Utilizing Cross-CPU Allocation to Exploit Preempt-Disabled Linux Kernel

No ratings

Presented at Hexacon 2024 by

Mingi Cho. Wongi Lee

The Linux kernel is widely used in cloud servers, mobile devices, automotive, and more, and its security is becoming increasingly important. To discover vulnerabilities in the Linux kernel, there are bug bounty programs such as Pwn2Own, KernelCTF, and Android VRP. In this talk, we exploit two vulnerabilities CVE-2023-31248 and CVE-2024-36978. To exploit these vulnerabilities, we introduce a novel exploitation technique “Cross-CPU Allocation”. The first vulnerability is CVE-2023-31248, a vulnerability found in nftables, which was exploited at Pwn2Own 2023. The second vulnerability is CVE-2024-36978, a vulnerability found in the traffic control subsystem found by Hangyu Hua and was firstly exploited by Wongi Lee at the mitigation kernel of kernelCTF. We will discuss the challenges we encountered during the exploit and how we solved them. Resources