Linux 内核漏洞利用

一组与 Linux 内核安全和漏洞利用相关的链接集合。

每两个月更新一次。也欢迎提交 Pull Request。

在 X 上关注 @andreyknvl，在 Mastodon 上关注 @[email protected]，或在 Bluesky 上关注 @andreyknvl，以获取更新通知。

在 Telegram、X、Mastodon、Bluesky 或 Reddit 上订阅 @linkersec，获取精选内容。

培训

参见 xairy.io/trainings/。

目录

• 书籍
• 技术
  • 漏洞利用
  • 保护绕过
• 漏洞
  • 信息泄露
  • 本地提权
  • 远程代码执行
  • KVM
  • 其他
• 漏洞挖掘
• 防御
• 漏洞利用程序
• 工具
  • 模糊测试器
  • 杂项
• 实践
  • 工作坊
  • CTF 题目
  • 其他题目
  • 练习环境
  • 基础设施
• 杂项

书籍

2022: "Gray Hat Hacking: The Ethical Hacker's Handbook, Sixth Edition" [书籍] [资料]

2014: "Android Hacker's Handbook" 作者 Joshua J. Drake [书籍]

2012: "A Guide to Kernel Exploitation: Attacking the Core" 作者 Enrico Perla 和 Massimiliano Oldani [书籍] [资料]

技术

漏洞利用

2026: "Fence2Pwn: KFENCE-Enabled Kernel Exploitation Bypassing Slab Hardening and Memory Tagging" 作者 Ernesto Martinez Garcia 等 [论文]

2026: "Discovering, characterizing and exploiting controllable-copy objects for kernel data-only attacks with CopyKat" 作者 Jakob Koschel 等 [论文]

2026: "socket(0,2,0) - Reviving modprobe_path again" 作者 leo_something 和 BitFriends [文章]

2026: "Kernel-Exploit-Dojo" [代码]

2026: "Kernel-Hack-Drill Masterclass" 作者 Alexander Popov [视频]

2026: "PhantomMap: GPU-Assisted Kernel Exploitation" 作者 Jiayi Hu 等 [论文] [幻灯片] [视频]

2026: "Some notes on the security properties of the pipe_buffer kernel object" 作者 Alexander Popov [文章]

2026: "Cross-Cache Attacks for the Linux Kernel via PCP Massaging" 作者 Claudio Migliorelli 等 [论文]

2026: "Heap Localization: Cache Side-Channel based Linux Kernel Heap Exploit Techniques" 作者 Yoochan Lee 等 [论文]

2026: "Improving Linux Heap Exploit Reliability with FreshSlices and CPU-Bullying" [文章]

2026: "DIRTYFREE: Simplified Data-Oriented Programming in the Linux Kernel" [论文]

2026: "Table Manners: Diving into Linux pagetables exp techniques" 作者 Lau [幻灯片]

2025: "CROSS-X: Generalized and Stable Cross-Cache Attack on the Linux Kernel" 作者 Dong-ok Kim 等 [论文]

2025: "BRIDGEROUTER: Automated Capability Upgrading of Out-Of-Bounds Write Vulnerabilities to Arbitrary Memory Write Primitives in the Linux Kernel" [论文]

2025: "Extending Kernel Race Windows Using '/dev/shm'" 作者 Faith [文章]

2025: "System Register Hijacking: Compromising Kernel Integrity By Turning System Registers Against the System" [论文]

2025: "Linux Kernel Exploitation for Beginners" 作者 Kevin Massey [幻灯片] [视频]

2025: "KernelGP: Racing Against the Android Kernel" 作者 Chariton Karamitas [视频]

2025: "Control Flow Hijacking in the Linux Kernel" 作者 Valeriy Yashnikov [幻灯片] [视频]

2025: "Kernel Exploitation Techniques: Turning The (Page) Tables" 作者 Samuel Page [文章]

2025: "Linux Kernel Exploitation series" 作者 r1ru [文章] [代码]

2025: "Reviving the modprobe_path Technique: Overcoming search_binary_handler() Patch" [文章]

2025: "WHEN GOOD KERNEL DEFENSES GO BAD: Reliable and Stable Kernel Exploits via Defense-Amplified TLB Side-Channel Leaks" 作者 Lukas Maar 等 [论文] [制品] [github]

2025: "Cross Cache Attack CheetSheet" 作者 Pumpkin Chang [文章]

2024: "Cross Cache for Lazy People -- The Padding Spray Method" [文章]

2024: "Linux Kernel Use Pipe Object to Do Data-Only Attack" 作者 Pumpkin Chang [文章]

2024: "CTF-style Tricks of Linux Kernel Exploitation" 作者 Pumpkin Chang [文章] [第 2 部分]

2024: "Linux Kernel exploitation cheatsheet" 作者 Pumpkin Chang [文章]

2024: "SLUB Internals for Exploit Developers" 作者 Andrey Konovalov [幻灯片] [视频]

2024: "SCAVY: Automated Discovery of Memory Corruption Targets in Linux Kernel for Privilege Escalation" [论文]

2024: "PageJack: A Powerful Exploit Technique With Page-Level UAF" 作者 Zhiyun Qian 等 [幻灯片] [视频] [代码] [摘要]

2024: "SLUBStick: Arbitrary Memory Writes through Practical Software Cross-Cache Attacks within the Linux Kernel" 作者 Lukas Maar 等 [论文]

2024: "Linux Kernel Exploitation - ret2usr" 作者 Sascha Schirra [文章]