Linux-Kernel-Exploitation

Eine Sammlung von Links zu Linux-Kernel-Sicherheit und -Exploitation.

Alle zwei Monate aktualisiert. Pull Requests sind ebenfalls willkommen.

Folge @andreyknvl auf X, @[email protected] auf Mastodon oder @andreyknvl auf Bluesky, um über Updates benachrichtigt zu werden.

Abonniere @linkersec auf Telegram, X, Mastodon, Bluesky oder Reddit für Highlights.

Trainings

Siehe xairy.io/trainings/.

Inhalt

• Bücher
• Techniken
  • Exploitation
  • Umgehung von Schutzmaßnahmen
• Schwachstellen
  • Info-Leaks
  • LPE
  • RCE
  • KVM
  • Sonstiges
• Bugs finden
• Defensiv
• Exploits
• Werkzeuge
  • Fuzzer
  • Verschiedenes
• Übung
  • Workshops
  • CTF-Aufgaben
  • Weitere Aufgaben
  • Spielwiesen
  • Infrastruktur
• Sonstiges

Bücher

2022: "Gray Hat Hacking: The Ethical Hacker's Handbook, Sixth Edition" [Buch] [Materialien]

2014: "Android Hacker's Handbook" von Joshua J. Drake [Buch]

2012: "A Guide to Kernel Exploitation: Attacking the Core" von Enrico Perla und Massimiliano Oldani [Buch] [Materialien]

Techniken

Exploitation

2026: "Fence2Pwn: KFENCE-Enabled Kernel Exploitation Bypassing Slab Hardening and Memory Tagging" von Ernesto Martinez Garcia et al. [Paper]

2026: "Discovering, characterizing and exploiting controllable-copy objects for kernel data-only attacks with CopyKat" von Jakob Koschel et al. [Paper]

2026: "socket(0,2,0) - Reviving modprobe_path again" von leo_something und BitFriends [Artikel]

2026: "Kernel-Exploit-Dojo" [Code]

2026: "Kernel-Hack-Drill Masterclass" von Alexander Popov [Video]

2026: "PhantomMap: GPU-Assisted Kernel Exploitation" von Jiayi Hu et al. [Paper] [Folien] [Video]

2026: "Some notes on the security properties of the pipe_buffer kernel object" von Alexander Popov [Artikel]

2026: "Cross-Cache Attacks for the Linux Kernel via PCP Massaging" von Claudio Migliorelli et al. [Paper]

2026: "Heap Localization: Cache Side-Channel based Linux Kernel Heap Exploit Techniques" von Yoochan Lee et al. [Paper]

2026: "Improving Linux Heap Exploit Reliability with FreshSlices and CPU-Bullying" [Artikel]

2026: "DIRTYFREE: Simplified Data-Oriented Programming in the Linux Kernel" [Paper]

2026: "Table Manners: Diving into Linux pagetables exp techniques" von Lau [Folien]

2025: "CROSS-X: Generalized and Stable Cross-Cache Attack on the Linux Kernel" von Dong-ok Kim et al. [Paper]

2025: "BRIDGEROUTER: Automated Capability Upgrading of Out-Of-Bounds Write Vulnerabilities to Arbitrary Memory Write Primitives in the Linux Kernel" [Paper]

2025: "Extending Kernel Race Windows Using '/dev/shm'" von Faith [Artikel]

2025: "System Register Hijacking: Compromising Kernel Integrity By Turning System Registers Against the System" [Paper]

2025: "Linux Kernel Exploitation for Beginners" von Kevin Massey [Folien] [Video]

2025: "KernelGP: Racing Against the Android Kernel" von Chariton Karamitas [Video]

2025: "Control Flow Hijacking in the Linux Kernel" von Valeriy Yashnikov [Folien] [Video]

2025: "Kernel Exploitation Techniques: Turning The (Page) Tables" von Samuel Page [Artikel]

2025: "Linux Kernel Exploitation series" von r1ru [Artikel] [Code]

2025: "Reviving the modprobe_path Technique: Overcoming search_binary_handler() Patch" [Artikel]

2025: "WHEN GOOD KERNEL DEFENSES GO BAD: Reliable and Stable Kernel Exploits via Defense-Amplified TLB Side-Channel Leaks" von Lukas Maar et al. [Paper] [Artefakte] [github]

2025: "Cross Cache Attack CheetSheet" von Pumpkin Chang [Artikel]

2024: "Cross Cache for Lazy People -- The Padding Spray Method" [Artikel]

2024: "Linux Kernel Use Pipe Object to Do Data-Only Attack" von Pumpkin Chang [Artikel]

2024: "CTF-style Tricks of Linux Kernel Exploitation" von Pumpkin Chang [Artikel] [Teil 2]

2024: "Linux Kernel exploitation cheatsheet" von Pumpkin Chang [Artikel]

2024: "SLUB Internals for Exploit Developers" von Andrey Konovalov [Folien] [Video]

2024: "SCAVY: Automated Discovery of Memory Corruption Targets in Linux Kernel for Privilege Escalation" [Paper]