Naup...

Home

Archives

About
Harvest Season for SLUB - From io_uring Vulnerability to Novel Sheaf-Based Exploitation Techniques

Harvest Season for SLUB - From io_uring Vulnerability to Novel Sheaf-Based Exploitation Techniques

Contents

  1. 1. Harvest Season for SLUB: From io_uring Vulnerability to Novel Sheaf-Based Exploitation Techniques
    1. 1.1. Preface
    2. 1.2. 1. Background
      1. 1.2.1. 1.1 io_uring Overview
      2. 1.2.2. 1.2 SLUB and the Sheaf Mechanism
        1. 1.2.2.1. 1.2.1 Layer 1: the sheaf layer (slub_percpu_sheaves)
        2. 1.2.2.2. 1.2.2 Layer 2: the barn layer (node_barn)
        3. 1.2.2.3. 1.2.3 Layer 3: the slab management layer (kmem_cache_node)
    3. 1.3. 2. Vulnerability 1: Race Condition Between CQ/SQ Resize and Deferred Task Work
      1. 1.3.1. 2.1 Root Cause
      2. 1.3.2. 2.2 Proof of Concept
      3. 1.3.3. Disclosure Timeline
      4. 1.3.4. Artifacts
    4. 1.4. 3. Vulnerability 2: Logic Error in the Error-Handling Path of the Provided-Buffer Bundle Expansion Flow
      1. 1.4.1. 3.1 Root Cause
      2. 1.4.2. 3.2 Exploitation
        1. 1.4.2.1. 3.2.1 Leaking KASLR
        2. 1.4.2.2. 3.2.2 Leaking the task_struct Address
        3. 1.4.2.3. 3.2.3 One-Shot cred Overwrite Leading to Local Privilege Escalation
      3. 1.4.3. Disclosure Timeline
      4. 1.4.4. Artifacts
    5. 1.5. 4. The Impact of Sheaf on Traditional Exploitation and the Solutions
      1. 1.5.1. 4.1 The Impact of the Sheaf Mechanism
      2. 1.5.2. 4.2 Solution 1: Flushing Sheaf and Barn Objects Back to the Slab Management Layer
      3. 1.5.3. 4.3 Solution 2: Bypassing the Sheaf Cache Layer via Cross-NUMA Node Allocation
    6. 1.6. 5. Sheaf Design Flaws: Inconsistency Between the Sheaf and Traditional Slab Implementations
      1. 1.6.1. 5.1 Flaw 1: Bypassing CONFIG_SLAB_FREELIST_HARDENED Double-Free Detection
      2. 1.6.2. 5.2 Flaw 2: Bypassing CONFIG_SLAB_FREELIST_HARDENED Pointer Protection
    7. 1.7. 6. Novel Techniques: Sheaf-Based Exploitation
      1. 1.7.1. 6.1 Technique 1: Object Array Hijack
      2. 1.7.2. 6.2 Technique 2: Object Array Out-of-Bounds Write
      3. 1.7.3. 6.3 Technique 3: Cross-Cache via the RCU slab_sheaf
      4. 1.7.4. 6.4 Applying Technique 3 to Vulnerability 2
        1. 1.7.4.1. 6.4.1 Triple Free for Information Leak and Overlapping the RCU slab_sheaf
        2. 1.7.4.2. 6.4.2 Leaking the cred kmem_cache Address
        3. 1.7.4.3. 6.4.3 Privilege Escalation by Poisoning the RCU Cache and Cross-Cache Attacking cred_jar
    8. 1.8. 7. Conclusion
    9. 1.9. after all
    10. 1.10. References
Naup堇姬
Naup堇姬
Posts
92
Categories
0
Tags
21

Home

Archives

About
2026-08-22 2026-09-12
My Second CVE on Linux Kernel - Futex and mempolicy race condition to UAF
Older

My Second CVE on Linux Kernel - Futex and mempolicy race condition to UAF

2020-2026 Naup堇姬
Powered by Hexo  Theme.Reimu
228.5k  |  19:55
Number of visits   |  Number of visitors 

Contents

  1. 1. Harvest Season for SLUB: From io_uring Vulnerability to Novel Sheaf-Based Exploitation Techniques
    1. 1.1. Preface
    2. 1.2. 1. Background
      1. 1.2.1. 1.1 io_uring Overview
      2. 1.2.2. 1.2 SLUB and the Sheaf Mechanism
        1. 1.2.2.1. 1.2.1 Layer 1: the sheaf layer (slub_percpu_sheaves)
        2. 1.2.2.2. 1.2.2 Layer 2: the barn layer (node_barn)
        3. 1.2.2.3. 1.2.3 Layer 3: the slab management layer (kmem_cache_node)
    3. 1.3. 2. Vulnerability 1: Race Condition Between CQ/SQ Resize and Deferred Task Work
      1. 1.3.1. 2.1 Root Cause
      2. 1.3.2. 2.2 Proof of Concept
      3. 1.3.3. Disclosure Timeline
      4. 1.3.4. Artifacts
    4. 1.4. 3. Vulnerability 2: Logic Error in the Error-Handling Path of the Provided-Buffer Bundle Expansion Flow
      1. 1.4.1. 3.1 Root Cause
      2. 1.4.2. 3.2 Exploitation
        1. 1.4.2.1. 3.2.1 Leaking KASLR
        2. 1.4.2.2. 3.2.2 Leaking the task_struct Address
        3. 1.4.2.3. 3.2.3 One-Shot cred Overwrite Leading to Local Privilege Escalation
      3. 1.4.3. Disclosure Timeline
      4. 1.4.4. Artifacts
    5. 1.5. 4. The Impact of Sheaf on Traditional Exploitation and the Solutions
      1. 1.5.1. 4.1 The Impact of the Sheaf Mechanism
      2. 1.5.2. 4.2 Solution 1: Flushing Sheaf and Barn Objects Back to the Slab Management Layer
      3. 1.5.3. 4.3 Solution 2: Bypassing the Sheaf Cache Layer via Cross-NUMA Node Allocation
    6. 1.6. 5. Sheaf Design Flaws: Inconsistency Between the Sheaf and Traditional Slab Implementations
      1. 1.6.1. 5.1 Flaw 1: Bypassing CONFIG_SLAB_FREELIST_HARDENED Double-Free Detection
      2. 1.6.2. 5.2 Flaw 2: Bypassing CONFIG_SLAB_FREELIST_HARDENED Pointer Protection
    7. 1.7. 6. Novel Techniques: Sheaf-Based Exploitation
      1. 1.7.1. 6.1 Technique 1: Object Array Hijack
      2. 1.7.2. 6.2 Technique 2: Object Array Out-of-Bounds Write
      3. 1.7.3. 6.3 Technique 3: Cross-Cache via the RCU slab_sheaf
      4. 1.7.4. 6.4 Applying Technique 3 to Vulnerability 2
        1. 1.7.4.1. 6.4.1 Triple Free for Information Leak and Overlapping the RCU slab_sheaf
        2. 1.7.4.2. 6.4.2 Leaking the cred kmem_cache Address
        3. 1.7.4.3. 6.4.3 Privilege Escalation by Poisoning the RCU Cache and Cross-Cache Attacking cred_jar
    8. 1.8. 7. Conclusion
    9. 1.9. after all
    10. 1.10. References
Naup堇姬
Naup堇姬
Posts
92
Categories
0
Tags
21

Home

Archives

About