Linux kernel exploitation playbook. Use when exploiting kernel vulnerabilities (UAF, OOB, race condition, type confusion) for privilege escalation via commit_creds, modprobe_path overwrite, or kernel ROP chains in CTF and real-world scenarios.

SKILL: Linux Kernel Exploitation — Expert Attack Playbook AI LOAD INSTRUCTION : Expert kernel exploitation techniques. Covers environment setup (QEMU), vulnerability classes, privilege escalation targets, kernel ROP, ret2usr, stack pivoting, and cross cache attacks. Distilled from ctf wiki kernel mode sections and real world kernel CVEs. Base models often confuse user mode and kernel mode exploitation constraints, especially regarding SMEP/SMAP/KPTI. 0. RELATED ROUTING [binary protection bypass](../binary protection bypass/SKILL.md) — userspace protections (NX, ASLR) also apply in kernel context [stack overflow and rop](../stack overflow and rop/SKILL.md) — kernel ROP reuses many userspace ROP concepts [heap exploitation](../heap exploitation/SKILL.md) — kernel SLUB is conceptually related to userspace heap [linux privilege escalation](../linux privilege escalation/SKILL.md) — non exploit kernel privesc techniques Advanced References [KERNEL MITIGATION BYPASS.md](./KERNEL MITIGATION BYPASS.md) — KASLR, SMEP, SMAP, KPTI, FG KASLR, CFI bypass techniques [KERNEL HEAP TECHNIQUES.md](./KERNEL HEAP TECHNIQUES.md) — SLUB internals, cross cache attacks, msg msg/pipe buffer/sk buff exploitation 1. EXPLOITATION MODEL 2. ENVIRONMENT SETUP QEMU + Custom Kernel GDB Debugging initramfs Modification 3. COMMON VULNERABILITY TYPES Type Description Kernel Example UAF Object freed but pointer still accessible CVE 2022 0847 (DirtyPipe) OOB Read/Write Array index or size check missing CVE 2021 22555 (Netfilter) Race Condition TOCTOU between check and use CVE 2016 5195 (DirtyCow) Integer Overflow Size calculation wraps around Various ioctl handlers Type Confusion Object cast to wrong type CVE 2023 0179 (Netfilter) Double Free Object freed twice SLUB allocator exploitation Stack Overflow Kernel stack buffer overflow Rare (kernel stack is small: 8KB–16KB) 4. PRIVILEGE ESCALATION TARGETS Method 1: commit creds(prepare kernel cred(0)) Kernel ROP chain equivalent: Method 2: modprobe path Overwrite Method 3: cred Structure Direct Overwrite If you can find the current task's cred pointer and have arbitrary write, directly zero out uid/gid fields in the cred structure. Method 4: Namespace Escape (Containers) Overwrite init nsproxy or manipulate namespace pointers to escape container isolation. 5. KERNEL ROP Controlled RIP Sources Source Mechanism Corrupted function pointer UAF object has vtable like dispatch → overwrite pointer Corrupted return address Kernel stack overflow (rare) Corrupted ops structure Module operations struct (file operations, seq operations) seq operations Hijack (Common CTF Pattern) Stack Pivoting in Kernel Gadget Usage xchg eax, esp; ret Pivot to address in lower 32 bits of RAX (mmap buffer at known addr) mov rsp, [rdi+X]; ... If RDI points to controlled data push rdi; pop rsp; ... Pivot to RDI (first arg of hijacked function) Important : After SMEP, cannot execute userspace code. ROP chain must use kernel gadgets only. 6. ret2usr (Pre SMEP) Directly call a userspace function from kernel context: Blocked by : SMEP (Supervisor Mode Execution Prevention) — kernel cannot execute user mapped pages. 7. RETURNING TO USERSPACE After privilege escalation in kernel, must return cleanly to userspace to get a root shell. Via iretq (Traditional) Via KPTI Trampoline (When KPTI Enabled) KPTI separates kernel/user page tables. Direct swapgs; iretq crashes because user pages aren't mapped. Use the kernel's own return trampoline: Via signal Handler Return Set up a signal handler before exploit. After commit creds , trigger the signal → return to userspace via signal handler (avoids manual swapgs/iretq). 8. QEMU DEBUGGING TIPS Command Purpose s S GDB server on :1234, paused monitor /dev/null Disable QEMU monitor (cleaner output) append "nokaslr" Disable KASLR for debugging cpu kvm64,+smep,+smap Enable specific CPU features info registers (GDB) Show all register values maintenance packet Qqemu.PhyMemMode:1 Read physical memory in GDB cat /proc/kallsyms Kernel symbol addresses (if readable) cat /sys/kernel/notes Kernel build ID 9. DECISION TREE

kernel-exploitation