When Good Kernel Defences Go Bad: Reliable and Stable Kernel Exploits via Defense-Amplified TLB Side-Channel Leaks
Awesome paper by Lukas Maar et al. about leaking exploitation-relevant kernel addresses via a TLB side-channel attack.
Authors demonstrate how to leak the addresses of the physmap, vmemmap, and vmalloc memory regions, addresses of page tables of all levels, addresses of kernel stacks, and addresses of various kernel objects including msg_msg, pipe_buffer, cred, file, and seq_file.
Authors then show how to apply the discovered techniques in exploits; the code is public.
Awesome paper by Lukas Maar et al. about leaking exploitation-relevant kernel addresses via a TLB side-channel attack.
Authors demonstrate how to leak the addresses of the physmap, vmemmap, and vmalloc memory regions, addresses of page tables of all levels, addresses of kernel stacks, and addresses of various kernel objects including msg_msg, pipe_buffer, cred, file, and seq_file.
Authors then show how to apply the discovered techniques in exploits; the code is public.
👍6🔥6
Three bypasses of Ubuntu's unprivileged user namespace restrictions
Article about bypassing the recent Ubuntu's restriction on getting capabilities in unprivileged user namespaces.
Article about bypassing the recent Ubuntu's restriction on getting capabilities in unprivileged user namespaces.
🔥14👍1🤔1
Kernel-Hack-Drill: Environment For Developing Linux Kernel Exploits
Alexander Popov (me) published the slides from his talk at Zer0Con 2025. In this talk, he presented the kernel-hack-drill open-source project and showed how it helped him to exploit CVE-2024-50264 in the Linux kernel.
Alexander Popov (me) published the slides from his talk at Zer0Con 2025. In this talk, he presented the kernel-hack-drill open-source project and showed how it helped him to exploit CVE-2024-50264 in the Linux kernel.
🔥32👍4🤔2🎉1
Exploiting CVE-2024-0582 via the Dirty Pagetable Method
Kuzey Arda Bulut posted an article about exploiting CVE-2024-0582 in io_uring using the Dirty Pagetable technique.
This bug was previously reported by Jann Horn and exploited by Oriol Castejón.
Kuzey Arda Bulut posted an article about exploiting CVE-2024-0582 in io_uring using the Dirty Pagetable technique.
This bug was previously reported by Jann Horn and exploited by Oriol Castejón.
🔥15
External fuzzing of USB drivers with syzkaller
Slides from a talk by Andrey Konovalov on using syzkaller to externally fuzz USB drivers. Includes a demonstration of how to rediscover CVE-2024-53104, an out-of-bounds bug in the USB Video Class driver.
Slides from a talk by Andrey Konovalov on using syzkaller to externally fuzz USB drivers. Includes a demonstration of how to rediscover CVE-2024-53104, an out-of-bounds bug in the USB Video Class driver.
🔥18
RISC-V support in kernel-hardening-checker
Alexander Popov (me) added RISC-V support to kernel-hardening-checker. Now, you can check the Linux kernel security parameters for RISC-V in addition to X86_64, ARM64, X86_32, and ARM.
Alexander Popov (me) added RISC-V support to kernel-hardening-checker. Now, you can check the Linux kernel security parameters for RISC-V in addition to X86_64, ARM64, X86_32, and ARM.
👍13🔥9🎉2
Linux Kernel Exploitation series
Awesome series of articles by r1ru that outlines many commonly-used modern exploitation techniques.
Comes with the reference exploit code.
Awesome series of articles by r1ru that outlines many commonly-used modern exploitation techniques.
Comes with the reference exploit code.
👍15🔥7
A Quick Dive Into The Linux Kernel Page Allocator
Article by D3vil that explains the internals of the Page allocator.
Article by D3vil that explains the internals of the Page allocator.
👍13🔥3🤔2
[CVE-2025-37752] Two Bytes Of Madness: Pwning The Linux Kernel With A 0x0000 Written 262636 Bytes Out-Of-Bounds
Great article by D3vil about exploiting a type confusion in the network scheduler subsystem and pwning all kernelCTF instances.
Author exploited a severely-limited OOB side-effect of the bug to corrupt pipe_inode_info->tmp_page and gain a page UAF read/write primitive. Researcher then swapped the private_data and f_cred fields of a signalfd file structure and overwrote the credentials via signalfd_ctx.
