From Finding New Type of Logical Flaw at Linux Kernel To Developing New Heap Exploitation Technique
summary
A new technique called Pspray uses a timing side-channel to detect the slowpath slab creation in the Linux kernel, catch the moment a fresh slab gets a single allocation, then prefill that slab so CPU per‑CPU free lists remain unchanged and overlapping allocations succeed. A proof‑of‑concept measures thousands of allocation timings, raises exploitation reliability (reported increased by ~80%), and improves success across UAF, double‑free and OOB cases though noise and edge‑of‑slab placement still cause failures.
AI-written summary · about
chapters (8)
- 0:00Start
- 5:58SLUB (Architecture)
- 7:07SLUB (Allocation mechanism)
- 11:00Summarize the problem
- 11:59Research Question
- 13:18Back to SLUB
- 19:41Out-Of-Bounds
- 25:01Conclusion
related talks
01h 31mSLUB Internals for Exploit Developers
44mHands Off and Putting SLAB/SLUB Feng Shui in a Blackbox
41mUsing Microarchitectural Design to Break KASLR and More
43mUsing Undocumented CPU Behavior to See Into Kernel Mode and Break KASLR in the Process
44mDeep Analysis of Exploitable Linux Kernel Vulnerabilities 2017-2019
30mMicro-Virtualization Memory Tracing to Detect and Prevent Spraying Attacks
01h 00mIntroduction to memory exploitation
49mBypassing KPTI Using the Speculative Behavior of the SWAPGS Instruction