TY - CONF
T1 - Exploiting uses of uninitialized stack variables in linux kernels to leak kernel pointers
AU - Cho, Haehyun
AU - Park, Jinbum
AU - Kang, Joonwon
AU - Bao, Tiffany
AU - Wang, Ruoyu
AU - Shoshitaishvili, Yan
AU - Doupé, Adam
AU - Ahn, Gail Joon
N1 - Funding Information:
This material is based upon work supported in part by Sam-sung Research, Samsung Electronics, the National Science Foundation (NSF) under Grant Number 1703644, the Defense Advanced Research Projects Agency (DARPA) under agreement number HR001118C0060 and FA875019C0003, the Office of Naval Research (ONR) KK1847, the Global Research Laboratory Program through the National Research Foundation of Korea funded by the Ministry of Science and ICT under Grant NRF-2014K1A1A2043029, and a grant from the Center for Cybersecurity and Digital Forensics (CDF) at Arizona State University.
Publisher Copyright:
© WOOT 2020 - 14th USENIX Workshop on Offensive Technologies, co-located with USENIX Security 2020. All rights reserved.
PY - 2020
Y1 - 2020
N2 - Information leaks are the most prevalent type of vulnerabilities among all known vulnerabilities in Linux kernel. Many of them are caused by the use of uninitialized variables or data structures. It is generally believed that the majority of information leaks in Linux kernel are low-risk and do not have severe impact due to the difficulty (or even the impossibility) of exploitation. As a result, developers and security analysts do not pay enough attention to mitigating these vulnerabilities. Consequently, these vulnerabilities are usually assigned low CVSS scores or without any CVEs assigned. Moreover, many patches that address uninitialized data use bugs in Linux kernel are not accepted, leaving billions of Linux systems vulnerable. Nonetheless, information leak vulnerabilities in Linux kernel are not as low-risk as people believe. In this paper, we present a generic approach that converts stack-based information leaks in Linux kernel into kernel-pointer leaks, which can be used to defeat modern security defenses such as KASLR. Taking an exploit that triggers an information leak in Linux kernel, our approach automatically converts it into a highly impactful exploit that leaks pointers to either kernel functions or the kernel stack. We evaluate our approach on four known CVEs and one security patch in Linux kernel and demonstrate its effectiveness. Our findings provide solid evidence for Linux kernel developers and security analysts to treat information leaks in Linux kernel more seriously.
AB - Information leaks are the most prevalent type of vulnerabilities among all known vulnerabilities in Linux kernel. Many of them are caused by the use of uninitialized variables or data structures. It is generally believed that the majority of information leaks in Linux kernel are low-risk and do not have severe impact due to the difficulty (or even the impossibility) of exploitation. As a result, developers and security analysts do not pay enough attention to mitigating these vulnerabilities. Consequently, these vulnerabilities are usually assigned low CVSS scores or without any CVEs assigned. Moreover, many patches that address uninitialized data use bugs in Linux kernel are not accepted, leaving billions of Linux systems vulnerable. Nonetheless, information leak vulnerabilities in Linux kernel are not as low-risk as people believe. In this paper, we present a generic approach that converts stack-based information leaks in Linux kernel into kernel-pointer leaks, which can be used to defeat modern security defenses such as KASLR. Taking an exploit that triggers an information leak in Linux kernel, our approach automatically converts it into a highly impactful exploit that leaks pointers to either kernel functions or the kernel stack. We evaluate our approach on four known CVEs and one security patch in Linux kernel and demonstrate its effectiveness. Our findings provide solid evidence for Linux kernel developers and security analysts to treat information leaks in Linux kernel more seriously.
UR - http://www.scopus.com/inward/record.url?scp=85091909162&partnerID=8YFLogxK
UR - http://www.scopus.com/inward/citedby.url?scp=85091909162&partnerID=8YFLogxK
M3 - Paper
AN - SCOPUS:85091909162
T2 - 14th USENIX Workshop on Offensive Technologies, WOOT 2020, co-located with USENIX Security 2020
Y2 - 11 April 2020
ER -