ret2dir: Deconstructing Kernel Isolation

on YouTube ↗01h 03m

" summary

ret2dir claims a practical bypass of KERNEXEC/UDEREF and hardware SMEP/SMAP/PXN by exploiting the kernel’s direct‑mapped physical memory region: it maps attacker‑controlled user pages into the kernel fmap alias, discovers their kernel synonyms via /proc/PID/pagemap, forces suitable PFNs by mass page‑faulting and zone depletion, and then overwrites kernel pointers to point at those synonyms to execute code or ROP (example: CVE‑2013‑2094 perf exploit converted). Works across x86/x86_64/AArch32/AArch64 Linux; mitigation proposed is exclusive page‑frame ownership. return-to-direct-mapped memory fmap spraying

AI-written summary · about

" chapters (37)

1. 0:00Introduction
2. 0:17About me
3. 0:44Agenda
4. 2:42Kernel Vulnerabilities
5. 3:23Linux
6. 6:01Kernel Attack Model
7. 9:17Why do they work
8. 10:55Protections
9. 13:50Summary
10. 15:00Questions
11. 16:04Return to Direct Map Memory
12. 16:57Kernel Space Layout
13. 19:06Role of Kernel Space Layout
14. 20:47Properties of the Region
15. 22:56Threat Model
16. 24:10Addressaliasing
17. 24:41Attack
18. 25:41Location of synonym
19. 26:16Problems
20. 27:37How
21. 30:32Second problem
22. 31:08How Linux manages physical memory
23. 32:13How Linux manages page frames
24. 37:24What if page frames are not available
25. 37:49Fishmap sprain
26. 41:06Fishmap signatures
27. 42:14Vulnerability overview
28. 43:44Vulnerability data structure
29. 44:15Static kee
30. 44:34How to abuse it
31. 49:23How it works
32. 50:38What happens if this map is not executable
33. 53:34How this works
34. 54:41Demo
35. 56:17Exploit DB
36. 57:19Probability of success
37. 58:25Pagegas

" related talks

• 41mUsing Microarchitectural Design to Break KASLR and MoreAnders Fogh · RuhrSec 2017
• 43mUsing Undocumented CPU Behavior to See Into Kernel Mode and Break KASLR in the ProcessDaniel Gruss, Anders Fogh · Black Hat USA 2016
• 19mDisARMed: Attacking ARM TrustZone from Userspace with Memory AliasingDavid Oswald, Jacqueline Henes, Matthew Bowden, Mihai Ordean · 20th USENIX WOOT Conference on Offensive Technologies (WOOT '26)
• 34mGetting on the Same (Virtual Memory) Page: A Roundtable on Data-only Attack MitigationsMaxwell Bland · Linux Security Summit North America 2025
• 40mWinter is Coming BackYueqiang Cheng, Zhi Zhang, Zhi Wang, Surya Nepal · Black Hat Asia 2019
• 36mLost Control-Breaking Hardware-Assisted Kernel Control-Flow Integrity with Page-Oriented ProgrammingSeunghun Han · Black Hat USA 2023
• 25mPIkit: A New Kernel-Independent Processor-Interconnect RootkitJohn Kim, Song Wonjun, Hyunwoo Choi, Junhong Kim, Eunsoo Kim, Yongdae Kim · USENIX Security '16
• 30mEvasive Maneuvers: Strategies to Overcome Runtime Detection ToolsAmit Schendel · CloudNativeSecurityCon North America 2024