Race conditions in Linux Kernel perf events

Nils Ole Timm published an article about exploiting a perf events race condition provoking a kernel page UAF.

The researcher also published a limited PoC exploit for kernel configurations that don't turn on check_pages_enabled.

Deep Dive into RCU Race Condition: Analysis of TCP-AO UAF (CVE-2024–27394)

V4bel published an analysis of a race condition vulnerability in the TCP-AO subsystem caused by incorrect usage of the kernel RCU mechanism.

The researcher managed to trigger it reliably using the ExpRace technique.

SELinux bypasses

An amazing article by Klecko about different approaches to bypassing SELinux in Android kernel exploits.

The author lists multiple ways to disable SELinux via an arbitrary address read/write primitive and shows which of them are detected by the Samsung and Huawei hypervisors (spoiler: not all 😁).

More Bang for Your Bug!

Slides for the talk at the Linux Plumbers conference by Eduardo Vela and Space Meyer about kernelCTF, kernel attack surface, and exploit mitigations.

Unleashing a 0day: Pivoting Capabilities and Conquering the Linux Kernel

A talk (video) by Pedro Pinto about exploiting a slab use-after-free bug in the traffic control subsystem.

The author performed multiple cross-cache attacks to ultimately get an arbitrary read/write primitive via pipe_buffer->page and escalate privileges via modprobe_path.

Pedro also shared his experience submitting this bug to the KernelCTF bug bounty program.

Utilizing Cross-CPU Allocation to Exploit Preempt-Disabled Linux Kernel

A talk (video) by Mingi Cho and Wongi Lee about exploiting a slab use-after-free bug in the netfilter subsystem and an out-of-bounds bug in the traffic control subsystem.

The researchers managed to exploit both bugs on the kernelCTF migitation instance. Notably, they relied on cross-CPU slab/page_alloc shaping techniques in both exploits.

Restricting Unprivileged User Namespaces In Ubuntu

A talk (video) by John Johansen and Maxime Bélair about restricting capabilities within user namespaces in Ubuntu 24.04.

1day vuln dev: DirtyCOW

A video by SideQuest covering the author's approach to analyzing the DirtyCow vulnerability.

Defects-in-Depth: Analyzing the Integration of Effective Defenses against One-Day Exploits in Android Kernels

An outstanding paper by Lukas Maar et al. about analyzing the exploitation techniques used in public 1-day Android kernel exploits over the last few years and cross-referencing them with the mitigations implemented by various Android vendors 🔥

Novel approach to exploit a limited OOB on Ubuntu at Pwn2Own Vancouver 2024

Slides from a talk by Pumpkin Chang about exploiting a stack out-of-bounds write bug in the traffic control subsystem.

Pumpkin shaped vmalloc memory to make the stack out-of-bounds access land in an eBPF bytecode allocation and used the write primitive to overwrite the eBPF bytecode as it was being JITed.

OtterRoot: Netfilter Universal Root 1-day

An article by Pedro Pinto about exploiting a slab double-free bug in the netfilter subsystem.

Pedro wrote two exploits for this bug: one that relies on ROP and that was used to exploit a kernelCTF instance, and the other that gets physical memory arbitrary read/write without relying on any offsets.

Diving into Linux kernel security

Alexander Popov (me) published his H2HC talk slides that describe how to get started with learning Linux kernel security and knowingly configure the security parameters of Linux-based systems.

Bootkitty: Analyzing the first UEFI bootkit for Linux

Martin Smolár and Peter Strýček published a report about a PoC UEFI bootkit targeting Linux systems. The bootkit patches GRUB, disables the signature checking for Linux kernel modules, and loads malicious userspace libraries into the init process.

This bootkit turned out to be created by Korean cybersecurity students.

The Qualcomm DSP Driver — Unexpectedly Excavating an Exploit

An article by Seth Jenkins about investigating kernel crash logs produced by an In-The-Wild exploit that targeted the adsprpc Qualcomm driver and finding several vulnerabities in that driver.