Great article by D3vil about exploiting a type confusion in the network scheduler subsystem and pwning all kernelCTF instances.
Author exploited a severely-limited OOB side-effect of the bug to corrupt pipe_inode_info->tmp_page and gain a page UAF read/write primitive. Researcher then swapped the private_data and f_cred fields of a signalfd file structure and overwrote the credentials via signalfd_ctx.
🔥17👏3
KernelGP: Racing Against the Android Kernel
Talk by Chariton Karamitas about ways to use FUSE for kernel exploitation from unprivileged SELinux contexts on Android.
Talk by Chariton Karamitas about ways to use FUSE for kernel exploitation from unprivileged SELinux contexts on Android.
YouTube
OffensiveCon25 - Chariton Karamitas - KernelGP: Racing Against the Android Kernel
https://www.offensivecon.org/speakers/2025/chariton-karamitas.html
👍9🔥6
Android In-The-Wild: Unexpectedly Excavating a Kernel Exploit
Talk by Seth Jenkins about analyzing the traces of an In-The-Wild exploit that targeted the Qualcomm adsprpc driver.
Based on a previously published article.
Talk by Seth Jenkins about analyzing the traces of an In-The-Wild exploit that targeted the Qualcomm adsprpc driver.
Based on a previously published article.
YouTube
OffensiveCon25 - Seth Jenkins - Android In-The-Wild: Unexpectedly Excavating a Kernel Exploit
https://www.offensivecon.org/speakers/2025/seth-jenkins.html
👍7
How I used o3 to find CVE-2025-37899, a remote zeroday vulnerability in the Linux kernel's SMB implementation
Article by Sean Heelan about rediscovering a bug in the ksmbd module via the OpenAI's o3 model and then finding a 0-day vulnerability as well.
The researcher had to rerun the prompt multiple times before getting a true-positive result. The o3 model managed to find the 0-day vulnerability in only ~1 out of 50 runs.
Article by Sean Heelan about rediscovering a bug in the ksmbd module via the OpenAI's o3 model and then finding a 0-day vulnerability as well.
The researcher had to rerun the prompt multiple times before getting a true-positive result. The o3 model managed to find the 0-day vulnerability in only ~1 out of 50 runs.
👍19🔥1
Bypassing MTE with CVE-2025-0072
Article by Man Yue Mo about exploiting a page use-after-free vulnerability in the ARM's Mali GPU driver in the code that manages userspace-mapped pages.
Author published an exploit for this bug that disable SELinux and gains root privileges on Pixel 8 running from the untrusted_app context. The exploit is not affected by MTE.
Article by Man Yue Mo about exploiting a page use-after-free vulnerability in the ARM's Mali GPU driver in the code that manages userspace-mapped pages.
Author published an exploit for this bug that disable SELinux and gains root privileges on Pixel 8 running from the untrusted_app context. The exploit is not affected by MTE.
👍13🔥5
Solo: A Pixel 6 Pro Story (When one bug is all you need)
Awesome article by Lin Ze Wei about adapting the Pixel 7/8 exploit for a bug in the Mali GPU driver to Pixel 6 Pro.
Awesome article by Lin Ze Wei about adapting the Pixel 7/8 exploit for a bug in the Mali GPU driver to Pixel 6 Pro.
🔥11👍2
Exploiting the CVE-2025-21756 1-day vulnerability
Hyunwoo Kim and Wongi Lee posted a kernelCTF report about exploiting a UAF in the vsock subsystem of the Linux kernel.
The researchers leaked the kernel base address using the EntryBleed side-channel attack and then turned the UAF on the vsock_sock structure into a RIP control primitive to execute a ROP-chain.
Hyunwoo Kim and Wongi Lee posted a kernelCTF report about exploiting a UAF in the vsock subsystem of the Linux kernel.
The researchers leaked the kernel base address using the EntryBleed side-channel attack and then turned the UAF on the vsock_sock structure into a RIP control primitive to execute a ROP-chain.
👍16🔥5
Bypass Kernel Barriers: Fuzzing Linux Kernel in Userspace With LKL
Xuan Xing & Eugene Rodionov gave a talk (slides) about fuzzing the Linux kernel interfaces fully in user space using LKL (Linux Kernel Library).
Xuan Xing & Eugene Rodionov gave a talk (slides) about fuzzing the Linux kernel interfaces fully in user space using LKL (Linux Kernel Library).
🔥15🤔4👍3