.png){kind=icon}
.png){kind=icon}
Return
Constructing arbitrary write via puppet objects and delivering gadgets in Linux kernel
.png){kind=icon}
PRE
AI
DOI：10.1016/j.cose.2024.104189.png)
.png){kind=icon}
Original request for help.png){kind=icon}
Share.png){kind=icon}
Save
Abstract
En 中文
Researchers have proposed various methods to perform kernel exploitation, which facilitates vulnerability evaluation and fixing. To sum up, traditional approaches tend to construct ROP chains or perform arbitrary write to escalate privileges. However, the former depends on some unusual ROP gadgets to save the stack frame pointer and demands adequate kernel memory space to hold the ROP chain. Additionally, to construct arbitrary write, existing approaches either rely on the usability of a certain kernel objector have restrictions on the write value. These limitations sometimes hinder the exploitation of the vulnerability. In this paper, to overcome the limitations of existing exploitation strategies, we propose an elegant approach, which uses puppet objects and delivering gadgets to construct arbitrary writes. This approach relies common ROP gadgets, requires less controllable memory, imposes fewer restrictions, and features a concise exploitation process. We also devise a tool named PODE to automatically identify puppet objects in Linux kernel and select suitable puppet objects and delivering gadgets fora given vulnerability. We evaluate PODE using real-world kernel vulnerabilities and successfully exploit 16 of them using puppet objects, demonstrating that it not only diversifies the ways to perform kernel exploitation but also escalates the exploitability of kernel vulnerabilities.
Keywords:
Kernel security
Vulnerability exploitation
Arbitrary write
Privilege escalation
Journal
C
IF:
5.4
Papers:
4.6K
Citations:
1.4W