Exploiting Race Conditions Using the Scheduler

on YouTube ↗34m

" summary

Exploits two real bugs on a Google Pixel 2 (Linux 4.4): one races mremap against fallocate to produce a use-after-free of a physical page, then reallocates it as a page-cache page for a privileged library and wins code overwrite; another over-decrements struct file refs and uses a FUSE/userfault-style stall plus kcmp-based determinism to reliably reuse freed file structs. Both expand tiny timing windows by manipulating scheduling (pinning tasks, unprivileged sched_ syscalls*) and procfs counters; the techniques are implemented and shown to work.

AI-written summary · about

" chapters (18)

1. 0:00Intro
2. 2:08Translation Lookaside Buffer (TLB)
3. 2:59mremap() moving a memory mapping
4. 3:40fallocate() (de)allocate space for a file
5. 5:20Exploit plan: Basics
6. 5:56Buddy allocator
7. 9:09Preemption
8. 10:12Scheduler control
9. 12:25Android kernel exploit (app - zygote)
10. 15:55userfaultfd and FUSE
11. 17:46komp() for reliable UAF
12. 20:00FUSE for exploiting struct file refcount
13. 22:35int getpidcon(pid t pid, char **context)
14. 24:02Bug 3: race condition in hwservicemanager
15. 25:18_mutex on kernel 4.4
16. 26:37Priority Inversion
17. 27:57Major faults
18. 29:16Repeated file mapping faults

" related talks

• 45mThe Art of Exploiting Unconventional Use-after-free Bugs in Android KernelDi Shen · CODE BLUE 2017
• 27mBad io_uring: A New Era of Rooting for AndroidKang Li, Xinyu Xing, Zhaofeng Chen, Zhenpeng Lin · Black Hat USA 2023
• 22mHunting and Exploiting Recursive MMIO Flaws in QEMU KVMGaoning Pan, Chunming Wu, Qiuhao Li, Hui He · Black Hat Asia 2022
• 40mEvils in the Sparse Texture Memory: Exploit Kernel Based on Undefined Behaviors of Graphic APIsXingyu Jin, Tony Mendez, Richard Neal · Black Hat Europe 2023
• 51mExploiting Hardware Glitches And Side Channels In Perfect SoftwareHerbert Bos · OWASP Global AppSec Amsterdam 2019
• 55mControlling Multi-Core Race Conditions on Linux/AndroidMike Anderson · Embedded Linux Conference 2013
• 43mUsing Undocumented CPU Behavior to See Into Kernel Mode and Break KASLR in the ProcessDaniel Gruss, Anders Fogh · Black Hat USA 2016
• 40mWinter is Coming BackYueqiang Cheng, Zhi Zhang, Zhi Wang, Surya Nepal · Black Hat Asia 2019