Exploiting the Linux Kernel

This training guides researchers through the field of Linux kernel exploitation. In a series of practical labs, the training explores the process of exploiting kernel bugs in a modern Linux distribution on the x86-64 architecture.

The training is structured as a series of lectures, each followed by one or more hands-on labs. The goal of each lab is to write a Linux kernel exploit following the techniques described during the lecture.

The training starts with beginner topics but proceeds into advanced areas as well. The beginner chapters include learning how to escalate privileges and bypass foundational mitigations in x86-64 kernels. The advanced chapters are primarily dedicated to the modern slab (heap) exploitation techniques and include an in-depth analysis of the kernel allocators’ internals.

The core requirement for this training is the ability to read and write C code. Basic knowledge of the x86-64 architecture and assembly, GDB, and the common binary exploitation techniques would also come in handy. There is no need to know any Linux kernel internals: all required parts are covered during the training.

TRAINING TOPICS

• Security-relevant Linux kernel internals and attack surface

• Kernel privilege escalation techniques

• Exploiting stack, global, and slab (heap) vulnerabilities

• Exploiting use-after-free and out-of-bounds vulnerabilities

• KASLR, SMEP, SMAP, and KPTI bypasses

• In-kernel Return-Oriented Programming (ROP)

• Cross-cache and cross-allocator exploitation

• Data-only kernel exploitation