Exploiting Uses of Uninitialized Stack Variables in Linux Kernels to Leak Kernel Pointers

on YouTube ↗18m

" summary

Presents an automated pipeline that turns stack-based uninitialized-data leaks into kernel pointer leaks that defeat KASLR by computing a precise leak offset via stack footprinting, finding syscalls (using a modified Linux Test Project) or BPF sequences to place kernel pointers at that offset, and recovering partial pointers with a guess-and-check subtraction on BPF frame pointers. Evaluated against four CVEs and one security patch, handles leaks smaller than 8 bytes, produces working pointer leaks for several cases and fails on one nonexploitable CVE.

AI-written summary · about

" chapters (15)

1. 0:00Intro
2. 0:24Uninitialized variables in the stack
3. 1:04Unexpected information leaks
4. 1:14Real-world example (CVE-2016-4486)
5. 1:43Basic security principle of the OS kernels
6. 5:17Challenges in Exploitation Computing the offset to uninitialized data from the kernel stack base.
7. 7:00Our Approach
8. 7:17Computing the Leak Offset Stack footprinting 1. Fill the kernel stack
9. 8:41Extensive Syscall Testing with the LTP • Linux Test Project (LTP) provides concrete test cases for system calls.
10. 9:14Syscall Testing with the LTP 1. Fill the kernel stack
11. 10:10Stack Spraying via BPF • The extended Berkeley Packet Filter (BPF) allows users to make a program and execute it inside the kernel.
12. 11:26Handling Small Data Leaks • Need the most important 52 bits (7 bytes) of a kernel stack address
13. 13:50Finding pointers with the LTP framework
14. 14:47Summary of exploitation results
15. 17:01Conclusion

" related talks

• 34mSTACKLEAK: A Long Way to the Linux Kernel MainlineAlexander Popov · Linux Security Summit North America 2018
• 45mBreaking and Protecting Linux Kernel StackElena Reshetova · Linux Security Summit North America 2019
• 41mA General Approach to Bypassing Many Kernel Protections and its MitigationYueqi Chen, Xinyu Xing, Zhenpeng Lin · Black Hat Asia 2021
• 44mDeep Analysis of Exploitable Linux Kernel Vulnerabilities 2017-2019Tong Lin, Luhai Chen · Linux Security Summit Europe 2019
• 43mUsing Undocumented CPU Behavior to See Into Kernel Mode and Break KASLR in the ProcessDaniel Gruss, Anders Fogh · Black Hat USA 2016
• 24mCurrent State of Exploit Mitigations in the Linux KernelLucas Amorim · BSides Vancouver 2021
• 23mOverflowing the kernel stack with BPFDan Williams, Sai Roop Somaraju, Siddharth Chintamaneni · Linux Plumbers Conference 2023
• 41mUsing Microarchitectural Design to Break KASLR and MoreAnders Fogh · RuhrSec 2017