| Foreword |
|
xi | |
| Preface |
|
xiii | |
| Acknowledgments |
|
xvii | |
| About the Authors |
|
xix | |
| About the Technical Editor |
|
xxi | |
|
PART I A JOURNEY TO KERNEL LAND |
|
|
|
Chapter 1 From User-Land to Kernel-Land Attacks |
|
|
3 | (18) |
|
|
|
3 | (1) |
|
Introducing the Kernel and the World of Kernel Exploitation |
|
|
3 | (6) |
|
|
|
5 | (4) |
|
Why Doesn't My User-Land Exploit Work Anymore? |
|
|
9 | (4) |
|
Kernel-Land Exploits versus User-Land Exploits |
|
|
11 | (2) |
|
An Exploit Writer's View of the Kernel |
|
|
13 | (5) |
|
User-Land Processes and the Scheduler |
|
|
13 | (1) |
|
|
|
14 | (4) |
|
Open Source versus Closed Source Operating Systems |
|
|
18 | (1) |
|
|
|
18 | (1) |
|
|
|
19 | (1) |
|
|
|
19 | (2) |
|
Chapter 2 A Taxonomy of Kernel Vulnerabilities |
|
|
21 | (26) |
|
|
|
21 | (1) |
|
Uninitialized/Nonvalidated/Corrupted Pointer Dereference |
|
|
22 | (4) |
|
Memory Corruption Vulnerabilities |
|
|
26 | (3) |
|
Kernel Stack Vulnerabilities |
|
|
26 | (1) |
|
Kernel Heap Vulnerabilities |
|
|
27 | (2) |
|
|
|
29 | (4) |
|
(Arithmetic) Integer Overflows |
|
|
29 | (2) |
|
|
|
31 | (2) |
|
|
|
33 | (6) |
|
Logic Bugs (a.k.a. the Bug Grab Bag) |
|
|
39 | (5) |
|
Reference Counter Overflow |
|
|
39 | (1) |
|
Physical Device Input Validation |
|
|
40 | (1) |
|
Kernel-Generated User-Land Vulnerabilities |
|
|
41 | (3) |
|
|
|
44 | (1) |
|
|
|
44 | (3) |
|
Chapter 3 Stairway to Successful Kernel Exploitation |
|
|
47 | (56) |
|
|
|
47 | (1) |
|
A Look at the Architecture Level |
|
|
48 | (10) |
|
|
|
48 | (7) |
|
|
|
55 | (3) |
|
|
|
58 | (13) |
|
|
|
59 | (7) |
|
|
|
66 | (5) |
|
|
|
71 | (19) |
|
|
|
71 | (15) |
|
|
|
86 | (4) |
|
The Information-Gathering Step |
|
|
90 | (8) |
|
What the Environment Tells Us |
|
|
91 | (5) |
|
What the Environment Would Not Want to Tell Us: Infoleaks |
|
|
96 | (2) |
|
|
|
98 | (1) |
|
|
|
99 | (4) |
|
PART II THE UNIX FAMILY, MAC OS X, AND WINDOWS |
|
|
|
Chapter 4 The UNIX Family |
|
|
103 | (92) |
|
|
|
103 | (1) |
|
The Members of the UNIX Family |
|
|
104 | (22) |
|
|
|
104 | (10) |
|
|
|
114 | (11) |
|
|
|
125 | (1) |
|
|
|
126 | (12) |
|
Abusing the Linux Privilege Model |
|
|
126 | (12) |
|
Practical UNIX Exploitation |
|
|
138 | (55) |
|
|
|
138 | (1) |
|
Attacking the OpenSolaris Slab Allocator |
|
|
139 | (21) |
|
Attacking the Linux 2.6 SLABˆHˆHUB Allocator |
|
|
160 | (17) |
|
Attacking (Linux) Kernel Stack Overflows |
|
|
177 | (7) |
|
|
|
184 | (9) |
|
|
|
193 | (1) |
|
|
|
194 | (1) |
|
|
|
195 | (74) |
|
|
|
195 | (1) |
|
|
|
196 | (4) |
|
|
|
197 | (1) |
|
|
|
197 | (1) |
|
|
|
197 | (1) |
|
|
|
198 | (2) |
