Exploiting Uses of Uninitialized Stack Variables in Linux Kernels to Leak Kernel Pointers

Authors: 

Haehyun Cho, Arizona Sate University; Jinbum Park and Joonwon Kang, Samsung Research; Tiffany Bao, Ruoyu Wang, Yan Shoshitaishvili, and Adam Doupé, Arizona State University; Gail-Joon Ahn, Arizona State University and Samsung Research

Abstract: 

Information leaks are the most prevalent type of vulnerabilities among all known vulnerabilities in Linux kernel. Many of them are caused by the use of uninitialized variables or data structures. It is generally believed that the majority of information leaks in Linux kernel are low-risk and do not have severe impact due to the difficulty (or even the impossibility) of exploitation. As a result, developers and security analysts do not pay enough attention to mitigating these vulnerabilities. Because of this, these vulnerabilities are usually assigned low CVSS scores or without any CVEs assigned. Moreover, many patches that address uninitialized data use bugs in Linux kernel are not accepted, leaving billions of Linux systems vulnerable.

Nonetheless, information leak vulnerabilities in Linux kernel are not as low-risk as people believe. In this paper, we present a generic approach that converts stack-based information leaks in Linux kernel into kernel pointer leak vulnerabilities, which can be used to defeat modern security defenses such as KASLR. Taking an exploit that triggers an information leak in Linux kernel, our approach automatically converts it into a highly impactful exploit that leaks pointers to either kernel functions or the kernel stack.We evaluate our approach on four known CVEs and one security patch in Linux kernel and demonstrate its effectiveness. Our findings provide solid evidence for Linux kernel developers and security analysts to treat information leaks in Linux kernel more seriously.

Open Access Media

USENIX is committed to Open Access to the research presented at our events. Papers and proceedings are freely available to everyone once the event begins. Any video, audio, and/or slides that are posted after the event are also free and open to everyone. Support USENIX and our commitment to Open Access.

BibTeX
@inproceedings {257182,
author = {Haehyun Cho and Jinbum Park and Joonwon Kang and Tiffany Bao and Ruoyu Wang and Yan Shoshitaishvili and Adam Doup{\'e} and Gail-Joon Ahn},
title = {Exploiting Uses of Uninitialized Stack Variables in Linux Kernels to Leak Kernel Pointers},
booktitle = {14th USENIX Workshop on Offensive Technologies (WOOT 20)},
year = {2020},
url = {https://www.usenix.org/conference/woot20/presentation/cho},
publisher = {USENIX Association},
month = aug
}

Presentation Video