Security Researcher, Theori
The Linux kernel’s vsock subsystem contains CVE-2024-50264, a multi-task race condition in the vsock loopback path that can trigger a Use-After-Free by carefully orchestrating races among four or more tasks.
This talk first briefly reviews vsock’s internal behavior and the root cause of the bug (timing vulnerabilities and state-machine inconsistencies), then focuses on the advanced techniques we used to exploit it in practice. Concretely, we explain how we combined timerfd-based timing control, sequencing to induce state-machine confusion, SLUBStick-driven allocation/free pattern control, and Dirty PageTable techniques for manipulating memory state to build a reliable exploit chain.
Using this approach we submitted the exploit to Google kernelCTF and won a prize of $81,337, and the vulnerability later received the Pwnie Awards 2025 Best Privilege Escalation prize. Finally, we share interesting anecdotes and unexpected obstacles encountered during the exploit development so other researchers can benefit when analyzing and exploiting similarly complex race vulnerabilities.
Hyunwoo Kim (@v4bel) is an independent vulnerability researcher focused on the Linux kernel, with a track record that includes wins at Google kernelCTF, Pwn2Own, and the Pwnie Awards.
Wongi Lee (@_qwerty_po) is a security researcher at Theori, with a track record that includes wins at Google kernelCTF, Pwn2Own, and the Pwnie Awards.
POC Conference is made possible thanks to the support of our sponsors. Their continued partnership has played a vital role in sustaining and growing POC over the years. We sincerely thank them for their contribution.
