skip to content

algoatson.github.io ~/series/linux-kernel-exploitation

❯ segfault@algoatson.github.io

linux kernel exploitation

7 parts~24 min rss

❯ start at part 1 ›

#1kernel a slab use-after-free, from ioctl to root4 min

#2kernel kernel LPE — commit_creds(prepare_kernel_cred(0))3 min

#3kernel userfaultfd & FUSE — freezing a race until it's deterministic3 min

#4kernel Dirty Pipe (CVE-2022-0847): one uninitialised flag4 min

#5kernel kernel heap spray — the elastic objects you allocate on demand4 min

#6kernel cross-cache attacks — reaching the objects in their own cache3 min

#7kernel DirtyCred — swap the object, skip the corruption3 min