyzRetrospector: A Large-Scale Retrospective Study of Syzbot

Joseph Bursey, Ardalan Amiri Sani, and Zhiyun Qian published an article analyzing how changes in the Linux kernel and syzkaller influence the ability of syzbot to find bugs.

In the paper, the researchers share the key results of their analysis and offer suggestions on how to improve the syzbot effectiveness.

Mali GPU Kernel LPE

An article by simo about expoiting a kernel pointer leak and an out-of-bounds write bug in the Mali GPU driver.

The shared exploit leverages the pipe_buffer structure to gain arbitrary read/write to disable SELinux and gain root privileges on Pixel 7 and 8 Pro phones.

In the article, the researcher also pointed out the non-transparent and confusing handling of reported vulnerabilities by Google.

Gaining kernel code execution on an MTE-enabled Pixel 8

An article by Man Yue Mo about exploiting a race condition in the JIT memory regions handling code in the Mali GPU driver.

The shared exploit disables SELinux and gains root privileges from the untrusted_app context on Pixel 8.

In the article, the author also pointed out that MTE (Memory Tagging Extension) does not prevent the exploitation of this bug, as invalid memory accesses happen through the GPU coprocessor.

Flipping Pages: An analysis of a new Linux vulnerability in nf_tables and hardened exploitation techniques

An incredibly detailed and well-presented article by notselwyn about exploiting a logical bug in the netfilter subsystem.

The shared exploit leverages the bug to get a page double-free primitive and then execute the Kernel Space Mirroring Attack (KSMA) via a novel Dirty Pagedirectory technique.

The amount of knowledge shared in the article is impossible to encompass in a brief summary, so go check it out yourself! 🔥

Mind the Patch Gap: Exploiting an io_uring Vulnerability in Ubuntu

An article by Oriol Castejón about exploiting a logical bug in the io_uring subsystem that leads to freed pages being writable through a userspace mapping.

The proposed exploitation approach reclaims the freed pages with a slab filled with file structures for /etc/passwd and modifies them from userspace via the mapping to add a new /etc/passwd entry.

In addition, Yordan Stoychev published an exploit for this bug that uses a different technique.

Your NVMe Had Been Syz’ed: Fuzzing NVMe-oF/TCP Driver for Linux with Syzkaller

An article by Alon Zahavi about externally fuzzing the NVMe-over-TCP packet parsing paths with syzkaller.

The article:

— Introduces syzkaller and syzlang;
— Shows added syzlang denoscriptions for NVMe-over-TCP fuzzing, including a new pseudo-syscall;
— Explains how remote KCOV was used to collect coverage from the NVMe packet parsing code executed in a background kernel thread;
— Lists found bugs.

Make your own backdoor: CFLAGS code injection, Makefile injection, pkg-config

Vegard Nossum posted a PoC backdoor for the Linux kernel that doesn't require changing the kernel source code or any release tarballs.

64 bytes and a ROP chain – A journey through nftables

A two-part article by Davide Ornaghi about finding, analyzing, and exploiting a stack buffer-overflow in the netfilter subsystem from the softirq context.

Davide also gave a talk (slides) about this work at HITB Amsterdam last year.

To Boldly Go Where No Fuzzer Has Gone Before: Finding Bugs in Linux' Wireless Stacks through VirtIO Devices

A paper by Sönke Huster et al. about externally fuzzing the Linux kernel's Wi-Fi and Bluetooth stacks.

The implemented VirtFuzz fuzzer injects Wi-Fi and Bluetooth frames into the kernel through QEMU via a custom VirtIO-based device. The fuzzer also collects coverage via KCOV-based annotations and exposes it to the host via QEMU's shared memory device to guide the fuzzing process.

A Bug Hunter's Reflections on Fuzzing

Alexander Popov (me) shared the video and slides of the HITBxPHDays talk, where he describes what is special in fuzzing for vulnerability discovery and how to adapt the syzkaller kernel fuzzer for security research.

Attacking Android Binder: Analysis and Exploitation of CVE-2023-20938

An article by Zi Fan Tan, Gulshan Singh, and Eugene Rodionov about exploiting a vulnerability in the Android Binder device driver that leads to a slab use-after-free.

Zi and Eugene also gave a talk (slides) about this work at OffensiveCon last month. There, they also shared the details about finding this vulnerability with a custom Linux Kernel Library–based fuzzer.

Driving forward in Android drivers

An article by Seth Jenkins about exploiting a race condition in the MediaTek mtk_jpeg driver that leads to a variety of memory corruption side-effects.

The described data-only exploit leverages the bug to get a use-after-free on a dmabuf file structure and then gets an arbitrary read/write primitive to disable SELinux and gain root on Asus ROG 6D.

In the exploit, Seth deliberately avoided using the cross-cache techniques, as these might soon get mitigated by SLAB_VIRTUAL.

The article also covers:

— Approaches to discovering device drivers accessible to unprivileged users on Android;
— Using the MediaTek GED (GPU Extension Device) driver to gain extremely powerful slab memory control primitives.

ZDI-24-821: A Remote UAF in The Kernel's net/tipc

An article by Sam Page describing a slab use-after-free in the TIPC networking stack that can be triggered by both local and remote attackers.

Linux Kernel: Vulnerability in the eBPF verifier register limit tracking

An exploitable vunerability in eBPF announced by JJ. Requires the CAP_BPF capability to trigger. Found with buzzer.

So You Wanna Find Bugs In The Linux Kernel?

Slides of the talk presented by sam4k at TyphoonCon. The talk gives an overview of the Linux kernel vulnerability research area and suggests approaches and tools for finding bugs.