bsauce / kernel-security-learning Public

Notifications You must be signed in to change notification settings
Fork 82
Star 641

Anything about kernel security. CTF kernel pwn, kernel exploit, kernel fuzz and kernel defense paper, kernel debugging technique, kernel CVE debug.

641 stars 82 forks Branches Tags Activity

Notifications

Name		Name	Last commit message	Last commit date
Latest commit History 89 Commits
CVE		CVE
debug_technique		debug_technique
paper		paper
README.md		README.md

Repository files navigation

Kernel-Security-Learning

Anything about kernel security. CTF kernel pwn & kernel exploit, kernel fuzz and kernel defense paper & kernel debugging technique & kernel CVE debug.

Keep updating...

1. CTF

2. Paper

（1）kernel exploit

2014-USENIX：ret2dir: Rethinking Kernel Isolation
2015-CCS：From collision to exploitation_ Unleashing Use-After-Free vulnerabilities in Linux Kernel
2016-CCS：Prefetch Side-Channel Attacks - Bypassing SMAP and Kernel ASLR
2016-CCS：Breaking Kernel Address Space Layout Randomization with Intel TSX
2017-CCS：SemFuzz: Semantics-based Automatic Generation of Proof-of-Concept Exploits
2017-NDSS：Unleashing Use-Before-Initialization Vulnerabilities in the Linux Kernel Using Targeted Stack Spraying — 【note】
2018-USENIX：FUZE-Towards Facilitating Exploit Generation for Kernel Use-After-Free Vulnerabilities — 【note】【tool-FUZE】
2019-USENIX：KEPLER-Facilitating Control-flow Hijacking Primitive Evaluation for Linux Kernel Vulnerabilities — 【note】【tool-KEPLER】
2019-CCS：SLAKE-Facilitating Slab Manipulation for Exploiting Vulnerabilities in the Linux Kernel — 【note】【tool-SLAKE】
2020-USENIX：KOOBE: Towards Facilitating Exploit Generation of Kernel Out-Of-Bounds Write Vulnerabilities — 【note】【note2】【tool-KOOBE】
2020-CCS：A Systematic Study of Elastic Objects in Kernel Exploitation — 【note】【note2】【tool-ELOISE】
2020-WOOT：Exploiting Uses of Uninitialized Stack Variables in Linux Kernels to Leak Kernel Pointers
2021-USENIX：ExpRace: Exploiting Kernel Races through Raising Interrupts — 【note】
2021-CCS：Demons in the Shared Kernel: Abstract Resource Attacks Against OS-level Virtualization — 【note】
2022-USENIX：SyzScope: Revealing High-Risk Security Impacts of Fuzzer-Exposed Bugs in Linux kernel — 【toolSyzScope】
2022-USENIX：Playing for K(H)eaps: Understanding and Improving Linux Kernel Exploit Reliability — 【note】
2022-S&P：GREBE: Unveiling Exploitation Potential for Linux Kernel Bugs — 【note】【note2】【reproduce】【tool-GREBE】
2022-NDSS：Kasper: Scanning for Generalized Transient Execution Gadgets in the Linux Kernel — 【note】【tool-Kasper】
2022-CCS：DirtyCred: Escalating Privilege in Linux Kernel — 【note】
2023-USENIX：PSPRAY: Timing Side-Channel based Linux Kernel Heap Exploitation Technique — 【note】【note2】
2023-USENIX：AlphaEXP: An Expert System for Identifying Security-Sensitive Kernel Objects — 【note】
2023-S&P：AEM: Facilitating Cross-Version Exploitability Assessment of Linux Kernel Vulnerabilities — 【note】
2023-S&P：When Top-down Meets Bottom-up: Detecting and Exploiting Use-After-Cleanup Bugs in Linux Kernel — 【note】【note2】
2023-CCS：RetSpill: Igniting User-Controlled Data to Burn Away Linux Kernel Protections — 【note】【tool-RetSpill】
2024-NDSS: SyzBridge: Bridging the Gap in Exploitability Assessment of Linux Kernel Bugs in the Linux Ecosystem - 【note】【tool-SyzBridge】
2024-NDSS: K-LEAK: Towards Automating the Generation of Multi-Step Infoleak Exploits against the Linux Kernel - 【note】【tool-K-LEAK】
2024-USENIX：Take a Step Further: Understanding Page Spray in Linux Kernel Exploitation
2024-USENIX：SLUBStick: Arbitrary Memory Writes through Practical Software Cross-Cache Attacks within the Linux Kernel - 【tool-SLUBStick】
2024-USENIX：SCAVY: Automated Discovery of Memory Corruption Targets in Linux Kernel for Privilege Escalation