|
|
|
200 | (8) |
|
|
|
208 | (19) |
|
|
|
214 | (1) |
|
Kernel Extension Auditing |
|
|
215 | (12) |
|
|
|
227 | (1) |
|
|
|
228 | (38) |
|
Arbitrary Memory Overwrite |
|
|
229 | (10) |
|
Stack-Based Buffer Overflows |
|
|
239 | (14) |
|
Memory Allocator Exploitation |
|
|
253 | (13) |
|
|
|
266 | (1) |
|
Snow Leopard Exploitation |
|
|
266 | (1) |
|
|
|
266 | (1) |
|
|
|
267 | (2) |
|
|
|
269 | (74) |
|
|
|
269 | (2) |
|
|
|
271 | (14) |
|
Kernel Information Gathering |
|
|
272 | (4) |
|
Introducing DVWD: Damn Vulnerable Windows Driver |
|
|
276 | (2) |
|
Kernel Internals Walkthrough |
|
|
278 | (4) |
|
|
|
282 | (3) |
|
|
|
285 | (23) |
|
Windows Authorization Model |
|
|
286 | (9) |
|
|
|
295 | (13) |
|
Practical Windows Exploitation |
|
|
308 | (31) |
|
Arbitrary Memory Overwrite |
|
|
308 | (11) |
|
|
|
319 | (20) |
|
|
|
339 | (1) |
|
|
|
340 | (3) |
|
PART III REMOTE KERNEL EXPLOITATION |
|
|
|
Chapter 7 Facing the Challenges of Remote Kernel Exploitation |
|
|
343 | (42) |
|
|
|
343 | (1) |
|
Attacking Remote Vulnerabilities |
|
|
344 | (4) |
|
Lack of Exposed Information |
|
|
344 | (3) |
|
Lack of Control over the Remote Target |
|
|
347 | (1) |
|
Executing the First Instruction |
|
|
348 | (14) |
|
Direct Execution Flow Redirection |
|
|
349 | (11) |
|
Arbitrary Write of Kernel Memory |
|
|
360 | (2) |
|
|
|
362 | (21) |
|
|
|
364 | (19) |
|
|
|
383 | (1) |
|
|
|
384 | (1) |
|
Chapter 8 Putting it All Together: A Linux Case Study |
|
|
385 | (34) |
|
|
|
385 | (1) |
|
SCTP FWD Chunk Heap Memory Corruption |
|
|
386 | (7) |
|
|
|
386 | (3) |
|
|
|
389 | (4) |
|
Remote Exploitation: An Overall Analysis |
|
|
393 | (1) |
|
Getting the Arbitrary Memory Overwrite Primitive |
|
|
394 | (9) |
|
Remotely Adjusting the Heap Layout |
|
|
395 | (2) |
|
Building SCTP Messages: From Relative to Absolute Memory Overwrite |
|
|
397 | (6) |
|
|
|
403 | (7) |
|
Directly Jumping from Interrupt Context to User Mode |
|
|
403 | (7) |
|
|
|
410 | (4) |
|
Checking the Current Process and Emulating the gettimeofday() function |
|
|
411 | (1) |
|
Executing the Connect-Back |
|
|
412 | (1) |
|
|
|
413 | (1) |
|
|
|
414 | (1) |
|
|
|
415 | (1) |
|
|
|
415 | (4) |
|
|
|
|
Chapter 9 Kernel Evolution: Future Forms of Attack and Defense |
|
|
419 | (18) |
|
|
|
419 | (1) |
|
|
|
420 | (5) |
|
|
|
420 | (2) |
|
|
|
422 | (3) |
|
|
|
425 | (1) |
|
|
|
425 | (7) |
|
Kernel Threat Analysis and Modeling |
|
|
425 | (2) |
|
Kernel Defense Mechanisms |
|
|
427 | (1) |
|
|
|
428 | (4) |
|
Beyond Kernel Bugs: Virtualization |
|
|
432 | (2) |
|
|
|
432 | (1) |
|
|
|
433 | (1) |
|
|
|
434 | (3) |
| Index |
|
437 | |