Mind the Patch Gap: Exploiting an io_uring Vulnerability in Ubuntu

An article by Oriol Castejón about exploiting a logical bug in the io_uring subsystem that leads to freed pages being writable through a userspace mapping.

The proposed exploitation approach reclaims the freed pages with a slab filled with file structures for /etc/passwd and modifies them from userspace via the mapping to add a new /etc/passwd entry.

In addition, Yordan Stoychev published an exploit for this bug that uses a different technique.

Your NVMe Had Been Syz’ed: Fuzzing NVMe-oF/TCP Driver for Linux with Syzkaller

An article by Alon Zahavi about externally fuzzing the NVMe-over-TCP packet parsing paths with syzkaller.

The article:

— Introduces syzkaller and syzlang;
— Shows added syzlang denoscriptions for NVMe-over-TCP fuzzing, including a new pseudo-syscall;
— Explains how remote KCOV was used to collect coverage from the NVMe packet parsing code executed in a background kernel thread;
— Lists found bugs.

Make your own backdoor: CFLAGS code injection, Makefile injection, pkg-config

Vegard Nossum posted a PoC backdoor for the Linux kernel that doesn't require changing the kernel source code or any release tarballs.

64 bytes and a ROP chain – A journey through nftables

A two-part article by Davide Ornaghi about finding, analyzing, and exploiting a stack buffer-overflow in the netfilter subsystem from the softirq context.

Davide also gave a talk (slides) about this work at HITB Amsterdam last year.

To Boldly Go Where No Fuzzer Has Gone Before: Finding Bugs in Linux' Wireless Stacks through VirtIO Devices

A paper by Sönke Huster et al. about externally fuzzing the Linux kernel's Wi-Fi and Bluetooth stacks.

The implemented VirtFuzz fuzzer injects Wi-Fi and Bluetooth frames into the kernel through QEMU via a custom VirtIO-based device. The fuzzer also collects coverage via KCOV-based annotations and exposes it to the host via QEMU's shared memory device to guide the fuzzing process.

A Bug Hunter's Reflections on Fuzzing

Alexander Popov (me) shared the video and slides of the HITBxPHDays talk, where he describes what is special in fuzzing for vulnerability discovery and how to adapt the syzkaller kernel fuzzer for security research.

Attacking Android Binder: Analysis and Exploitation of CVE-2023-20938

An article by Zi Fan Tan, Gulshan Singh, and Eugene Rodionov about exploiting a vulnerability in the Android Binder device driver that leads to a slab use-after-free.

Zi and Eugene also gave a talk (slides) about this work at OffensiveCon last month. There, they also shared the details about finding this vulnerability with a custom Linux Kernel Library–based fuzzer.

Driving forward in Android drivers

An article by Seth Jenkins about exploiting a race condition in the MediaTek mtk_jpeg driver that leads to a variety of memory corruption side-effects.

The described data-only exploit leverages the bug to get a use-after-free on a dmabuf file structure and then gets an arbitrary read/write primitive to disable SELinux and gain root on Asus ROG 6D.

In the exploit, Seth deliberately avoided using the cross-cache techniques, as these might soon get mitigated by SLAB_VIRTUAL.

The article also covers:

— Approaches to discovering device drivers accessible to unprivileged users on Android;
— Using the MediaTek GED (GPU Extension Device) driver to gain extremely powerful slab memory control primitives.

ZDI-24-821: A Remote UAF in The Kernel's net/tipc

An article by Sam Page describing a slab use-after-free in the TIPC networking stack that can be triggered by both local and remote attackers.

Linux Kernel: Vulnerability in the eBPF verifier register limit tracking

An exploitable vunerability in eBPF announced by JJ. Requires the CAP_BPF capability to trigger. Found with buzzer.

So You Wanna Find Bugs In The Linux Kernel?

Slides of the talk presented by sam4k at TyphoonCon. The talk gives an overview of the Linux kernel vulnerability research area and suggests approaches and tools for finding bugs.

Virtual Escape; Real Reward: Introducing Google’s kvmCTF

Google started a vulnerability reward program for the Kernel-based Virtual Machine (KVM) hypervisor focused on zero-day bugs.

SLUBStick: Arbitrary Memory Writes through Practical Software Cross-Cache Attacks within the Linux Kernel

A paper by Lukas Maar, Stefan Gast, et al. about exploiting slab memory corruptions via a cross-allocator slab-to-page attack targeting user page tables.

The paper covers:

— Using a timing side-channel to make sure that all objects in a slab are under the exploit's control to increase the success chance of executing a cross-cache or a cross-allocator attack;

— Converting limited slab memory corruptions to a stronger slab use-after-free write primitive;

— Using a single-shot slab use-after-free write to gain control over user page tables and thus obtain physical memory arbitrary read/write.

A deep dive into CVE-2023-2163: How we found and fixed an eBPF Linux Kernel Vulnerability

An article by JJ and Meador Inge about exploiting a bug in the eBPF subsystem found with buzzer.

Listen Up: Sonos Over-The-Air Remote Kernel Exploitation and Covert Wiretap

A talk and an article by Robert Herrera and Alex Plaskett about remotely exploiting a bug in the Wi-Fi driver of the Sonos One smart speaker.

PageJack: A Powerful Exploit Technique With Page-Level UAF

A talk, a summary article, and a related paper by Zhiyun Qian et al. about overwriting slab objects containing a struct page * field to achieve arbitrary read/write in physical memory.

The authors also shared a set of exploits that uses the described technique.

CVE-2022-22265: Samsung NPU driver

An article by Javier P Rufo about exploiting a slab double-free in the Samsung's NPU driver via the Dirty Pagetable technique.

SSD Advisory — Linux kernel TAPRIO OOB

An article about exploiting an RCU-involved race condition in the TAPRIO network queuing discipline implementation. The exploit is by Kyle Zeng.

Ongoing slab hardening efforts

Recently, there have been multiple efforts to make the exploitation of slab memory corruptions harder.

1️⃣ RANDOM_KMALLOC_CACHES by Ruigi Gong; merged in v6.6; enabled in Ubuntu 24.04; LWN article

This feature creates 16 instances of each normal kmalloc cache and makes kmalloc randomly pick one of them based on the code location of the kmalloc call.

2️⃣ SLAB_BUCKETS by Kees Cook; merged in v6.11; LWN article

It allows putting specific dynamically-sized allocations into separate caches called buckets. This requires annotating allocation sites. This feature is intended to be used for user-controllable allocations. So far, only msg_msg and v/memdup_user allocations are annotated.

3️⃣ SLAB_PER_SITE by Kees Cook; under discussion; LWN article

This patchset creates a set of buckets for each kmalloc call site without manual annotations.

4️⃣ SLAB_VIRTUAL by Jann Horn and Matteo Rizzo; under discussion; documentation

It mitigates cross-cache attacks by making the slab allocator use a unique virtual memory address range for each cache for allocating slabs.

CVE-2020-27786 (Race Condition + Use-After-Free)

An article by ii4gsp about exploiting a racy use-after-free in the MIDI subsystem.

GPUAF: Using a general GPU exploit tech to attack Pixel 8

A talk by Pan Zhenpeng and Jheng Bing Jhong about leveraging an integer overflow bug in the Mali GPU driver to gain use-after-free access to physical pages, fake GPU page tables, and escalate privileges on Pixel 8.