How Double-Fetch Situations turn into Double-Fetch Vulnerabilities...
summary
A static, pattern-based analysis built on the Coccinelle matching engine scans Linux, Android and FreeBSD kernels for repeated user-to-kernel copies and refines rules for pointer aliasing, header/body messages, loops and shallow copies. The study flags 90 double-fetch occurrences, 57 in drivers, manually narrows these to exploitable cases and found six true bugs (three driver-exploitable) that maintainers patched; the detector is being integrated into Linux patch vetting.
AI-written summary · about
chapters (12)
- 0:00Introduction and talk outline
- 1:05Understanding double fetch
- 3:44Kernel data transfer mechanics
- 8:14Approach overview and methodology
- 10:10Manual analysis insights
- 12:00Vulnerability scenarios
- 15:27Shallow copy issues
- 17:02Refining the detection tool
- 20:51Results and findings
- 23:03Discussion of findings
- 25:41Conclusion
- 26:37Q&A session
related talks
44mDeep Analysis of Exploitable Linux Kernel Vulnerabilities 2017-2019
38mHow I started chasing speculative type confusion bugs in the kernel and ended up wi...
53mResearching New Attack Interfaces On iOS And OSX
01h 16mClassic Vulnerabilities
01h 05mClassic Vulnerabilities
52mWelcome & Opening Remarks & Meaningful Bounds Checking in the Linux Kernel
39mCache the Frames, Catch the Vulnerabilities in Kernel Streaming
15mEffective Static Analysis of Concurrency Use-After-Free Bugs in Linux Device Drivers