Logo
ScienceStack
Table of Contents
Fetching ...
Sign In

Take a Step Further: Understanding Page Spray in Linux Kernel Exploitation

Ziyi Guo, Dang K Le, Zhenpeng Lin, Kyle Zeng, Ruoyu Wang, Tiffany Bao, Yan Shoshitaishvili, Adam Doupé, Xinyu Xing

TL;DR

A systematic investigation into Page Spray is conducted, providing an in-depth understanding of this exploitation technique, and a comprehensive exploit model termed the \sys model is introduced, elucidating its fundamental principles.

Abstract

Recently, a novel method known as Page Spray emerges, focusing on page-level exploitation for kernel vulnerabilities. Despite the advantages it offers in terms of exploitability, stability, and compatibility, comprehensive research on Page Spray remains scarce. Questions regarding its root causes, exploitation model, comparative benefits over other exploitation techniques, and possible mitigation strategies have largely remained unanswered. In this paper, we conduct a systematic investigation into Page Spray, providing an in-depth understanding of this exploitation technique. We introduce a comprehensive exploit model termed the \sys model, elucidating its fundamental principles. Additionally, we conduct a thorough analysis of the root causes underlying Page Spray occurrences within the Linux Kernel. We design an analyzer based on the Page Spray analysis model to identify Page Spray callsites. Subsequently, we evaluate the stability, exploitability, and compatibility of Page Spray through meticulously designed experiments. Finally, we propose mitigation principles for addressing Page Spray and introduce our own lightweight mitigation approach. This research aims to assist security researchers and developers in gaining insights into Page Spray, ultimately enhancing our collective understanding of this emerging exploitation technique and making improvements to the community.

Take a Step Further: Understanding Page Spray in Linux Kernel Exploitation

TL;DR

A systematic investigation into Page Spray is conducted, providing an in-depth understanding of this exploitation technique, and a comprehensive exploit model termed the \sys model is introduced, elucidating its fundamental principles.

Abstract

Recently, a novel method known as Page Spray emerges, focusing on page-level exploitation for kernel vulnerabilities. Despite the advantages it offers in terms of exploitability, stability, and compatibility, comprehensive research on Page Spray remains scarce. Questions regarding its root causes, exploitation model, comparative benefits over other exploitation techniques, and possible mitigation strategies have largely remained unanswered. In this paper, we conduct a systematic investigation into Page Spray, providing an in-depth understanding of this exploitation technique. We introduce a comprehensive exploit model termed the \sys model, elucidating its fundamental principles. Additionally, we conduct a thorough analysis of the root causes underlying Page Spray occurrences within the Linux Kernel. We design an analyzer based on the Page Spray analysis model to identify Page Spray callsites. Subsequently, we evaluate the stability, exploitability, and compatibility of Page Spray through meticulously designed experiments. Finally, we propose mitigation principles for addressing Page Spray and introduce our own lightweight mitigation approach. This research aims to assist security researchers and developers in gaining insights into Page Spray, ultimately enhancing our collective understanding of this emerging exploitation technique and making improvements to the community.
Paper Structure (65 sections, 2 figures, 4 tables)

This paper contains 65 sections, 2 figures, 4 tables.

Table of Contents

  1. Introduction
  2. Background
  3. Kernel Heap Allocator
  4. Kernel Page Allocator
  5. GFP (Get Free Pages) flags.
  6. Fallback Operation.
  7. Threat Model
  8. Page Spray Exploit Model Analysis
  9. Basic Exploitation Model
  10. Model Variants
  11. Model Adaptability
  12. Root Cause of Page Spray
  13. Existence of Fast Page-level Operations
  14. Copy-Write Call Mode
  15. Raw Page-Level Buffer.
  16. ...and 50 more sections

Figures (2)

  • Figure 1: Page Spray Exploit Model for Double Free.
  • Figure 2: Page Spray Invocation Model. Each node indicates a specific function in the overall CallGraph. is the structure which is binded with page frags.