Compromising Linux the Right Way: 0-days, Novel Techniques, and Lessons from Failure

No ratings

Presented at HITCON 2025 by

Pumpkin

Linux kernel exploitation has always been challenging due to its limited attack surface and constantly evolving mitigations. To address these challenges, bug bounty programs like Google’s kernelCTF provide a realistic environment where researchers can explore vulnerabilities under practical constraints. Despite the intense and often high-paced competition, it remains an ideal setting for refining advanced exploitation techniques and discovering real-world bugs. In this presentation, I will demonstrate how two novel techniques were used to exploit net/sched vulnerabilities in kernelCTF. The first technique simplifies UAF exploitation by hijacking a secondary object, which eliminates the need to control the entire freed structure and improves reliability in constrained heap environments. The second involves a kernel variable that can be directly controlled by the attacker, enabling the construction of fake objects or ROP chains with just a kernel base leak. By chaining these techniques together, we achieved privilege escalation to root on the latest LTS Linux kernel. Beyond the technical exploitation, I will also share insights into the net/sched subsystem, including its design and recurring logic flaws. Additionally, I will recount how I found CVE-2025-21700 and CVE-2025-21703 during a one-day analysis of CVE-2024-56770 — though other researchers had reported these issues ahead of me. The talk will conclude with key takeaways on kernel research mindset, exploit development, and the novel techniques derived from this journey.