Abstract:The kernel vulnerability DirtyPipe was reported to be present in nearly all versions of Linux since 5.8. Using this vulnerability, a bad actor could fulfill privilege escalation without triggering existing kernel protection and exploit mitigation, making this vulnerability particularly disconcerting. However, the success of DirtyPipe exploitation heavily relies on this vulnerability's capability (i.e., injecting data into the arbitrary file through Linux's pipes). Such an ability is rarely seen for other kernel vulnerabilities, making the defense relatively easy. As long as Linux users eliminate the vulnerability, the system could be relatively secure. This work proposes a new exploitation method -- DirtyCred -- pushing other Linux kernel vulnerabilities to the level of DirtyPipe. Technically speaking, given a Linux kernel vulnerability, our exploitation method swaps unprivileged and privileged kernel credentials and thus provides the vulnerability with the DirtyPipe-like exploitability. With this exploitability, a bad actor could obtain the ability to escalate privilege and even escape the container. We evaluated this exploitation approach on 24 real-world kernel vulnerabilities in a fully-protected Linux system. We discovered that DirtyCred could demonstrate exploitability on 16 vulnerabilities, implying DirtyCred's security severity. Following the exploitability assessment, this work further proposes a new kernel defense mechanism. Unlike existing Linux kernel defenses, our new defense isolates kernel credential objects on non-overlapping memory regions based on their own privilege. Our experiment result shows that the new defense introduces primarily negligible overhead.

Principle and Attack Method of Kernel Overflow under Win32 Enviroment

Research on Principle and Defense of Buffer Overflow Attacks

Different is Good

Defense Buffer Overflow in Code Writing

Based on the FUZZING Lead to a New Mining Method Based on Windows Kernel Vulnerability

Progress in Research on Buffer Overflow Vulnerability Analysis Technologies

Understanding Concurrency Vulnerabilities in Linux Kernel

POP and PUSH: Demystifying and Defending Against (mach) Port-oriented Programming.

DirtyCred: Escalating Privilege in Linux Kernel

OWL: Understanding and Detecting Concurrency Attacks

Buffer Overflow Attacks Analysis and Real-time Detection

Technology to Prevent Buffer Overflow Attacks Based on CPU Hardware

Advanced exploitation of buffer overflow

Research for Buffer Overflow Vulnerabilities Based on Multi-Dimensional Fuzzing Technology

Towards Efficient Heap Overflow Discovery

Dynamic and static analyses of integer overflow vulnerabilities

Evolution of Exploitation and Exploit Mitigation

HeapTherapy: An Efficient End-to-End Solution against Heap Buffer Overflows

Research on Integer-Based Vulnerabilities：Security Model, Detecting Methods and Real- World Cases

Beyond Control: Exploring Novel File System Objects for Data-Only Attacks on Linux Systems

Research on Key Memory Attack Windows 7 Operating System