Deep-Kernel Treasure Hunt: Finding exploitable structures in the Linux kernel
summary
A Ghidra-based static analyzer named Malis scans binaries, finds kmalloc calls via CFG traversal and intra-function symbolic propagation, and reports allocation sizes and caller paths; run on the Linux kernel it finishes in about five minutes and uncovers over a thousand structures allocated from kmalloc caches, including signal_fd_context, shared_memory_id and variable-size semop_array, giving actionable targets for heap overflow or use-after-free exploits while noting limits from Ghidra’s indirect branch resolution and inability to prove user-privilege allocability.
AI-written summary · about
chapters (13)
- 0:00Linux kernel heap exploitation
- 1:28Heap vulnerabilities in kernel
- 4:45Why exploit structures are complex
- 8:44Slab allocator memory management
- 11:33Exploitable kernel structures
- 13:41Previous exploit structure methods
- 16:30Introducing MALIS methodology
- 21:47MALIS algorithm details
- 23:39MALIS evaluation on Linux kernel
- 26:07Exploitable structures found
- 28:38MALIS challenges and limits
- 30:02Conclusion
- 31:53Q&A
related talks
44mDeep Analysis of Exploitable Linux Kernel Vulnerabilities 2017-2019
59mSanitizing the Linux Kernel — On KASAN and other Dynamic Bug-finding Tools
41mUsing Microarchitectural Design to Break KASLR and More
38mHow I started chasing speculative type confusion bugs in the kernel and ended up wi...
43mUsing Undocumented CPU Behavior to See Into Kernel Mode and Break KASLR in the Process
42mIdentifying Safety Weaknesses and Fault Propagation in the Linux Kernel
41mA General Approach to Bypassing Many Kernel Protections and its Mitigation
45mFinding Vulnerabilities through Static Analysis and Scripting