Articles on vulnerability research and software exploitation by Chris J-D.
Since FreeBSD 11.0, the _umtx_op syscall has contained a race condition vulnerability that leads to an exploitable use-after-free. This article explains the bug and builds up to a stable exploitation strategy that allows for a full system compromise by an unprivileged user.
FreeBSD 10.3 introduced a trivial kernel information disclosure vulnerability that became a heap disclosure from 11.2 onwards. This article explains the vulnerability and presents a technique for reliably exploiting the bug to leak the address of a useful kernel object.
NetBSD 5.0 (released 2009) introduced a change to the in-kernel coredump handler that accidentally introduced a reference count bug on the crashing process' credential. This article describes the details of the vulnerability and presents a technique for successfully exploiting it to elevate to root.
Since 2013, a race condition leading to a use-after-free has existed across all major Linux distributions between the process exit logic and reading from /proc/ /timers. It turns out to be non-exploitable, but this article explains the race and walks through the process of exploitability analysis.
A kernel refcount bug affecting FreeBSD 11.0-13.0 could be trivially exploited to gain root privileges on vulnerable systems. This article explains the vulnerability and the exploitation technique I used to write an architecture-independent proof-of-concept.