Exploiting Kernel Races through Taming Thread Interleaving
0Yoochan Lee | Master Student, Seoul National University
Byoungyoung Lee | Professor, Seoul National University
Changwoo Min | Professor, Virginia Tech
Date: Thursday, August 6 | 1:30pm-2:10pm
Format: 40-Minute Briefings
Track: Exploit Development
A kernel race condition vulnerability is difficult to exploit, because thread interleaving is non-deterministic and cannot be controlled. Thus, conventional exploitation techniques against kernel races simply attempt to brute force, i.e., keep exploiting the race in hopes that the execution orders happen to be indeed racing. However, we observed that many kernel races cannot be exploited through brute forcing including three recent Linux kernel race vulnerabilities, because the chance to race is virtually zero.
This presentation introduces a new kernel race condition exploitation technique. The key idea behind our new race exploitation technique is to tame the thread execution order based on the clear understanding of the kernel’s thread interleaving mechanism. With our new exploitation techniques, we demonstrate how three Linux kernel races can be successfully exploited within 10-100 seconds, all of which were not exploitable given in 24 hours through simple brute forcing.
Black Hat - USA - 2020 Hacking conference
#hacking, #hackers, #infosec, #opsec, #IT, #security