Abstract
Researchers have proposed various methods to perform kernel exploitation, which facilitates vulnerability evaluation and fixing. To sum up, traditional approaches tend to construct ROP chains or perform arbitrary write to escalate privileges. However, the former depends on some unusual ROP gadgets to save the stack frame pointer and demands adequate kernel memory space to hold the ROP chain. Additionally, to construct arbitrary write, existing approaches either rely on the usability of a certain kernel object or have restrictions on the write value. These limitations sometimes hinder the exploitation of the vulnerability.In this paper, to overcome the limitations of existing exploitation strategies, we propose an elegant approach, which uses puppet objects and delivering gadgets to construct arbitrary writes. This approach relies on common ROP gadgets, requires less controllable memory, imposes fewer restrictions, and features a concise exploitation process. We also devise a tool named PODE to automatically identify puppet objects in Linux kernel and select suitable puppet objects and delivering gadgets for a given vulnerability. We evaluate PODE using 22 real-world kernel vulnerabilities and successfully exploit 16 of them using puppet objects, demonstrating that it not only diversifies the ways to perform kernel exploitation but also escalates the exploitability of kernel vulnerabilities.
Published Version
Talk to us
Join us for a 30 min session where you can share your feedback and ask us any queries you have
Disclaimer: All third-party content on this website/platform is and will remain the property of their respective owners and is provided on "as is" basis without any warranties, express or implied. Use of third-party content does not indicate any affiliation, sponsorship with or endorsement by them. Any references to third-party content is to identify the corresponding services and shall be considered fair use under The CopyrightLaw.