squirre17/hbp-attack-demoLinux kernel hbp exploit method demo. (i.e. the degradation version of CVE-2022-42703)
fork from https://github.com/veritas501/hbp_attack_demo
Reference: P0 blog: https://googleprojectzero.blogspot.com/2022/12/exploiting-CVE-2022-42703-bringing-back-the-stack-attack.html
Created a vuln module, pretending we have a kernel arbitrary address write primitive, but KASLR is enabled and there is no address leak yet.
Therefore, by leveraging the feature that cpu_entry_area is not randomized by KASLR and the feature that hardware breakpoints can be triggered in kernel mode, we can leak KASLR and canary on the kernel stack and escalate privileges through a ROP attack.
blog: Analysis and demonstration of a privilege escalation idea using hardware breakpoints
wget https://cdn.kernel.org/pub/linux/kernel/v5.x/linux-5.15.103.tar.xz
ctrl + \ to exit qemu
The vmlinux with symbols is too large, it will be rejected, so only bzImage can be used.