The widespread deployment of control-flow integrity has propelled non-control data attacks into the mainstream. In the domain of OS kernel exploits, by corrupting critical non-control data, local attackers can directly gain root access or privilege escalation without hijacking the control flow. As a result, OS kernels have been restricting the availability of such non-control data. This forces attackers to continue to search for more exploitable non-control data in OS kernels. However, discovering unknown non-control data can be daunting because they are often tied heavily to semantics and lack universal patterns. We make two contributions in this paper: (1) discover critical non-control objects in the file subsystem and (2) analyze their exploitability. This work represents the first study, with minimal domain knowledge, to semi-automatically discover and evaluate exploitable non-control data within the file subsystem of the Linux kernel. Our solution utilizes a custom analysis and testing framework that statically and dynamically identifies promising candidate objects. Furthermore, we categorize these discovered objects into types that are suitable for various exploit strategies, including a novel strategy necessary to overcome the defense that isolates many of these objects. These objects have the advantage of being exploitable without requiring KASLR, thus making the exploits simpler and more reliable. We use 18 real-world CVEs to evaluate the exploitability of the file system objects using various exploit strategies. We develop 10 end-to-end exploits using a subset of CVEs against the kernel with all state-of-the-art mitigations enabled.

翻译：控制流完整性的广泛部署将非控制数据攻击推向了主流。在操作系统内核利用领域，通过篡改关键的非控制数据，本地攻击者无需劫持控制流即可直接获取root权限或实现权限提升。因此，操作系统内核一直在限制此类非控制数据的可用性。这迫使攻击者继续在操作系统内核中搜索更多可被利用的非控制数据。然而，发现未知的非控制数据十分困难，因为它们通常与语义紧密相关且缺乏通用模式。本文做出两项贡献：（1）发现文件子系统中的关键非控制对象；（2）分析其可利用性。这项工作是首次在无需大量领域知识的前提下，半自动化地发现和评估Linux内核文件子系统中可被利用的非控制数据的研究。我们的解决方案利用定制的分析与测试框架，通过静态和动态方法识别有前景的候选对象。此外，我们将这些发现对象分类为适用于不同利用策略的类型，其中包括一种新型策略——该策略需克服将许多此类对象隔离的防御机制。这些对象具有无需绕过KASLR即可被利用的优势，从而使利用过程更简单、更可靠。我们使用18个真实世界的CVE，通过多种利用策略评估文件系统对象的可利用性。针对启用了所有先进防御机制的内核，我们基于部分CVE开发了10个端到端利用程序。