SLUB Internals for Exploit Developers
summary
Explains concrete SLUB internals needed to turn slab bugs into exploits: allocation tiers (lockless active slab, pcpu partials, per‑node, new slab), freelist layout and freelist hashed placement in the middle of slots, and limits like op_per_slab and per‑CPU partial counts on kernel 6.6. Shows practical shaping tactics—fill holes via repeated kmalloc/kfree, slab spraying, the “make‑holes” sequence—and tools (/proc/slabinfo, shrink, timing side‑channels, set_affinity). Notes real constraints: preemption, migration, and mitigations make success high (near 99.9%) but not guaranteed.
AI-written summary · about
chapters (9)
- 0:00SLUB allocator intro
- 10:53SLABs and SLUB management
- 20:00SLUB internal structures
- 34:34Core SLUB concepts
- 48:08Memory shaping for OOB
- 55:49Use-after-free exploits
- 1:03:52Advanced memory shaping
- 1:19:49Double-free and mitigations
- 1:25:10Q&A
related talks
25mThe slab allocators of past, present, and future
44mHands Off and Putting SLAB/SLUB Feng Shui in a Blackbox
26mFrom Finding New Type of Logical Flaw at Linux Kernel To Developing New Heap Exploitation Technique
51mReducing the Kernel's Slab Allocators: Progress Report
41mUsing Microarchitectural Design to Break KASLR and More
51mThe Anatomy of an Exploit
05mSlab allocators
24mCurrent State of Exploit Mitigations in the Linux Kernel