CONFidence2015 - when something overflowing... (Peter Hlavaty)

## Overview Peter Hlavaty presents kernel exploitation techniques through analysis of a real Android vulnerability discovered in Trinity/Fazer devices. The vulnerability exists in a spice function related to pipe buffer handling and was originally known from 2012 but remained applicable to current market phones. Triggering required two simple steps: resizing pipe buffer sizes and calling the spice function with manipulated parameters that caused out-of-bounds access when setting buffer indices.

## Key Topics **Vulnerability Mechanics**: The pipe buffer overflow manifests differently depending on buffer size. Small sizes trigger stack allocation and fast path execution, while large sizes cause kernel malloc allocation from the heap. Each path presents different exploitation constraints and opportunities.

**Stack vs. Heap Exploitation**: Stack-based overflow is simpler because the kernel contains no stack canaries, allowing direct return pointer corruption. However, each Android ROM has different memory layouts due to compilation differences, requiring custom exploitation for each variant. Heap-based overflow is more complex but more reliable, involving careful manipulation of slab allocations and kernel object placement.

**KASLR and Pointer Constraints**: The vulnerability cannot overflow with arbitrary data—only with kernel pointers and page sizes in fixed patterns. This constraint requires identifying specific kernel data structures to target. The speaker discovered that overflow from multiple buffers simultaneously adds complexity, as corrupted memory affects unrelated kernel objects.

**Memory Spraying Techniques**: The speaker introduces post-bank techniques using pipe splicing for efficient kernel memory spraying. Rather than traditional approaches, they exploit the pipe splice function to write data repeatedly into pipes, controlling where kernel memory allocations land. This involves creating about 5-12 pipes, writing data repeatedly for several seconds, and filling kernel address space with controlled patterns—a lightweight yet effective approach compared to traditional pool spraying on 64-bit systems.

**Slab Allocation Strategy**: Exploiting involves creating many kernel objects of identical size to populate specific slab caches, freeing selected objects, and triggering overflow when new allocations land in freed spaces. The challenge is that kernel caches are organized by size and object type, requiring careful coordination to place exploitable structures adjacent to the overflow target.

## Technical Details The exploit requires handling multiple complex stages: initial vulnerability trigger, reliable memory layout control through spraying, target structure placement, and controlled overflow execution. On 64-bit platforms with execution prevention enabled, the speaker notes that finding suitable targets (like TTY buffer structures with function pointers) requires extensive analysis. One limitation encountered was magic value checks in some structures—overwriting these triggers panic, making the target unsuitable unless the magic value can be preserved within the overflow constraints.

## Takeaways Modern kernel exploitation is primarily an engineering discipline requiring deep OS internals knowledge, multi-stage attack chains, and platform-specific adaptation. Proactive vulnerability patching is essential for companies, as successful kernel exploits typically achieve full system compromise. The speaker's team emphasizes responsible disclosure, knowledge sharing through security conferences and CTF competitions, and supporting the research community. They argue that understanding these techniques is crucial for defensive security and that security research, while challenging, is vital for protecting systems against both known and future vulnerabilities.