New Linux Kernel Exploit Technique ‘SLUBStick’ Discovered by Researchers

Aug 07, 2024Ravie LakshmananLinux / Vulnerability

Cybersecurity researchers have uncovered a new Linux kernel exploitation method known as SLUBStick that can be used to escalate a limited heap vulnerability to an arbitrary memory read-and-write primitive.

“Initially, it leverages a timing side-channel of the allocator to conduct a cross-cache attack reliably,” a team of researchers from the Graz University of Technology explained [PDF]. “Specifically, exploiting the side-channel leakage increases the success rate to over 99% for commonly used generic caches.”

Memory safety flaws affecting the Linux kernel have restricted capabilities and are more difficult to exploit due to security features like Supervisor Mode Access Prevention (SMAP), Kernel address space layout randomization (KASLR), and kernel control flow integrity (kCFI).

While software cross-cache attacks have been developed to bypass kernel hardening measures like coarse-grained heap separation, research shows that current methods have a success rate of only 40%.

SLUBStick has been demonstrated on versions 5.19 and 6.2 of the Linux kernel using nine security vulnerabilities (e.g., double free, use-after-free, and out-of-bounds write) identified between 2021 and 2023, resulting in privilege escalation to root without authentication and container escapes.

The fundamental concept behind this approach is to provide the ability to alter kernel data and acquire an arbitrary memory read-and-write primitive in a way that effectively bypasses existing defenses like KASLR.

However, for this method to be successful, the threat model assumes the presence of a heap vulnerability in the Linux kernel and that an unprivileged user possesses code execution capabilities.

“SLUBStick targets newer systems, including v5.19 and v6.2, for a range of heap vulnerabilities,” the researchers noted.