kernel-security-learning

Kernel-Security-Learning

Anything about kernel security. CTF kernel pwn & kernel exploit, kernel fuzz and kernel defense paper & kernel debugging technique & kernel CVE debug.

Keep updating...

1. CTF

1. linux内核漏洞利用初探（1）：环境配置
2. linux内核漏洞利用初探（2）：demo-null_dereference
3. linux内核漏洞利用初探（3）：demo-stack_overflow
4. 【Linux内核漏洞利用】2018强网杯core_栈溢出
5. 【Linux内核漏洞利用】CISCN2017-babydriver_UAF漏洞
6. 【Linux内核漏洞利用】0CTF2018-baby-double-fetch
7. 【Linux内核漏洞利用】强网杯2018-solid_core-任意读写
8. 【linux内核漏洞利用】StringIPC—从任意读写到权限提升三种方法
9. 【linux内核漏洞利用】STARCTF 2019 hackme—call_usermodehelper提权路径变量总结
10. 【linux内核漏洞利用】WCTF 2018 klist—竞争UAF-pipe堆喷
11. 【linux内核漏洞利用】TokyoWesternsCTF-2019-gnote Double-Fetch
12. 【linux内核userfaultfd使用】Balsn CTF 2019 - KrazyNote
13. linux内核提权系列教程（1）：堆喷射函数sendmsg与msgsend利用
14. linux内核提权系列教程（2）：任意地址读写到提权的4种方法
15. linux内核提权系列教程（3）：栈变量未初始化漏洞
16. 【linux内核漏洞利用】ret2dir利用方法
17. 【内核漏洞利用】绕过CONFIG_SLAB_FREELIST_HARDENED防护—kernoob两种解法
18. 【Exploit trick】Linux内核中利用msg_msg结构实现任意地址读写
19. 【Exploit trick】针对 cred 结构的 cross cache 利用（corCTF 2022-cache-of-castaways）
20. 【Exploit trick】利用poll_list对象构造kmalloc-32任意释放 (corCTF 2022-CoRJail)

