Exploiting Kernel Races through Taming Thread Interleaving

This presentation examines why some kernel race vulnerabilities cannot be exploited reliably through brute force and how controlling thread interleaving can extend the window for a race. It classifies race conditions and reviews limitations of earlier timing and scheduler-based approaches.

Syllabus

Intro
Race condition is an increasing attack vector
Background: Race Condition Vulnerability
Background: to trigger Race Condition Vulnerability
Background: Exploitability of Race Condition Vulnerability
Classification of Race Condition Vulnerability
Single-variable Race Condition
Exploitability of Single-variable Race
Multi-variable Race Condition
Exploitability of Inclusive Multi-variable Race
Problem : Exploitability of Non-inclusive Race
Previous method : Using Different Core Latency
Limitations of Use Different Core Latency
Previous Approach : Using scheduler (CONFIG PREEMPT)
Limitation of Using scheduler
Each of methods has obvious limitations
How to extend the time window?
ExpRace can solve two problems at once
Brief introduction about memory corruption exploit