Linux Kernel Exploitation for Beginners

The talk aims to lower the barrier to Linux kernel exploitation by using kernel-focused capture-the-flag challenges as an entry point. It explains why the kernel is an attractive target, given its privileged context and large attack surface, and why CTF challenges are easier to start with: a predictable memory state, a prebuilt kernel image, a root filesystem, and source code for the vulnerability.

The speaker then walks through a challenge's layout. This covers unpacking the initramfs, reading the init scripts and the kernel module, and reviewing a simple module that exposes allocate, free, read and write commands with user-controlled sizes that are never checked. That gives an out-of-bounds heap read and write. A proof of concept leaks neighbouring objects, and the speaker shows how to change the environment for debugging, such as disabling KASLR and kernel pointer restriction and using GEF's kernel extensions to inspect slab caches. The TTY struct is presented as a useful target because it provides a magic value and kernel and heap pointers.

The talk covers leaking heap and kernel pointers, then using fixed offsets from a stable kernel leak to locate functions. It explains SMEP and SMAP and how kernel ROP chains reuse existing code snippets to get around them. The planned live demo did not happen, and the session ran out of time before the ROP chain was built. Practitioners can take away that small CTF modules are a practical way to learn kernel heap behaviour and mitigation bypasses.