Forest Global Training Partners

Cyber Risks · Google Project Zero

Exploiting null-dereferences in the Linux kernel

Summary: Google Project Zero's Seth Jenkins demonstrated that null-dereference bugs in the Linux kernel, generally dismissed as harmless since mitigations like SMEP, SMAP and mmap_min_addr, can still be exploited: a null-deref in show_smaps_rollup, triggered by reading /proc/[pid]/smaps_rollup on a task with no VMAs, causes a kernel oops that skips cleanup and leaves refcounts held. By repeatedly leaking the mm_users refcount, which uses an overflow-unsafe atomic_t, the technique overflows it to zero and frees an mm still in use, producing a use-after-free; a proof-of-concept took about 8 days on a vanilla Kali Linux box, versus over 2 years on a serial-console server.

Why it matters: The bug itself was fixed in October 2022, but the more important fix was an oops limit that panics the kernel after too many oopses - and distributed kernels must inherit and backport it, or a bug class most teams write off as harmless remains a full-fledged security issue.

Read the original at Google Project Zero ↗

Topics
Vulnerabilities & Patching
Related