Breaking Boundaries & Demystifying Kernel SU 4 Root Access In Azure Cloud Shell
summary
Finds a Use-After-Free in nftables and an Open vSwitch integer manipulation bug in kernels Azure Cloud Shell used (5.10.102.2-microsoft-standard and older 6.9 builds), crafts transactions that race the prepare/commit/release phases using RCU tricks to force premature free, leaks heap pointers and achieves a KASLR bypass, and reliably yields root inside the user’s Cloud Shell (about 7/10 success on vulnerable kernels); Microsoft ships a patched kernel and hardenings so the live exploit demo no longer works.
AI-written summary · about
chapters (8)
- 0:00Introduction to Kernel SU
- 1:09Azure Cloud Shell Basics
- 3:40Container vs VM Security
- 6:34Root Cause Analysis
- 16:39Exploit Demonstration
- 18:55MSRC Fixes and Mitigations
- 21:27Key Takeaways on Container Security
- 22:11Q&A Session
related talks
44mDeep Analysis of Exploitable Linux Kernel Vulnerabilities 2017-2019
41mUncovering Azure's Silent Threats: A Journey into Cloud Vulnerabilities
37mBreaking and Fixing the Kernel: Crashes, Debugging & Performance Tun...
24mCurrent State of Exploit Mitigations in the Linux Kernel
41mThinking Outside the Sandbox - Violating Trust Boundaries in Uncommon Ways
35mKSMA: Breaking Android Kernel Isolation and Rooting with ARM MMU Features
52mUncovering Azure's Silent Threats: A Journey Into Cloud Vulnerabilities
41mA General Approach to Bypassing Many Kernel Protections and its Mitigation