Hands Off and Putting SLAB - SLUB Feng Shui in a Blackbox

This talk presents an automated technique for manipulating Linux kernel slab and SLUB memory layouts. It covers identifying relevant objects and system calls, arranging memory for exploitation, and evaluating the approach against use-after-free, double-free, and out-of-bounds vulnerabilities.

Syllabus

Introduction
SLAB Cache
Free Vulnerability
Challenges
Roadmap
Solution
Solution Filter
Victim Object
Spray Object
Call Graph
Kernel Noise
SLAB Layout
Case 1 Unoccupied
Case 1 Side Effect
Case 2 Tricks
Case 2 Problem
The Solution
The Third Step
The First Problem
The Third Problem
Evaluation
Demo
Linux Kernel
General Mitigation Approach
Summary
Conclusion
Not the same size
Merge
User Perspective
PA