Lost Control-Breaking Hardware-Assisted Kernel Control-Flow Integrity with Page-Oriented Programming

on YouTube ↗36m

" summary

Claims a new exploit called page-oriented programming that uses a kernel read/write bug plus modified hypervisor page-table control to remap physical pages and stitch page-granularity gadgets into new direct-branch paths. Prototype uses LLVM 6, Linux kernel 6.3.1 with Fine IBT, a patched Shadow Fox hypervisor and a vulnerable kernel driver on an Asus laptop. The demo shows successful privilege escalation and reading /etc/shadow, proving the technique works against hardware-assisted CFI.

AI-written summary · about

" chapters (11)

1. 0:00Introduction
2. 5:07Control-Flow Integrity weaknesses
3. 8:00Hardware-assisted Kernel CFI
4. 10:51Limitations of Kernel CFI
5. 16:41Page-Oriented Programming (POP)
6. 18:30POP exploits CFI weaknesses
7. 23:08POP demonstration overview
8. 23:52Live demo setup
9. 32:44Simplified POP technique
10. 33:46Mitigation challenges
11. 34:53Conclusion

" related talks

• 41mUsing Microarchitectural Design to Break KASLR and MoreAnders Fogh · RuhrSec 2017
• 51mExploiting Hardware Glitches And Side Channels In Perfect SoftwareHerbert Bos · OWASP Global AppSec Amsterdam 2019
• 33mExploring a New Class of Kernel Exploit PrimitiveRohit Mothe, Andrew Ruddick · Black Hat Europe 2022
• 44mDeep Analysis of Exploitable Linux Kernel Vulnerabilities 2017-2019Tong Lin, Luhai Chen · Linux Security Summit Europe 2019
• 14mBranch Privilege Injection: Compromising Spectre v2 Hardware Mitigations by...Kaveh Razavi, Sandro Rüegge, Johannes Wikner · USENIX Security '25
• 39mControl Flow Integrity in the Linux KernelKees Cook · linux.conf.au 2020
• 33mByepervisor: How We Broke The PS5 HypervisorSpecterDev · Hardwear.io Netherlands 2024
• 40mEvils in the Sparse Texture Memory: Exploit Kernel Based on Undefined Behaviors of Graphic APIsXingyu Jin, Tony Mendez, Richard Neal · Black Hat Europe 2023