Hands Off and Putting SLAB/SLUB Feng Shui in a Blackbox
summary
Automated technique maps kernel allocation sites to usable objects and system calls, builds a kernel object database via static analysis plus targeted fuzzing, and then programs sequences of allocations and frees (including defragmentation and slot reordering via dummy alloc/free) to force a vulnerable slot to host a controllable victim object. Algorithms compute how many alloc/dealloc steps are needed; demo shows function-pointer overwrite leading to UID 0. Evaluated on 27 bugs, succeeds in 17, fails when POC lacks reach or in special caches.
AI-written summary · about
chapters (30)
- 0:00Introduction
- 1:20SLAB Cache
- 2:15Free Vulnerability
- 4:37Challenges
- 6:57Roadmap
- 7:44Solution
- 9:42Solution Filter
- 10:35Victim Object
- 11:18Spray Object
- 11:40Call Graph
- 13:01Kernel Noise
- 14:45SLAB Layout
- 15:35Case 1 Unoccupied
- 15:49Case 1 Side Effect
- 17:00Case 2 Tricks
- 17:30Case 2 Problem
- 17:51The Solution
- 18:07The Third Step
- 18:20The First Problem
- 19:20The Third Problem
- 19:43Evaluation
- 22:52Demo
- 26:22Linux Kernel
- 29:52General Mitigation Approach
- 33:17Summary
- 33:45Conclusion
- 35:40Not the same size
- 36:17Merge
- 37:33User Perspective
- 42:03PA
related talks
01h 31mSLUB Internals for Exploit Developers
37mHeap Layout Optimisation for Exploitation
41mUsing Microarchitectural Design to Break KASLR and More
51mAutomation Techniques in C++ Reverse Engineering
28mExtreme OS Kernel Testing
26mFrom Finding New Type of Logical Flaw at Linux Kernel To Developing New Heap Exploitation Technique
51mReducing the Kernel's Slab Allocators: Progress Report
25mThe slab allocators of past, present, and future