A deep dive into CVE-2023-2163: How we found and fixed an eBPF Linux Kernel Vulnerability

An article by JJ and Meador Inge about exploiting a bug in the eBPF subsystem found with buzzer.

Listen Up: Sonos Over-The-Air Remote Kernel Exploitation and Covert Wiretap

A talk and an article by Robert Herrera and Alex Plaskett about remotely exploiting a bug in the Wi-Fi driver of the Sonos One smart speaker.

PageJack: A Powerful Exploit Technique With Page-Level UAF

A talk, a summary article, and a related paper by Zhiyun Qian et al. about overwriting slab objects containing a struct page * field to achieve arbitrary read/write in physical memory.

The authors also shared a set of exploits that uses the described technique.

CVE-2022-22265: Samsung NPU driver

An article by Javier P Rufo about exploiting a slab double-free in the Samsung's NPU driver via the Dirty Pagetable technique.

SSD Advisory — Linux kernel TAPRIO OOB

An article about exploiting an RCU-involved race condition in the TAPRIO network queuing discipline implementation. The exploit is by Kyle Zeng.

Ongoing slab hardening efforts

Recently, there have been multiple efforts to make the exploitation of slab memory corruptions harder.

1️⃣ RANDOM_KMALLOC_CACHES by Ruigi Gong; merged in v6.6; enabled in Ubuntu 24.04; LWN article

This feature creates 16 instances of each normal kmalloc cache and makes kmalloc randomly pick one of them based on the code location of the kmalloc call.

2️⃣ SLAB_BUCKETS by Kees Cook; merged in v6.11; LWN article

It allows putting specific dynamically-sized allocations into separate caches called buckets. This requires annotating allocation sites. This feature is intended to be used for user-controllable allocations. So far, only msg_msg and v/memdup_user allocations are annotated.

3️⃣ SLAB_PER_SITE by Kees Cook; under discussion; LWN article

This patchset creates a set of buckets for each kmalloc call site without manual annotations.

4️⃣ SLAB_VIRTUAL by Jann Horn and Matteo Rizzo; under discussion; documentation

It mitigates cross-cache attacks by making the slab allocator use a unique virtual memory address range for each cache for allocating slabs.

CVE-2020-27786 (Race Condition + Use-After-Free)

An article by ii4gsp about exploiting a racy use-after-free in the MIDI subsystem.

GPUAF: Using a general GPU exploit tech to attack Pixel 8

A talk by Pan Zhenpeng and Jheng Bing Jhong about leveraging an integer overflow bug in the Mali GPU driver to gain use-after-free access to physical pages, fake GPU page tables, and escalate privileges on Pixel 8.

Race conditions in Linux Kernel perf events

Nils Ole Timm published an article about exploiting a perf events race condition provoking a kernel page UAF.

The researcher also published a limited PoC exploit for kernel configurations that don't turn on check_pages_enabled.

Deep Dive into RCU Race Condition: Analysis of TCP-AO UAF (CVE-2024–27394)

V4bel published an analysis of a race condition vulnerability in the TCP-AO subsystem caused by incorrect usage of the kernel RCU mechanism.

The researcher managed to trigger it reliably using the ExpRace technique.

SELinux bypasses

An amazing article by Klecko about different approaches to bypassing SELinux in Android kernel exploits.

The author lists multiple ways to disable SELinux via an arbitrary address read/write primitive and shows which of them are detected by the Samsung and Huawei hypervisors (spoiler: not all 😁).

More Bang for Your Bug!

Slides for the talk at the Linux Plumbers conference by Eduardo Vela and Space Meyer about kernelCTF, kernel attack surface, and exploit mitigations.

Unleashing a 0day: Pivoting Capabilities and Conquering the Linux Kernel

A talk (video) by Pedro Pinto about exploiting a slab use-after-free bug in the traffic control subsystem.

The author performed multiple cross-cache attacks to ultimately get an arbitrary read/write primitive via pipe_buffer->page and escalate privileges via modprobe_path.

Pedro also shared his experience submitting this bug to the KernelCTF bug bounty program.

Utilizing Cross-CPU Allocation to Exploit Preempt-Disabled Linux Kernel

A talk (video) by Mingi Cho and Wongi Lee about exploiting a slab use-after-free bug in the netfilter subsystem and an out-of-bounds bug in the traffic control subsystem.

The researchers managed to exploit both bugs on the kernelCTF migitation instance. Notably, they relied on cross-CPU slab/page_alloc shaping techniques in both exploits.

Restricting Unprivileged User Namespaces In Ubuntu

A talk (video) by John Johansen and Maxime Bélair about restricting capabilities within user namespaces in Ubuntu 24.04.

1day vuln dev: DirtyCOW

A video by SideQuest covering the author's approach to analyzing the DirtyCow vulnerability.

Defects-in-Depth: Analyzing the Integration of Effective Defenses against One-Day Exploits in Android Kernels

An outstanding paper by Lukas Maar et al. about analyzing the exploitation techniques used in public 1-day Android kernel exploits over the last few years and cross-referencing them with the mitigations implemented by various Android vendors 🔥

Novel approach to exploit a limited OOB on Ubuntu at Pwn2Own Vancouver 2024

Slides from a talk by Pumpkin Chang about exploiting a stack out-of-bounds write bug in the traffic control subsystem.

Pumpkin shaped vmalloc memory to make the stack out-of-bounds access land in an eBPF bytecode allocation and used the write primitive to overwrite the eBPF bytecode as it was being JITed.

OtterRoot: Netfilter Universal Root 1-day

An article by Pedro Pinto about exploiting a slab double-free bug in the netfilter subsystem.

Pedro wrote two exploits for this bug: one that relies on ROP and that was used to exploit a kernelCTF instance, and the other that gets physical memory arbitrary read/write without relying on any offsets.