The widespread deployment of control-flow integrity has shifted attackers' focus to non-control data attacks. In OS kernel exploits, attackers can gain root access or escalate privileges by corrupting critical non-control objects without hijacking the control flow. However, searching for exploitable non-control data in the OS kernel is challenging because of the data's semantic complexity and lack of universal patterns. This work represents the first study to semi-automatically discover and evaluate exploitable non-control data within the Linux kernel's file system, with minimal domain knowledge. Utilizing a custom analysis and testing framework, we identify promising candidate objects both statically and dynamically. We categorize these objects into types suitable for various exploit strategies, including a systematic strategy to overcome defenses that isolate many of these objects. These objects can be exploitable without requiring KASLR, thus making the exploits simpler and more reliable. We evaluate the exploitability of the file system objects using 18 real-world CVEs with various exploit strategies. We further develop 10 end-to-end exploits against the kernel with all state-of-the-art mitigations enabled.

The operating system kernel is the security foundation for the entire system. Yet control flow hijacking is a prevalent attack method that continually threatens its security. Control-Flow Integrity (CFI) defends against these attacks by enforcing execution compliance with a pre-computed Control-Flow Graph (CFG). The kernel is very sensitive to performance overhead, challenging the CFI scheme design. The existing Clang-CFI is software-based, making it the general solution widely deployed as the de facto CFI. However, it is coarse-grained, and its CFI scheme design cannot be easily applied to fine-grained CFGs. To provide CFI for fine-grained CFG, we propose a flexible protection design, FLEX-CFI. This software-based approach enhances generality by eliminating hardware dependencies. Our CFI design is practical and applicable to various fine-grained CFGs with negligible overhead. We implemented a prototype of FLEX-CFI based on Clang/LLVM and evaluated it on the Android ARM64 Linux kernel using a real-world hardware device. The results show that FLEX-CFI effectively secures 92% of all indirect call-sites in the allyesconfig kernel configuration while reducing target functions by 93.5% and imposing close-tozero performance overhead.

This paper proposes a cost-effective Cryptographically Secure Random Number Generator (CSRNG) utilizing a Field-Programmable Gate Array (FPGA) integrated with a Geiger counter. The front end of this system is designed to capture ambient radioactivity through a Geiger counter system that emits pulses in response to such environmental stimuli. To complement this setup, a neoTRNG-based ring oscillator RNG is incorporated to enhance the randomness of the generated numbers. By combining these elements, the CSRNG can achieve a high level of unpredictability crucial for cryptographic applications. Moving to the system's backend, utilizing the BLAKE2s hash function is pivotal in counteracting any potential biases introduced by the frontend components. This hashing function ensures that the output random numbers remain robust and secure, free from discernible patterns or vulnerabilities. In essence, the methodology outlined in this paper offers a comprehensive guide to conceptualizing and implementing a cost-effective CSRNG. The challenges inherent in generating cryptographically secure random numbers can be effectively navigated through a meticulous integration of hardware components and cryptographic techniques. This approach sheds light on the intricate processes in creating a reliable source of randomness, essential for safeguarding sensitive information in various digital systems.

The continuous integration and continuous deployment (CI/CD) pipeline has been widely used and is becoming popular on Internet hosting platforms, such as GitHub. While being popular, however, current CI/CD pipelines suffer from malicious code and severe vulnerabilities. Even worse, it is often under-protected as people have not been fully aware of its attack surfaces and the corresponding impacts. Therefore, in this paper, we conduct a large-scale measurement and a systematic analysis to reveal the attack surfaces of the CI/CD pipeline and quantify their security impacts. Specifically, for the measurement, we collect a data set of 320,000+ CI/CD pipeline-configured GitHub repositories and build an analysis tool to parse the CI/CD pipelines and extract security-critical usages. Our measurement reveals that the script runtimes are prone to code hiding while the script usage update is not in time, giving attackers chances to hide malicious code and exploit existing vulnerabilities. Moreover, even the scripts from verified creators may contain severe vulnerabilities. Besides current CI/CD ecosystem heavily relies on several core scripts, which may lead to a single point of failure. While the CI/CD pipelines contain sensitive information/operations, making them the attacker's favorite targets. Inspired by the measurement findings, we abstract the threat model and the attack approach toward CI/CD pipelines, followed by a systematic analysis of attack surfaces, attack strategies, and the corresponding impacts. We further launch case studies on five attacks in real-world CI/CD environments to validate the revealed attack surfaces. Finally, we give suggestions on mitigating attacks on CI/CD scripts, including securing CI/CD configurations, securing CI/CD scripts, and improving CI/CD infrastructure.