（2）kernel vulerability detection

2012-OSDI：Improving integer security for systems with KINT
2014-Black Hat：QSEE TrustZone Kernel Integer Overflow
2014-USENIX：Static Analysis of Variability in System Software - The 90, 000 #ifdefs Issue
2014-OSDI：SKI：Exposing Kernel Concurrency Bugs through Systematic Schedule Exploration
2015-SOSP：Cross-checking semantic correctness: The case of finding file system bugs — 【tool-JUXTA】
2016-USENIX：UniSan-Proactive Kernel Memory Initialization to Eliminate Data Leakages — 【note】【tool-unisan】
2016-USENIX：APISan: Sanitizing API Usages through Semantic Cross-Checking — 【tool-apisan】
2017-EUROSYS：DangSan - Scalable Use-after-free Detection — 【tool-dangsan】
2017-USENIX-ATC：CAB-Fuzz：Practical Concolic Testing Techniques for {COTS} Operating Systems
2017-CCS：DIFUZE-Interface Aware Fuzzing for Kernel Drivers — 【note】【tool-difuze】
2017-USENIX：Digtool- A Virtualization-Based Framework for Detecting Kernel Vulnerabilities-usenix — 【note】【note2】【note3】【note4】
2017-USENIX：How Double-Fetch Situations turn into DoubleFetch — 【note】【tool】
2017-USENIX：DR. CHECKER- A Soundy Analysis for Linux Kernel Drivers — 【tool-dr_checker】
2017-USENIX：kAFL- Hardware-Assisted Feedback Fuzzing for OS Kernels — 【note】【tool-kAFL】
2018-S&P：DEADLINE-Precise and Scalable Detection of Double-Fetch Bugs in OS Kernels — 【note】【note2】【note3】【tool-DEADLINE】
2018-CCS：Check It Again- Detecting Lacking-Recheck Bugs in OS Kernels — 【note】【note2】【tool-LRSan】
2018-USENIX：MoonShine：Optimizing OS Fuzzer Seed Selection with Trace Distillation — 【note】【note2】【tool-moonshine】
2018-NDSS：K-Miner: Uncovering Memory Corruption in Linux — 【note】【note2】【tool-K-Miner】
2019-S&P：Razzer：Finding Kernel Race Bugs through Fuzzing — 【note】【note2】【note3】【tool-razzer】
2019-WOOT-Workshop：Unicorefuzz- On the Viability of Emulation for Kernelspace Fuzzing — 【tool-unicorefuzz】
2019-FSE：Detecting Concurrency Memory Corruption Vulnerabilities — 【tool-CONVUL】
2019-S&P：Fuzzing File Systems via Two-Dimensional Input Space Exploration — 【note】【note2】【tool-JANUS】
2019-USENIX：Detecting Missing-Check Bugs via Semantic- and Context-Aware Criticalness and Constraints Inferences — 【tool-CRIX】
2019-USENIX-ATC：Effective Static Analysis of Concurrency Use-After-Free Bugs in Linux Device Drivers — 【note】
2019-NDSS：PeriScope：An Effective Probing and Fuzzing Framework for the Hardware-OS Boundary — 【note】【tool-periscope】
2018-USENIX-ATC：DSAC: Effective Static Analysis of Sleep-in-Atomic-Context Bugs in Kernel Modules
2020-TOCS：Effective Detection of Sleep-in-atomic-context Bugs in the Linux Kernel
2020-NDSS：HFL: Hybrid Fuzzing on the Linux Kernel — 【note】【note2】【note3】
2020-S&P：Krace: Data Race Fuzzing for Kernel File Systems — 【note】
2020-USENIX：Agamotto: Accelerating Kernel Driver Fuzzing with Lightweight Virtual Machine Checkpoints — presentation
2020-USENIX：Muzz: Thread-aware Grey-box Fuzzing for Effective Bug Hunting in Multithreaded Programs — 【note】
2020-CCS：Exaggerated Error Handling Hurts! An In-Depth Study and Context-Aware Detection —【note】
