SLAKE: Facilitating Slab Manipulation for Exploiting

SLAKE: Facilitating Slab Manipulation for Exploiting Vulnerabilities in the Linux Kernel Yueqi Chen Xinyu Xing [email protected] [email protected] The Pennsylvania State University The Pennsylvania State University ABSTRACT 1 INTRODUCTION To determine the exploitability for a kernel vulnerability, a secu- Despite extensive code review, a Linux kernel, like all other soft- rity analyst usually has to manipulate slab and thus demonstrate ware, still inevitably contains a large number of bugs and vulnerabil- the capability of obtaining the control over a program counter or ities [42]. Compared with vulnerabilities in user-level applications, performing privilege escalation. However, this is a lengthy process a vulnerability in kernel code is generally more disconcerting be- because (1) an analyst typically has no clue about what objects cause kernel code runs with a higher privilege and the successful and system calls are useful for kernel exploitation and (2) he lacks exploitation of a kernel vulnerability could provide an attacker with the knowledge of manipulating a slab and obtaining the desired full root access. layout. In the past, researchers have proposed various techniques One straightforward solution to minimize the damage of Linux to facilitate exploit development. Unfortunately, none of them can kernel defects is to have software developers and security analysts be easily applied to address these challenges. On the one hand, this patch all the bugs and vulnerabilities immediately. However, even is because of the complexity of the Linux kernel. On the other hand, though allowing anyone to contribute to code development and this is due to the dynamics and non-deterministic of slab variations. fix, the Linux community still lacks the workforce to sift through In this work, we tackle the challenges above from two perspec- each software bug timely. As such, the Linux community typi- tives. First, we use static and dynamic analysis techniques to explore cally prioritizes kernel vulnerability remediation based on their the kernel objects, and the corresponding system calls useful for exploitability [30] (i.e., assessing a software bug based on ease of exploitation. Second, we model commonly-adopted exploitation its exploitation). methods and develop a technical approach to facilitate the slab To determine the exploitability for kernel vulnerabilities, an layout adjustment. By extending LLVM as well as Syzkaller, we analyst typically needs to manipulate slab (i.e., heap in kernel), implement our techniques and name their combination after SLAKE. manually craft working exploits and demonstrate the capability We evaluate SLAKE by using 27 real-world kernel vulnerabilities, in obtaining control over a program counter or escalating privi- demonstrating that it could not only diversify the ways to perform lege for a user process. In general, this is a time-consuming and kernel exploitation but also sometimes escalate the exploitability labor-intensive process. On the one hand, this is because given a of kernel vulnerabilities. kernel vulnerability, a security analyst lacks the knowledge about what kernel objects and system calls are useful for vulnerability CCS CONCEPTS exploitation. On the other hand, this is because even if the analyst figures out the kernel objects, as well as the corresponding system · Security and privacy → Operating systems security; Software calls, he may still have no clue about how to use them to obtain the security engineering; desired slab layout accordingly. In the past, there are many techniques developed to facilitate the KEYWORDS exploit development (e.g., [3, 4, 6, 19, 20, 24, 35, 46, 48]), and a recent OS Security; Vulnerability Exploitation; research work indicates an analyst can use various test cases to explore the desired memory layout for vulnerability exploitation [15]. ACM Reference Format: For the two following reasons, none of these techniques, however, Yueqi Chen and Xinyu Xing. 2019. SLAKE: Facilitating Slab Manipulation can be directly applied or tweaked to tackle the aforementioned for Exploiting Vulnerabilities in the Linux Kernel. In Proceedings of 2019 challenges. First, a Linux kernel is a complex system, in which many ACM SIGSAC Conference on Computer and Communications Security, London, United Kingdom, November 11–15, 2019 (CCS’19), 16 pages. kernel objects useful for exploitation cannot be allocated through https://doi.org/10.1145/3319535.3363212 test cases regularly used. As we will show in Section 6, even merely using Syzkaller (a kernel fuzzing tool) [13] to generate test cases, we are still not able to pinpoint sufficient kernel objects suitable for Permission to make digital or hard copies of all or part of this work for personal or