The Cost of Performance: Breaking ThreadX with Kernel Object Masquerading...
summary
ThreadX uses a performance shortcut that validates pointer ranges and a few condition fields instead of full object-value checks, and that allows a Kernel Object Masquerading (KOM) confused‑deputy primitive that forges objects by reusing modifiable fields. An automated pipeline converts ThreadX to LLVM and uses under‑constrained symbolic execution plus type selection and sequence search to find exploits; the authors classify 31 of 60 system calls as capable of modifying object fields, demonstrate arbitrary memory access and MPU disablement on ThreadX devices, and report vendor acknowledgements.
AI-written summary · about
chapters (6)
- 0:00ThreadX vulnerabilities
- 1:17Parameter sanitization
- 3:11Kernel Object Masquerading
- 7:16COM attacks framework
- 11:15COM attacks validation
- 15:11Summary
related talks
37mEternal War in XNU Kernel Objects
41mUsing Microarchitectural Design to Break KASLR and More
49mXOM-switch: Hiding Your Code from Advanced Code Reuse Attacks In One Shot
33mExploring a New Class of Kernel Exploit Primitive
48mCapturing 0Day Exploits With Perfectly Placed Hardware Traps
53mXenpwn: Breaking Paravirtualized Devices
25mKill Latest MPU-based Protections in Just One Shot: Targeting All Commodity RTOSes
51m“Almost Unlimited Modern C++ in Kernel-Mode Applications”