Background: to trigger Race Condition Vulnerability
5
Background: Exploitability of Race Condition Vulnerability
6
Classification of Race Condition Vulnerability
7
Single-variable Race Condition
8
Exploitability of Single-variable Race
9
Multi-variable Race Condition
10
Exploitability of Inclusive Multi-variable Race
11
Problem : Exploitability of Non-inclusive Race
12
Previous method : Using Different Core Latency
13
Limitations of Use Different Core Latency
14
Previous Approach : Using scheduler (CONFIG PREEMPT)
15
Limitation of Using scheduler
16
Each of methods has obvious limitations
17
How to extend the time window?
18
ExpRace can solve two problems at once
19
Brief introduction about memory corruption exploit
Description:
Explore kernel race condition vulnerabilities and advanced exploitation techniques in this Black Hat conference talk. Delve into the challenges of exploiting non-deterministic thread interleaving and learn why conventional brute force methods often fail. Examine three recent Linux kernel race vulnerabilities and discover a novel approach to extend the exploitation time window. Gain insights into different types of race conditions, including single-variable and multi-variable races, and understand their varying levels of exploitability. Analyze previous exploitation methods, such as using different core latency and scheduler manipulation, along with their limitations. Introduce yourself to the ExpRace technique, which addresses multiple exploitation challenges simultaneously. Conclude with a brief overview of memory corruption exploits in the context of kernel race conditions.
Exploiting Kernel Races through Taming Thread Interleaving