Exploiting a Missed Linux Kernel Patch in a KernelCTF Instance

No ratings

Presented at Zer0Con 2024 by

Mingi Cho

In recent years, nftables has become one of the most targeted components in the Linux kernel by attackers. Vulnerabilities in nftables were successfully exploited in Pwn2Own 2022 and 2023, with nearly 40 flags captured from exploiting these vulnerabilities submitted to kernelCTF. In this talk, we will present a vulnerability that we discovered in nftables, along with an exploit we developed for kernelCTF. Interestingly, while the vulnerability was patched in the upstream kernel, it was missed for more than 8 months in the stable kernels, despite nftables being intensively targeted by many attackers. In addition, we will introduce three Linux kernel mitigations — CONFIG_SLAB_VIRTUAL, CONFIG_KMALLOC_SPLIT_VARSIZE, and CONFIG_RANDOM_KMALLOC_CACHES — used by the mitigation kernel of kernelCTF, and we will present techniques to bypass these protections.