2020-FSE：UBITect: A Precise and Scalable Method to Detect Use-Before-Initialization Bugs in Linux Kernel — 【note】
2020-LPC：KCSAN-Data-race detection in the Linux kernel
2021-NDSS：Detecting Kernel Memory Leaks in Specialized Modules With Ownership Reasoning — 【note】
2021-NDSS：KUBO: Precise and Scalable Detection of User-triggerable Undefined Behavior Bugs in OS Kernel — 【note】
2021-USENIX：Detecting Kernel Refcount Bugs with Two-Dimensional Consistency Checking — 【note】
2021-USENIX：Understanding and Detecting Disordered Error Handling with Precise Function Pairing — 【note】
2021-USENIX：An Analysis of Speculative Type Confusion Vulnerabilities in the Wild
2021-USENIX：Static Detection of Unsafe DMA Accesses in Device Drivers — 【note】
2021-CCS：Statically Discovering High-Order Taint Style Vulnerabilities in OS Kernels — 【note】【note2】
2021-CCS：Detecting Missed Security Operations Through Differential Checking of Object-based Similar Paths — 【note】
2021-SOSP：HEALER: Relation Learning Guided Kernel Fuzzing — 【tool-healer】【note】【note2】【note3】
2021-S&P：A Novel Dynamic Analysis Infrastructure to Instrument Untrusted Execution Flow Across User-Kernel Spaces
2022-NDSS：An In-depth Analysis of Duplicated Linux Kernel Bug Reports — 【note】
2022-NDSS：Progressive Scrutiny-Incremental Detection of UBI bugs in the Linux Kernel — 【note】
2022-NDSS：Semantic-Informed Driver Fuzzing Without Both the Hardware Devices and the Emulators — 【note】【note2】
2022-USENIX：LinKRID: Vetting Imbalance Reference Counting in Linux kernel with Symbolic Execution — 【note】【note2】
2022-USENIX：OS-Aware Vulnerability Prioritization via Differential Severity Analysis
2023-NDSS：No Grammar, No Problem: Towards Fuzzing the Linux Kernel without System-Call Descriptions
2023-USENIX：FirmSolo: Enabling dynamic analysis of binary Linux-based IoT kernel modules — 【note】
2023-USENIX：Mitigating Security Risks in Linux with KLAUS: A Method for Evaluating Patch Correctness
2023-USENIX：BoKASAN: Binary-only Kernel Address Sanitizer for Effective Kernel Fuzzing
2023-USENIX：ACTOR: Action-Guided Kernel Fuzzing
2023-USENIX：Uncontained: Uncovering Container Confusion in the Linux Kernel
2023-USENIX：DDRace: Finding Concurrency UAF Vulnerabilities in Linux Drivers with Directed Fuzzing
2023-S&P：SyzDescribe: Principled, Automated, Static Generation of Syscall Descriptions for Kernel Drivers — 【tool-SyzDescribe】
2023-S&P：Precise Detection of Kernel Data Races with Probabilistic Lockset Analysis
2023-S&P：SEGFUZZ: Segmentizing Thread Interleaving to Discover Kernel Concurrency Bugs through Fuzzing — 【tool-segfuzz】
2023-CCS：SyzDirect: Directed Greybox Fuzzing for Linux Kernel — 【tool-Syzdirect】
2024-NDSS: MOCK: Optimizing Kernel Fuzzing Mutation with Context-aware Dependency - 【tool-mock】
2024-S&P: To Boldly Go Where No Fuzzer Has Gone Before: Finding Bugs in Linux' Wireless Stacks through VirtIO Devices - 【tool-Virtfuzz】
2024-S&P: SyzGen++: Dependency Inference for Augmenting Kernel Driver Fuzzing 【tool-SyzGen++】

