Parallelly Refill SLUB Objects Freed in Slow Paths: An Approach to Exploit the Use-After-Free Vulnerabilities in Linux Kernel

Recently since exploiting vulnerabilities in user application is becoming very difficult, vulnerabilities in Linux kernel have been paid more and more attention, especially the use-after-free vulnerabilities gained the most focus. However, there lacks a completion theory to exploit use-after-free vulnerabilities. The key to exploit UAF vulnerability is how to refill the freed object, because those days that the space just freed will be occupied firstly is gone. We propose a strategy to exploit the use-after-free vulnerabilities by continuously allocating objects. And to promote the efficiency and success rate, we present a technique by parallelly refilling objects with multiple threads and monitor. We also make a simulation experiment to verify the effectiveness of our theory. At last we give some mitigations to this attack.