Flipping Pages: An analysis of a new Linux vulnerability in nf_tables and hardened exploitation techniques (pwning.tech)
from tedu@inks.tedunangst.com to inks@inks.tedunangst.com on 26 Mar 2024 23:33
https://inks.tedunangst.com/l/5094

In this blogpost I present several novel techniques I used to exploit a 0-day double-free bug in hardened Linux kernels (i.e. KernelCTF mitigation instances) with 93%-99% success rate. The underlying bug is input sanitization failure of netfilter verdicts. Hence, the requirements for the exploit are that nf_tables is enabled and unprivileged user namespaces are enabled. The exploit is data-only and performs an kernel-space mirroring attack (KSMA) from userland with the novel Dirty Pagedirectory technique (pagetable confusion), where it is able to link any physical address (and its permissions) to virtual memory addresses by performing just read/writes to userland addresses.

Also: https://github.com/Notselwyn/CVE-2024-1086

#best #cpu #exploit #linux #malloc #paper #programming #security #systems

#best #cpu #exploit #inks #linux #malloc #paper #programming #security #systems