Deep Analysis of Exploitable Linux Kernel Vulnerabilities 2017-2019
summary
Analysis of several 2017–2019 Linux kernel bugs that shows full exploit chains delivering arbitrary kernel R/W and end-to-end privilege escalation on x86 and ARM targets (Ubuntu and Android). Demonstrates an eBPF verifier bypass that turns validation differences into code execution, a timerfd double-delete -> UAF + heap spray via pipe to corrupt kernel objects, and use of address_limit abuse, info leaks and scheduler affinity to bypass SMEP/SMAP/KASLR/CFI; all demos are practical and patched upstream.
AI-written summary · about
chapters (19)
- 0:00Intro
- 1:08Linux distribution families
- 3:12Top 6 CWE in Linux kernel
- 3:55Representative kernel vulnerabilities
- 5:51Linux privilege escalation
- 6:41Common LPE flow
- 7:39Control execution flow
- 8:34For specific vulnerability types
- 9:55Get arbitrary memory write
- 10:44What is addr limit?
- 12:54Gain root privilege
- 14:04eBPF verifier bypass vulnerability
- 17:19Verifier simulation execution
- 19:15Actual code running
- 26:41Conventional UAF exploit chain
- 28:07TOCTOU & pipe subsystem
- 30:48Combine list operation with pipe heap spray
- 35:35Case summary
- 42:21Conclusion
related talks
24mCurrent State of Exploit Mitigations in the Linux Kernel
39mCache the Frames, Catch the Vulnerabilities in Kernel Streaming
51mThe Anatomy of an Exploit
45mThe Art of Exploiting Unconventional Use-after-free Bugs in Android Kernel
51mExploiting Hardware Glitches And Side Channels In Perfect Software
01h 16mClassic Vulnerabilities
32mHow to Backdoor the Linux Kernel (and fail?)
01h 05mClassic Vulnerabilities