Mali GPU Kernel LPE

An article by simo about expoiting a kernel pointer leak and an out-of-bounds write bug in the Mali GPU driver.

The shared exploit leverages the pipe_buffer structure to gain arbitrary read/write to disable SELinux and gain root privileges on Pixel 7 and 8 Pro phones.

In the article, the researcher also pointed out the non-transparent and confusing handling of reported vulnerabilities by Google.

Gaining kernel code execution on an MTE-enabled Pixel 8

An article by Man Yue Mo about exploiting a race condition in the JIT memory regions handling code in the Mali GPU driver.

The shared exploit disables SELinux and gains root privileges from the untrusted_app context on Pixel 8.

In the article, the author also pointed out that MTE (Memory Tagging Extension) does not prevent the exploitation of this bug, as invalid memory accesses happen through the GPU coprocessor.

Flipping Pages: An analysis of a new Linux vulnerability in nf_tables and hardened exploitation techniques

An incredibly detailed and well-presented article by notselwyn about exploiting a logical bug in the netfilter subsystem.

The shared exploit leverages the bug to get a page double-free primitive and then execute the Kernel Space Mirroring Attack (KSMA) via a novel Dirty Pagedirectory technique.

The amount of knowledge shared in the article is impossible to encompass in a brief summary, so go check it out yourself! 🔥

Mind the Patch Gap: Exploiting an io_uring Vulnerability in Ubuntu

An article by Oriol Castejón about exploiting a logical bug in the io_uring subsystem that leads to freed pages being writable through a userspace mapping.

The proposed exploitation approach reclaims the freed pages with a slab filled with file structures for /etc/passwd and modifies them from userspace via the mapping to add a new /etc/passwd entry.

In addition, Yordan Stoychev published an exploit for this bug that uses a different technique.

Your NVMe Had Been Syz’ed: Fuzzing NVMe-oF/TCP Driver for Linux with Syzkaller

An article by Alon Zahavi about externally fuzzing the NVMe-over-TCP packet parsing paths with syzkaller.

The article:

— Introduces syzkaller and syzlang;
— Shows added syzlang denoscriptions for NVMe-over-TCP fuzzing, including a new pseudo-syscall;
— Explains how remote KCOV was used to collect coverage from the NVMe packet parsing code executed in a background kernel thread;
— Lists found bugs.

Make your own backdoor: CFLAGS code injection, Makefile injection, pkg-config

Vegard Nossum posted a PoC backdoor for the Linux kernel that doesn't require changing the kernel source code or any release tarballs.

64 bytes and a ROP chain – A journey through nftables

A two-part article by Davide Ornaghi about finding, analyzing, and exploiting a stack buffer-overflow in the netfilter subsystem from the softirq context.

Davide also gave a talk (slides) about this work at HITB Amsterdam last year.

To Boldly Go Where No Fuzzer Has Gone Before: Finding Bugs in Linux' Wireless Stacks through VirtIO Devices

A paper by Sönke Huster et al. about externally fuzzing the Linux kernel's Wi-Fi and Bluetooth stacks.

The implemented VirtFuzz fuzzer injects Wi-Fi and Bluetooth frames into the kernel through QEMU via a custom VirtIO-based device. The fuzzer also collects coverage via KCOV-based annotations and exposes it to the host via QEMU's shared memory device to guide the fuzzing process.

A Bug Hunter's Reflections on Fuzzing

Alexander Popov (me) shared the video and slides of the HITBxPHDays talk, where he describes what is special in fuzzing for vulnerability discovery and how to adapt the syzkaller kernel fuzzer for security research.

Attacking Android Binder: Analysis and Exploitation of CVE-2023-20938

An article by Zi Fan Tan, Gulshan Singh, and Eugene Rodionov about exploiting a vulnerability in the Android Binder device driver that leads to a slab use-after-free.

Zi and Eugene also gave a talk (slides) about this work at OffensiveCon last month. There, they also shared the details about finding this vulnerability with a custom Linux Kernel Library–based fuzzer.

Driving forward in Android drivers

An article by Seth Jenkins about exploiting a race condition in the MediaTek mtk_jpeg driver that leads to a variety of memory corruption side-effects.

The described data-only exploit leverages the bug to get a use-after-free on a dmabuf file structure and then gets an arbitrary read/write primitive to disable SELinux and gain root on Asus ROG 6D.

In the exploit, Seth deliberately avoided using the cross-cache techniques, as these might soon get mitigated by SLAB_VIRTUAL.

The article also covers:

— Approaches to discovering device drivers accessible to unprivileged users on Android;
— Using the MediaTek GED (GPU Extension Device) driver to gain extremely powerful slab memory control primitives.

ZDI-24-821: A Remote UAF in The Kernel's net/tipc

An article by Sam Page describing a slab use-after-free in the TIPC networking stack that can be triggered by both local and remote attackers.

Linux Kernel: Vulnerability in the eBPF verifier register limit tracking

An exploitable vunerability in eBPF announced by JJ. Requires the CAP_BPF capability to trigger. Found with buzzer.

So You Wanna Find Bugs In The Linux Kernel?

Slides of the talk presented by sam4k at TyphoonCon. The talk gives an overview of the Linux kernel vulnerability research area and suggests approaches and tools for finding bugs.

Virtual Escape; Real Reward: Introducing Google’s kvmCTF

Google started a vulnerability reward program for the Kernel-based Virtual Machine (KVM) hypervisor focused on zero-day bugs.

SLUBStick: Arbitrary Memory Writes through Practical Software Cross-Cache Attacks within the Linux Kernel

A paper by Lukas Maar, Stefan Gast, et al. about exploiting slab memory corruptions via a cross-allocator slab-to-page attack targeting user page tables.

The paper covers:

— Using a timing side-channel to make sure that all objects in a slab are under the exploit's control to increase the success chance of executing a cross-cache or a cross-allocator attack;

— Converting limited slab memory corruptions to a stronger slab use-after-free write primitive;

— Using a single-shot slab use-after-free write to gain control over user page tables and thus obtain physical memory arbitrary read/write.

A deep dive into CVE-2023-2163: How we found and fixed an eBPF Linux Kernel Vulnerability

An article by JJ and Meador Inge about exploiting a bug in the eBPF subsystem found with buzzer.

Listen Up: Sonos Over-The-Air Remote Kernel Exploitation and Covert Wiretap

A talk and an article by Robert Herrera and Alex Plaskett about remotely exploiting a bug in the Wi-Fi driver of the Sonos One smart speaker.

PageJack: A Powerful Exploit Technique With Page-Level UAF

A talk, a summary article, and a related paper by Zhiyun Qian et al. about overwriting slab objects containing a struct page * field to achieve arbitrary read/write in physical memory.

The authors also shared a set of exploits that uses the described technique.

CVE-2022-22265: Samsung NPU driver

An article by Javier P Rufo about exploiting a slab double-free in the Samsung's NPU driver via the Dirty Pagetable technique.

SSD Advisory — Linux kernel TAPRIO OOB

An article about exploiting an RCU-involved race condition in the TAPRIO network queuing discipline implementation. The exploit is by Kyle Zeng.