Current State of Exploit Mitigations in the Linux Kernel
summary
Covers a real keyring vulnerability where an integer overflow of reference counter wraps usage to zero, the slab is freed and a use‑after‑free lets an attacker place a fake object (via sendmsg) with a function pointer that ends up calling prepare_kernel_cred/commit_creds to get root. Exploit development workflow disables mitigations, rebuilds a kernel‑space ROP chain to bypass SMAP/KPTI and then uses an kASLR information leak to slide gadgets; demonstrations claim practical, repeatable bypasses.
AI-written summary · about
chapters (11)
- 0:00Introduction to talk
- 2:10Kernel memory space basics
- 7:30Key ring vulnerability example
- 11:03Privilege escalation goals
- 13:10SMAP and SMEP mitigations
- 15:55Kernel Page Table Isolation
- 17:43Bypassing SMAP and KPTI
- 18:45Kernel ASLR (KASLR) explained
- 20:10Bypassing KASLR with info leaks
- 22:00Exploit development workflow
- 23:46Conclusion and Q&A
related talks
44mDeep Analysis of Exploitable Linux Kernel Vulnerabilities 2017-2019
41mA General Approach to Bypassing Many Kernel Protections and its Mitigation
32mHow to Backdoor the Linux Kernel (and fail?)
33mExploring a New Class of Kernel Exploit Primitive
35mKSMA: Breaking Android Kernel Isolation and Rooting with ARM MMU Features
31mThe Bootloader: An Underestimated Risk To Embedded Linux Security
57mThe Anatomy of an Exploit
51mThe Anatomy of an Exploit