Constructing arbitrary write via puppet objects and delivering gadgets in Linux kernel

Abstract

Researchers have proposed various methods to perform kernel exploitation, which facilitates vulnerability evaluation and fixing. To sum up, traditional approaches tend to construct ROP chains or perform arbitrary write to escalate privileges. However, the former depends on some unusual ROP gadgets to save the stack frame pointer and demands adequate kernel memory space to hold the ROP chain. Additionally, to construct arbitrary write, existing approaches either rely on the usability of a certain kernel object or have restrictions on the write value. These limitations sometimes hinder the exploitation of the vulnerability.

In this paper, to overcome the limitations of existing exploitation strategies, we propose an elegant approach, which uses puppet objects and delivering gadgets to construct arbitrary writes. This approach relies on common ROP gadgets, requires less controllable memory, imposes fewer restrictions, and features a concise exploitation process. We also devise a tool named PODE to automatically identify puppet objects in Linux kernel and select suitable puppet objects and delivering gadgets for a given vulnerability. We evaluate PODE using 22 real-world kernel vulnerabilities and successfully exploit 16 of them using puppet objects, demonstrating that it not only diversifies the ways to perform kernel exploitation but also escalates the exploitability of kernel vulnerabilities.