2. Paper

（1）kernel exploit

1. 2014-USENIX：ret2dir: Rethinking Kernel Isolation
2. 2015-CCS：From collision to exploitation_ Unleashing Use-After-Free vulnerabilities in Linux Kernel
3. 2016-CCS：Prefetch Side-Channel Attacks - Bypassing SMAP and Kernel ASLR
4. 2016-CCS：Breaking Kernel Address Space Layout Randomization with Intel TSX
5. 2017-CCS：SemFuzz: Semantics-based Automatic Generation of Proof-of-Concept Exploits
6. 2017-NDSS：Unleashing Use-Before-Initialization Vulnerabilities in the Linux Kernel Using Targeted Stack Spraying — 【note】
7. 2018-USENIX：FUZE-Towards Facilitating Exploit Generation for Kernel Use-After-Free Vulnerabilities — 【note】【tool-FUZE】
8. 2019-USENIX：KEPLER-Facilitating Control-flow Hijacking Primitive Evaluation for Linux Kernel Vulnerabilities — 【note】【tool-KEPLER】
9. 2019-CCS：SLAKE-Facilitating Slab Manipulation for Exploiting Vulnerabilities in the Linux Kernel — 【note】【tool-SLAKE】
10. 2020-USENIX：KOOBE: Towards Facilitating Exploit Generation of Kernel Out-Of-Bounds Write Vulnerabilities — 【note】【note2】【tool-KOOBE】
11. 2020-CCS：A Systematic Study of Elastic Objects in Kernel Exploitation — 【note】【note2】【tool-ELOISE】
12. 2020-WOOT：Exploiting Uses of Uninitialized Stack Variables in Linux Kernels to Leak Kernel Pointers
13. 2021-USENIX：ExpRace: Exploiting Kernel Races through Raising Interrupts — 【note】
14. 2021-CCS：Demons in the Shared Kernel: Abstract Resource Attacks Against OS-level Virtualization — 【note】
15. 2022-USENIX：SyzScope: Revealing High-Risk Security Impacts of Fuzzer-Exposed Bugs in Linux kernel — 【toolSyzScope】
16. 2022-USENIX：Playing for K(H)eaps: Understanding and Improving Linux Kernel Exploit Reliability — 【note】
17. 2022-S&P：GREBE: Unveiling Exploitation Potential for Linux Kernel Bugs — 【note】 【note2】 【reproduce】 【tool-GREBE】
18. 2022-NDSS：Kasper: Scanning for Generalized Transient Execution Gadgets in the Linux Kernel — 【note】 【tool-Kasper】
19. 2022-CCS：DirtyCred: Escalating Privilege in Linux Kernel — 【note】
20. 2023-USENIX：PSPRAY: Timing Side-Channel based Linux Kernel Heap Exploitation Technique — 【note】 【note2】
21. 2023-USENIX：AlphaEXP: An Expert System for Identifying Security-Sensitive Kernel Objects — 【note】
22. 2023-S&P：AEM: Facilitating Cross-Version Exploitability Assessment of Linux Kernel Vulnerabilities — 【note】
23. 2023-S&P：When Top-down Meets Bottom-up: Detecting and Exploiting Use-After-Cleanup Bugs in Linux Kernel — 【note】 【note2】
24. 2023-CCS：RetSpill: Igniting User-Controlled Data to Burn Away Linux Kernel Protections — 【note】 【tool-RetSpill】
25. 2024-NDSS: SyzBridge: Bridging the Gap in Exploitability Assessment of Linux Kernel Bugs in the Linux Ecosystem - 【note】 【tool-SyzBridge】
26. 2024-NDSS: K-LEAK: Towards Automating the Generation of Multi-Step Infoleak Exploits against the Linux Kernel - 【note】 【tool-K-LEAK】
27. 2024-USENIX：Take a Step Further: Understanding Page Spray in Linux Kernel Exploitation
28. 2024-USENIX：SLUBStick: Arbitrary Memory Writes through Practical Software Cross-Cache Attacks within the Linux Kernel - 【tool-SLUBStick】
29. 2024-USENIX：SCAVY: Automated Discovery of Memory Corruption Targets in Linux Kernel for Privilege Escalation
30. 2024-TIFS：Beyond Control-Exploring Novel File System Objects for Data-Only Attacks on Linux Systems
31. 2024-CCS：On Kernel's Safety in the Spectre Era (And KASLR is Formally Dead)
32. 2025-NDSS：KernelSnitch: Side-Channel Attacks on Kernel Data Structures —— 【tool-KernelSnitch】 【slides】
33. 2025-USENIX：When Good Kernel Defenses Go Bad: Reliable and Stable Kernel Exploits via Defense-Amplified TLB Side-Channel Leaks —— 【tool-TLBSideChannel】
34. 2025-USENIX：System Register Hijacking: Compromising Kernel Integrity By Turning System Registers Against the System
35. 2025-USENIX：The Cost of Performance: Breaking ThreadX with Kernel Object Masquerading Attacks
36. 2025-S&P：BridgeRouter: Automated Capability Upgrading of Out-Of-Bounds Write Vulnerabilities to Arbitrary Memory Write Primitives in the Linux Kernel
37. 2025-CCS: Reviving Discarded Vulnerabilities: Exploiting Previously Unexploitable Linux Kernel Bugs Through Control Metadata Fields
38. 2025-CCS：CROSS-X: Generalized and Stable Cross-Cache Attack on the Linux Kernel
39. 2026-NDSS: DirtyFree: Simplified Data-Oriented Programming in the Linux Kernel
40. 2026-NDSS: Cross-Cache Attacks for the Linux Kernel via PCP Massaging
41. 2026-NDSS: SoK: Take a Deep Step into Linux Kernel Hardening Effectiveness from the Offensive-Defensive Perspective
42. 2026-S&P: Heap Localization: Cache Side-Channel based Linux Kernel Heap Exploit Techniques
43. 2026-CCS: PrivEscalate-Measuring and Augmenting the Threat of LLM-Automated Linux Privilege Escalation

Rootcase Analyze

1. 2026-USENIX: KernelRCA: Facilitating Root Cause Analysis of Memory Corruptions in Linux Kernel with Contextual Causality Chain
2. 2026-USENIX: [OS-Sanitizer: