SLUBStick: Arbitrary Memory Writes through Practical Software Cross-Cache
Attacks within the Linux Kernel
Lukas Maar
Graz University of Technology
Stefan Gast
Graz University of Technology
Martin Unterguggenberger
Graz University of Technology
Mathias Oberhuber
Graz University of Technology
Stefan Mangard
Graz University of Technology
Abstract
While the number of vulnerabilities in the Linux kernel has
increased significantly in recent years, most have limited capa-
bilities, such as corrupting a few bytes in restricted allocator
caches. To elevate their capabilities, security researchers have
proposed software cross-cache attacks, exploiting the mem-
ory reuse of the kernel allocator. However, such cross-cache
attacks are impractical due to their low success rate of only
40 %
, with failure scenarios often resulting in a system crash.
In this paper, we present SLUBStick, a novel kernel ex-
ploitation technique elevating a limited heap vulnerability to
an arbitrary memory read-and-write primitive. SLUBStick
operates in multiple stages: Initially, it exploits a timing side
channel of the allocator to perform a cross-cache attack reli-
ably. Concretely, exploiting the side-channel leakage pushes
the success rate to above
99 %
for frequently used generic
caches. SLUBStick then exploits code patterns prevalent in
the Linux kernel to convert a limited heap vulnerability into
a page table manipulation, thereby granting the capability to
read and write memory arbitrarily. We demonstrate the appli-
cability of SLUBStick by systematically analyzing two Linux
kernel versions, v5.19 and v6.2. Lastly, we evaluate SLUB-
Stick with a synthetic vulnerability and 9 real-world CVEs,
showcasing privilege escalation and container escape in the
Linux kernel with state-of-the-art kernel defenses enabled.
1 Introduction
Operating system kernels, such as Linux, are susceptible to
memory safety vulnerabilities due to their size and complexity.
However, most of these vulnerabilities have limited capabil-
ities, such as corrupting a few bytes in restricted allocator
caches. These limitations make exploitation difficult in prac-
tice. To make these vulnerabilities even more difficult to
exploit, researchers and kernel developers have included de-
fenses such as SMAP, KASLR, and kCFI [37]. In addition, the
kernel’s allocator is designed to restrict exploits that propagate
from heap vulnerabilities. One particular hardening strategy
is to enforce coarse-grained heap separation. This separation
places objects in distinct allocator caches that maintain blocks
of adjacent pages, called slabs, and separate security-critical
objects from frequently used objects. Hence, vulnerabilities
in frequently used caches cannot be directly exploited to ma-
nipulate security-critical objects, such as credentials.
To circumvent coarse-grained heap separation, security re-
searchers [50] presented software cross-cache attacks, which
have been used by several kernel exploits [2,13,17, 19, 28
–
30,
47]. Software cross-cache attacks exploit the memory reuse of
the kernel allocator as follows: Initially, an adversary triggers
a heap vulnerability to obtain and hold on to a write capability
for a victim object. They then free all memory slots on the
slab page containing the victim object and allocate a different
(sensitive) object type. This triggers the allocation of new
slab pages, presumably reclaiming the previously freed and
recycled slab page. The adversary then continues to overwrite
the victim object, which now resides in the same memory
location as the newly allocated sensitive object, corrupting it.
The Linux kernel has two types of allocator caches: ded-
icated and generic caches. While dedicated caches can be
reliably exploited for cross-cache attacks [2, 17, 19, 28, 47],
generic caches cannot [28, 50]. In particular, exploitation of
generic caches has a success rate of only
40 %
[50], with
failure scenarios often leading to system crashes. To in-
crease the reliability of generic cache exploitation, security
experts [13, 29, 30, 47] have used stabilization objects, e.g.,
msg_msg
or
pipe_buffer
. However, these objects cannot be
used in newer kernel versions due to more refined heap sepa-
ration, i.e., v5.14 introduced
kmalloc-cg-*
. Therefore, for
newer kernel versions, cross-cache attacks on generic caches
do not provide the reliability required in practice [28, 50].
In this paper, we present SLUBStick, a novel kernel ex-
ploitation technique that converts a limited kernel heap vul-
nerability into an arbitrary read-and-write primitive. At its
core, SLUBStick exploits timing side-channel leakage of the
kernel’s allocator to reliably trigger the recycling and reclaim-
ing process for a specific memory target. Exploiting this side-
channel leakage significantly enhances the success rate of soft-
剩余17页未读，继续阅读
资源评论
