Kernel Wars: Reliable Kernel-Mode Exploitation

Architecture and Background

Joel Eriksson & Panel: Kernel Wars Kernel vulnerabilities are often deemed unexploitable or at least unlikely to be exploited reliably. Although it's true that kernel-mode exploitation often presents some new challenges for exploit developers, it still all boils down to "creative debugging" and knowledge about the target in question. This talk intends to demystify kernel-mode exploitation by demonstrating the analysis and reliable exploitation of three different kernel vulnerabilities without public exploits.

Vulnerability Analysis

From a defenders point of view this could hopefully serve as an eye-opener, as it demonstrates the ineffectiveness of HIDS, NX, ASLR and other protective measures when the kernel itself is being exploited. The entire process will be discussed, including how the vulnerabilities were found, how they were analyzed to determine if and how they can be reliably exploited and of course the exploits will be demonstrated in practice. The vulnerabilities that will be discussed are: - FreeBSD 802.11 Management Frame Integer Overflow Found and exploited by Karl Janmar.

Exploitation and Demonstrations

Advisory: - NetBSD Local Kernel Heap Overflow Found by Christer Oberg, exploited by Christer Oberg and Joel Eriksson. - Windows (2000 & XP) Local GDI Memory Overwrite Found by Cesar Cerrudo, exploited by Joel Eriksson. Advisory: More information about the vulnerabilities can be found at: Joel Eriksson is the CTO of Bitsec, a newly founded security company based in Sweden.

Remediation and Defensive Strategies

Joel has been working in the computer security field since 1997 when he started out as an independent consultant. His primary focus is within vulnerability research, exploit development and reverse engineering. Joel has previously spoken at BlackHat Europe and UNCON.