Exploração do Kernel Linux

Uma coleção de links relacionados à segurança e exploração do kernel Linux.

Atualizado bimestralmente. Pull requests também são bem-vindos.

Siga @andreyknvl no X, @[email protected] no Mastodon, ou @andreyknvl no Bluesky para ser notificado das atualizações.

Inscreva-se em @linkersec no Telegram, X, Mastodon, Bluesky, ou Reddit para destaques.

Treinamentos

Veja xairy.io/trainings/.

Conteúdos

• Livros
• Técnicas
  • Exploração
  • Bypasses de Proteção
• Vulnerabilidades
  • Vazamentos de Informação
  • LPE
  • RCE
  • KVM
  • Outros
• Encontrando Bugs
• Defensivo
• Exploits
• Ferramentas
  • Fuzzers
  • Diversos
• Prática
  • Workshops
  • Tarefas de CTF
  • Outras Tarefas
  • Playgrounds
  • Infraestrutura
• Diversos

Livros

2022: "Gray Hat Hacking: The Ethical Hacker's Handbook, Sixth Edition" [livro] [materiais]

2014: "Android Hacker's Handbook" por Joshua J. Drake [livro]

2012: "A Guide to Kernel Exploitation: Attacking the Core" por Enrico Perla e Massimiliano Oldani [livro] [materiais]

Técnicas

Exploração

2026: "Fence2Pwn: KFENCE-Enabled Kernel Exploitation Bypassing Slab Hardening and Memory Tagging" por Ernesto Martinez Garcia et al. [artigo]

2026: "Discovering, characterizing and exploiting controllable-copy objects for kernel data-only attacks with CopyKat" por Jakob Koschel et al. [artigo]

2026: "socket(0,2,0) - Reviving modprobe_path again" por leo_something e BitFriends [artigo]

2026: "Kernel-Exploit-Dojo" [código]

2026: "Kernel-Hack-Drill Masterclass" por Alexander Popov [vídeo]

2026: "PhantomMap: GPU-Assisted Kernel Exploitation" por Jiayi Hu et al. [artigo] [slides] [vídeo]

2026: "Some notes on the security properties of the pipe_buffer kernel object" por Alexander Popov [artigo]

2026: "Cross-Cache Attacks for the Linux Kernel via PCP Massaging" por Claudio Migliorelli et al. [artigo]

2026: "Heap Localization: Cache Side-Channel based Linux Kernel Heap Exploit Techniques" por Yoochan Lee et al. [artigo]

2026: "Improving Linux Heap Exploit Reliability with FreshSlices and CPU-Bullying" [artigo]

2026: "DIRTYFREE: Simplified Data-Oriented Programming in the Linux Kernel" [artigo]

2026: "Table Manners: Diving into Linux pagetables exp techniques" por Lau [slides]

2025: "CROSS-X: Generalized and Stable Cross-Cache Attack on the Linux Kernel" por Dong-ok Kim et al. [artigo]

2025: "BRIDGEROUTER: Automated Capability Upgrading of Out-Of-Bounds Write Vulnerabilities to Arbitrary Memory Write Primitives in the Linux Kernel" [artigo]

2025: "Extending Kernel Race Windows Using '/dev/shm'" por Faith [artigo]

2025: "System Register Hijacking: Compromising Kernel Integrity By Turning System Registers Against the System" [artigo]

2025: "Linux Kernel Exploitation for Beginners" por Kevin Massey [slides] [vídeo]

2025: "KernelGP: Racing Against the Android Kernel" por Chariton Karamitas [vídeo]

2025: "Control Flow Hijacking in the Linux Kernel" por Valeriy Yashnikov [slides] [vídeo]

2025: "Kernel Exploitation Techniques: Turning The (Page) Tables" por Samuel Page [artigo]

2025: "Linux Kernel Exploitation series" por r1ru [artigos] [código]

2025: "Reviving the modprobe_path Technique: Overcoming search_binary_handler() Patch" [artigo]

2025: "WHEN GOOD KERNEL DEFENSES GO BAD: Reliable and Stable Kernel Exploits via Defense-Amplified TLB Side-Channel Leaks" por Lukas Maar et al. [artigo] [artefatos] [github]

2025: "Cross Cache Attack CheetSheet" por Pumpkin Chang [artigo]

2024: "Cross Cache for Lazy People -- The Padding Spray Method" [artigo]

2024: "Linux Kernel Use Pipe Object to Do Data-Only Attack" por Pumpkin Chang [artigo]

2024: "CTF-style Tricks of Linux Kernel Exploitation" por Pumpkin Chang [artigo] [parte 2]

2024: "Linux Kernel exploitation cheatsheet" por Pumpkin Chang [artigo]

2024: "SLUB Internals for Exploit Developers" por Andrey Konovalov [slides] [vídeo]

2024: "SCAVY: Automated Discovery of Memory Corruption Targets in Linux Kernel for Privilege Escalation" [artigo]