Chapter 1 - From User-Land to Kernel-Land Attacks

Abstract

In the past, kernel exploits have proven to be not only possible, but also extremely powerful and efficient, especially on systems equipped with state-of-the-art security patches. This power comes with the expense of requiring a wide and deep understanding of the kernel code and a bigger effort in the development of the exploit. This chapter introduces the kernel, and why many exploit developers are interested in it. It begins with the introduction of some generic, mandatory kernel concepts: how the kernel keeps track of and selects processes to run, and how virtual memory allows each process to run as though it has a large, contiguous, and private address space. Further, this chapter deals with combined user and kernel address space versus separated address space design. This concept is important because it highly affects the way exploits are written. On combined systems, one can basically dereference any address in a process address space that one controls. The chapter concludes with a small refresher on the open versus closed source saga.