Abstract

While for a fair amount of time, null-dereferences were exploitable vulnerabilities in the Linux kernel, due to the introduction of modern exploit mitigations, null-deref bugs are generally not considered a security issue in modern Linux kernel versions. This research describes an innovative exploit technique for null-deref vulnerabilities that circumvents these mitigations to gain privilege escalation.

This research involved using state-desynchronization primitives that occur when the kernel tries to recover to a safe execution state after a null-dereference has occurred. The kernel does this by killing the faulting task and throwing out the associated kernel task stack, which can result in local state-cleanup steps not being performed. In some cases, this can lead to exploitable conditions!

This presentation will step through each stage of this process, from the original bug discovery and nondescript public report, to the discovery (and consequent horror) of the exploit technique. We'll then build from this idea to a powerful primitive where an attacker-controlled process and a privileged process are made to share the same address space, allowing us to complete our privilege elevation. We will then discuss the subsequent mitigation introduced to the Linux kernel to prevent this technique, and demonstrate the exploit.