Organizer
Partner Company
One shot, Triple kill: Pwning all three Google kernelCTF instances with a single 1-day Linux vulnerability
Dongok Kim, SeungHyun Lee, Insu Yun
KAIST Hacking Lab
Abstract
Desktops, servers, cloud computing services, mobile devices, and IoT devices. Linux is the most popular open-source kernel and is used in various IT platforms. Because of the ubiquitous presence of Linux and the characteristic of the kernel which governs the entire system, security threat against Linux kernel is a significant concern. Numerous vulnerabilities in Linux are reported frequently, either discovered by fuzzer or through manual analysis. However, assessing the exploitability of these vulnerabilities is not a straightforward task these days, where various mitigations are applied.
To address these issues, Google recently announced kernelCTF — a bug bounty program that is specifically designed for studying Linux kernel exploits. kernelCTF originated from kCTF, which initially was a bug bounty program for GKE (Google Kubernetes Engine). Then, it has evolved into kernelCTF, to provide an environment for kernel security researchers to actively engage in vulnerability identification and exploit mitigations. For the intention of the program, kernelCTF provides various targets such as the latest LTS Linux kernel, Container-optimized OS (COS) used for GKE, and LTS Linux kernel with Google’s custom kernel exploit mitigations. Unlike other bug bounty programs, Google considers submissions as valid regardless of whether the vulnerability is 0-day or 1-day if they can successfully achieve full LPE kernel exploits with container escape.
In this talk, we will present our exploits submitted to kernelCTF. Notably, this is the first submission in kernelCTF's history that exploits every target with a single (1-day) vulnerability. We will briefly introduce what kernelCTF is and each target kernel instance of kernelCTF. Then, we will explain how we built the 1-day vulnerability exploit for every target instance in detail. This will include how we discovered this vulnerability, and how we made exploits working for the different target kernel versions, build configs, and applied mitigations. Finally, we will share our novel research and insights into kernel exploit mitigations of Linux and Google, focusing on their limitations and side effects. We will also discuss the difficulties to apply mitigations to the Linux kernel.
Speaker Info
Dongok Kim is a Master's student at KAIST Hacking Lab. He received his bachelor's degree at KAIST, School of Computing and Electrical Engineering. He is interested in general system security, including software security, binary exploitation and embedded system security. Currently, he focuses on Linux kernel security, especially in kernel exploit automation and kernel vulnerability triage. He is also a competitive CTF player and often plays for team KAIST GoN and The Goose. He participated and was awarded on several global/local CTFs.
SeungHyun Lee is an undergraduate student at KAIST, currently working as a research intern in Hacking Lab. His research focuses on system security, binary analysis, automatic vulnerability discovery and exploit generation. He is also an active CTF player at KAIST GoN and a member of multinational CTF team zer0pts.
Insu Yun is an assistant professor at KAIST, currently leading Hacking Lab. He is interested in system security in general, especially, binary analysis, automatic vulnerability detection, and automatic exploit generation. His work has been published to the major computer conferences such as IEEE Security & Privacy, USENIX Security, and USENIX OSDI. Particularly, his research won the best paper award from USENIX Security and OSDI in 2018. In addition to research, he has been participating in several hacking competitions as a hacking expert. In particular, he won Pwn2Own 2020 by compromising Apple Safari and won DEFCON CTF in 2015 and 2018, which is the world hacking competition. Prior to joining KAIST, he received his Ph.D. degree in Computer Science from Georgia Tech in 2020.