Kernel Exploitation Techniques: Turning The (Page) Tables
This post explores attacking page tables as a Linux kernel exploitation technique for gaining powerful read/write primitives.
sam4k
blogging about pwning kernels and os internals
Latest posts
Linternals: Exploring The mm Subsystem via mmap [0x02]
In this part we'll use our case study to explore how the Linux kernel maps private anonymous memory.
Linternals: Exploring The mm Subsystem via mmap [0x01]
In this series we'll explore the Linux kernel's memory management subsystem, using a simple userspace program as our starting point.
ZDI-24-821: A Remote UAF in The Kernel's net/tipc
In this post I discuss a vulnerability which allows a local, or remote attacker, to trigger a use-after-free in the TIPC networking stack on affected installations of the Linux kernel.
Exploring Linux's New Random Kmalloc Caches
Let's explore the modern kernel heap exploitation meta and how the new RANDOM_KMALLOC_CACHES tries to address it.
Analysing Linux Kernel Commits
Tag along as I talk about a half finished project, looking at analysing Linux kernel commits for interesting security fixes.
Linternals: The Slab Allocator
This time we're going to build on that and introduce another memory allocator found within the Linux kernel, the slab allocator, and it's various flavours. So buckle up as we dive into the exciting world of SLABs, SLUBs and SLOBs.
So You Wanna Pwn The Kernel?
My aim for this post is to provide some insights for getting into Linux kernel vulnerability research and exploit development
Kernel Exploitation Techniques: modprobe_path
Let's kick things off with a modern day staple for local privilege escalation (LPE) in Linux Kernel Exploitation, modprobe_path.
LiKE: A Series on Linux Kernel Exploitation
Thought the Linternals series was hype? Get ready for the even SEO friendlier LiKE, a series on Linux kernel exploitation.
Linternals: Introducing Memory Allocators & The Page Allocator
I know you've all been waiting for it, that's right, we're going to be taking a dive into another exciting aspect of Linux internals: memory allocators!
Linternals: The Kernel Virtual Address Space
In this part of our journey into virtual memory in Linux, we cover the mystical kernel memory map and all it entails.
Patching, Instrumenting & Debugging Linux Kernel Modules
An introductory look into patching, instrumenting and debugging Linux kernel modules.
Linternals: The User Virtual Address Space
We continue our journey to understand virtual memory in Linux, as we take a closer look at the user virtual address space.
CVE-2022-0435: A Remote Stack Overflow in The Linux Kernel
Recently I discovered a vulnerability in the Linux kernel that's been lurking there since 4.8 (July 2016)! CVE-2022-0435 is a remotely and locally exploitable stack overflow in the TIPC networking module of the Linux kernel
A Dummy's Guide to Disclosing Linux Kernel Vulnerabilities
A post sharing some insights into the process behind responsibly disclosing vulnerabilities in the Linux kernel...
Linternals: Introducing Virtual Memory
Alright, let's get stuck into some Linternals! As the title suggests, this post will be exploring the ins and outs of virtual memory with regards to modern Linux systems.
Setting Up A Virtualised (Linux) Empire on Apple Silicon
Follow me on my journey moving my virtualisation workflow as a Linux security researcher from Linux x86_64 to MacOS aarch64.
Linternals: The (Modern) Boot Process [0x02]
Welcome to the second part of my totally-wasn't-meant-to-be-a-one-part Linux internals post on the modern boot process! Last time I set the scene and covered the GUID Partition Table (GPT) scheme for formatting your stor
Linternals: The (Modern) Boot Process [0x01]
What more appropriate way to kick off a series on Linux internals than figuring out how we actually get those internals running in the first place? This post is going to cover the process that takes us from pressing a po