（3）kernel defense

2011-NDSS：Practical Protection of Kernel Integrity for Commodity OS from Untrusted Extensions
2011-NDSS：SigGraph - Brute Force Scanning of Kernel Data Structure Instances Using Graph-based Signatures
2011-NDSS：Efficient Monitoring of Untrusted Kernel-Mode Execution
2012-NDSS：Kruiser - Semi-synchronized Non-blocking Concurrent Kernel Heap Buffer Overflow Monitoring
2012-OSDI：Improving Integer Security for Systems with KINT
2012-S&P：Smashing the Gadgets - Hindering Return-Oriented Programming Using In-place Code Randomization
2012-USS：Enhanced Operating System Security Through Efficient and Fine-grained Address Space Randomization
2013-EUROSYS：Process firewalls - protecting processes during resource access
2013-NDSS：Attack Surface Metrics and Automated Compile-Time OS Kernel Tailoring
2013-S&P：Just-In-Time Code Reuse - On the Effectiveness of Fine-Grained Address Space Layout Randomization
2014-CCS：A Tale of Two Kernels - Towards Ending Kernel Hardening Wars with Split Kernel
2014-NDSS：ROPecker - A Generic and Practical Approach For Defending Against ROP Attacks
2014-OSDI：Jitk - A Trustworthy In-Kernel Interpreter Infrastructure
2014-S&P：KCoFI - Complete Control-Flow Integrity for Commodity Operating System Kernels
2014-S&P：Dancing with Giants - Wimpy Kernels for On-Demand Isolated I/O
2015-NDSS：Preventing Use-after-free with Dangling Pointers Nullification
2016-NDSS：Enforcing Kernel Security Invariants with Data Flow Integrity
2016-OSDI：Light-Weight Contexts - An OS Abstraction for Safety and Performance
2016-OSDI：EbbRT - A Framework for Building Per-Application Library Operating Systems
2017-EUROSYS：A Characterization of State Spill in Modern Operating Systems
2017-EUROSYS：kRˆX: Comprehensive Kernel Protection Against Just-In-Time Code Reuse 【slides】
2017-NDSS：PT-Rand - Practical Mitigation of Data-only Attacks against Page Tables
2017-S&P：NORAX - Enabling Execute-Only Memory for COTS Binaries on AArch64
2017-CCS：FreeGuard - A Faster Secure Heap Allocator
2017-USENIX：Lock-in-Pop - Securing Privileged Operating System Kernels by Keeping on the Beaten Path
2017-USENIX：Can’t Touch This: Software-only Mitigation against Rowhammer Attacks targeting Kernel Memory
2017-USENIX：Oscar: A Practical Page-Permissions-Based Scheme for Thwarting Dangling Pointers
2019-S&P：LBM - A Security Framework for Peripherals within the Linux Kernel
2019-S&P：SoK - Shining Light on Shadow Stacks
2019-S&P：SoK - Sanitizing for Security
2019-USENIX：PeX: A Permission Check Analysis Framework for Linux Kernel
2019-USENIX：ERIM: Secure, Efficient In-process Isolation with Protection Keys (MPK)
2019-USENIX：LXDs - Towards Isolation of Kernel Subsystems
2019-USENIX：SafeHidden: An Efficient and Secure Information Hiding Technique Using Re-randomization
2020-S&P：xMP: Selective Memory Protection for Kernel and User Space
2020-S&P：SEIMI: Efficient and Secure SMAP-Enabled Intra-process Memory Isolation — 【note】
2021-USENIX：Undo Workarounds for Kernel Bugs
2021-USENIX：SHARD: Fine-Grained Kernel Specialization with Context-Aware Hardening
2021-USENIX：Preventing Use-After-Free Attacks with Fast Forward Allocation
2022-NDSS：Preventing Kernel Hacks with HAKCs
2022-USENIX：Midas: Systematic Kernel TOCTTOU Protection
2023-S&P：EC: Embedded Systems Compartmentalization via Intra-Kernel Isolation
2023-S&P：uSwitch: Fast Kernel Context Isolation with Implicit Context Switches
2023-USENIX：PET: Prevent Discovered Errors from Being Triggered in the Linux Kernel
2023-USENIX：A Hybrid Alias Analysis and Its Application to Global Variable Protection in the Linux Kernel
2024-USENIX：SeaK: Rethinking the Design of a Secure Allocator for OS Kernel

other resources：

（4） Android

2020-USEINX：Automatic Hot Patch Generation for Android Kernels—自动给安卓打补丁【note】

3. CVE

4. Exploitation Techniques

Dirty Pagetable-一种新的内核漏洞利用技术

5. Tool

6. Debug & other techniques

Reference:

linux-security-papers

linux-kernel-exploitation

GoSSIP_Software Security Group

About

Anything about kernel security. CTF kernel pwn, kernel exploit, kernel fuzz and kernel defense paper, kernel debugging technique, kernel CVE debug.

Report repository

Releases

No releases published

Packages

No packages published

Contributors 2

Languages