The article discusses the rise of non-control data attacks, especially in the domain of OS kernel exploits, where corrupting critical non-control data can lead to root access or privilege escalation. The authors introduce their work on discovering critical non-control objects in the file subsystem and analyzing their exploitability. This is the first study to semi-automatically discover and evaluate exploitable non-control data within the file subsystem of the Linux kernel. The researchers use a custom analysis and testing framework to identify promising candidate objects and categorize them into types suitable for various exploit strategies. They also develop a new strategy to overcome the defense that isolates many of these objects.
Publication date: 1 Feb 2024
Project Page: Not provided
Paper: https://arxiv.org/pdf/2401.17618
