The widespread deployment of control-flow integrity has shifted attackers' focus to non-control data attacks. In OS kernel exploits, attackers can gain root access or escalate privileges by corrupting critical non-control objects without hijacking the control flow. However, searching for exploitable non-control data in the OS kernel is challenging because of the data's semantic complexity and lack of universal patterns. This work represents the first study to semi-automatically discover and evaluate exploitable non-control data within the Linux kernel's file system, with minimal domain knowledge. Utilizing a custom analysis and testing framework, we identify promising candidate objects both statically and dynamically. We categorize these objects into types suitable for various exploit strategies, including a systematic strategy to overcome defenses that isolate many of these objects. These objects can be exploitable without requiring KASLR, thus making the exploits simpler and more reliable. We evaluate the exploitability of the file system objects using 18 real-world CVEs with various exploit strategies. We further develop 10 end-to-end exploits against the kernel with all state-of-the-art mitigations enabled.

The operating system kernel is the security foundation for the entire system. Yet control flow hijacking is a prevalent attack method that continually threatens its security. Control-Flow Integrity (CFI) defends against these attacks by enforcing execution compliance with a pre-computed Control-Flow Graph (CFG). The kernel is very sensitive to performance overhead, challenging the CFI scheme design. The existing Clang-CFI is software-based, making it the general solution widely deployed as the de facto CFI. However, it is coarse-grained, and its CFI scheme design cannot be easily applied to fine-grained CFGs. To provide CFI for fine-grained CFG, we propose a flexible protection design, FLEX-CFI. This software-based approach enhances generality by eliminating hardware dependencies. Our CFI design is practical and applicable to various fine-grained CFGs with negligible overhead. We implemented a prototype of FLEX-CFI based on Clang/LLVM and evaluated it on the Android ARM64 Linux kernel using a real-world hardware device. The results show that FLEX-CFI effectively secures 92% of all indirect call-sites in the allyesconfig kernel configuration while reducing target functions by 93.5% and imposing close-tozero performance overhead.

Permission checks play an essential role in operating system security by providing access control to privileged functionalities. However, it is challenging for kernel developers to scalably verify the soundness of existing checks due to the large codebase and complexity of the kernel. In fact, Linux kernel contains millions of lines of code with hundreds of permission checks, and even worse its complexity is fast-growing. This paper presents PeX, a static permission check error detector for Linux, which takes as input a kernel source code and reports any missing, inconsistent, and redundant permission checks. PeX uses KIRIN (Kernel InteRface based Indirect call aNalysis), a novel, precise, and scalable indirect call analysis technique. Over the interprocedural control flow graph built by KIRIN, PeX automatically identifies permission checks and infers the mappings between permission checks and privileged functions. For each privileged function, PeX examines all possible paths to the function to check if necessary permission checks are correctly enforced. We evaluated PeX on the latest stable Linux kernel v4.18.5 for three types of permission checks: Discretionary Access Controls (DAC), Capabilities, and Linux Security Modules (LSM). PeX reported 45 new permission check errors, 17 of which have been confirmed by the kernel developers.