kernel exploitation. Second, a Linux kernel contains many routines, classroom use is granted without fee provided that copies are not made or distributed making the slab very dynamic and non-deterministic. Even if an for profit or commercial advantage and that copies bear this notice and the full citation on the first page. Copyrights for components of this work owned by others than ACM analyst could observe the desired memory layout through one test must be honored. Abstracting with credit is permitted. To copy otherwise, or republish, case, he is highly unlikely to use the same test case to obtain that to post on servers or to redistribute to lists, requires prior specific permission and/or a layout as he expects. fee. Request permissions from [email protected]. CCS’19, November 11–15, 2019, London, United Kingdom In this work, we propose a new approach, to facilitate the develop- © 2019 Association for Computing Machinery. ment of working exploits for various kinds of kernel vulnerabilities ACM ISBN 978-1-4503-6747-9/19/11...$15.00 or, more precisely, a technique to facilitate slab manipulation with https://doi.org/10.1145/3319535.3363212 the goal of obtaining the capability in hijacking control flow1. We claim the problem in this scope is meaningful and non-trivial. This name our technique after SLAKE, standing for SLAb manipulation is because, after being triggered, most kernel vulnerabilities only for Kernel Exploitation. Technically speaking, it tackles the chal- demonstrate the capability in corrupting memory regions tied to lenges above from the two angles. First, SLAKE performs static and the SLAB/SLUB and, more importantly, there has not yet been a dynamic analysis to identify the objects useful for kernel exploita- generic, systematic approach that could facilitate the manipulation tion and track down corresponding system calls. Second, SLAKE of kernel memory layout and thus benefit the exploitation of such models kernel exploitation methods commonly adopted. Using the vulnerabilities. model, it then designs a technical approach to facilitate the capabil- Assumptions. By definition, the capability of a vulnerability is ity of security analysts in adjusting slab layout and thus obtaining a power, indicating at which memory addresses the vulnerability the control over the program counter. gives an adversary the ability to overwrite data freely. In this work, Given the pioneering research works (e.g., [24, 45, 46]), we do not we consider the capability of a vulnerability through a PoC pro- claim SLAKE is the first technique designed for kernel exploitation gram, which could panic kernel execution but not perform actual facilitation. However, we argue that it is the first work that can exploitation. Under the assistance of address sanitizer KASAN [10] facilitate the manipulation of the slab and thus assist an analyst in and other debugging tools (e.g., GDB [40]), a security researcher hijacking the control over kernel execution. Besides, SLAKE is the could manually learn the capability of a vulnerability. It should first work that can facilitate kernel exploitation for various types be noted we do not assume researchers could go beyond the ca- of kernel vulnerabilities (e.g., UAF, Double Free, and OOB). Using pability manifested by a PoC and find more powerful capability 27 real-world kernel vulnerabilities, we show that SLAKE could for a target vulnerability. For example, if the PoC demonstrates not only identify the kernel objects and system calls commonly the ability to overwrite only one byte, but the vulnerability could adopted by professional analysts for kernel exploitation but more actually provide the capability of performing an arbitrary write, we importantly, pinpoint objects and system calls that have never conservatively assume a researcher could obtain only the one-byte been used in the public exploits. We argue this is a very beneficial overwriting capability. characteristic for security analysts because, as we will show in In addition, we assume that a capability of controlling program Section 6, this could significantly diversify the working exploits counter directly implies the exploitability of a vulnerability. On and potentially escalate the exploitability for kernel vulnerabilities. the one hand, this is because many previous works have already In summary, this paper makes the following contributions. demonstrated an adversary can easily bypass kernel mitigation • We design a new technical approach that utilizes static/dy- and complete successful exploitation as long as he could hijack the namic analysis to identify the kernel objects and system calls control of kernel execution [2, 7, 9, 14, 21ś23, 27, 28, 32, 45]. On useful for kernel exploitation. the other hand, this is because, with the ability to

Load more