xairy/linux-kernel-exploitation

A collection of links related to Linux kernel security and exploitation

linux-kernel-exploitation's Issues

Suggestion: Linux Kernel Runtime Guard (LKRG) Bypasses

Presume you would have seen this from a couple weeks ago.

Linux Kernel Runtime Guard (LKRG) bypass using usermodehelper [PoC, CVE-2017-1000112]

PoC only - no writeup. I haven't tested it. Exploit should look familiar ;)

Potentially a useful reference as the first (?) LKRG bypass demonstration.

Edit: Tested, and didn't work for me on Ubuntu 16.04.4 4.8.0-53-generic, but willing to admit user error.

[404] From Collision To Exploitation: Unleashing Use-After-Free Vulnerabilities in Linux Kernel

From Collision To Exploitation: Unleashing Use-After-Free Vulnerabilities in Linux Kernel is HTTP 404.

Archive: http://web.archive.org/web/20170808211024if_/https://loccs.sjtu.edu.cn//~romangol/download/papers/gossip_ccs2015.pdf

Mirror: http://repository.root-me.org/Exploitation%20-%20Syst%C3%A8me/Unix/EN%20-%20From%20collision%20to%20exploitation%3A%20Unleashing%20Use-After-Free%20vulnerabilities%20in%20Linux%20Kernel.pdf

Please! Help me...

Hello, i'm starting do learn linux kernel exploitation, and for somehow, i need to dynamically set different at run-time of kernel using sysctl syscall, but for values of parameters that aren't listed on #include <linux/sysctl.h> I don't know how to change!!! Please help me with some ideas!!!

The code:

#define _GNU_SOURCE

#include <unistd.h>
#include <sys/syscall.h>
#include <string.h>
#include <stdio.h>
#include <stdlib.h>
#include <linux/sysctl.h>


int _sysctl(struct __sysctl_args *args);

int main(void) {
	int name [] = {CTL_VM, VM_MEMORY_FAILURE_RECOVERY};
	int namelen = 2;
	int oldval[8];
	size_t len = sizeof(oldval);
	int error;
    error = sysctl (name, namelen, (void *)oldval, &len, 0 , 4);
	if (error == -1){
        perror("_sysctl");
        exit(EXIT_FAILURE);
	} else {
        printf("Changed value!");
        exit(EXIT_SUCCESS);
	}
}

For another parameters listed on header file it accepts to change, but not for parameters listed on /proc/sys/vm that aren't in header!

Add BHUSA 2022 presentation by Le Wu

https://www.youtube.com/watch?v=dIVjQrqpKC0
https://i.blackhat.com/USA-22/Wednesday/US-22-Wu-Devils-Are-in-the-File.pdf