Linux Kernel Exploitation

与 Linux 内核安全及利用相关的链接集合。

每两个月更新一次。也欢迎提交 Pull Request。

关注 X 上的 @andreyknvl、Mastodon 上的 @[email protected] 或 Bluesky 上的 @andreyknvl 以获取更新通知。

订阅 Telegram 上的 @linkersec、X、Mastodon、Bluesky 或 Reddit 以获取精选内容。

培训

参见 xairy.io/trainings/。

目录

• 书籍
• 技术
  • 利用
  • 绕过防护
• 漏洞
  • 信息泄露
  • 本地权限提升
  • 远程代码执行
  • KVM
  • 其他
• 发现漏洞
• 防御
• 漏洞利用代码
• 工具
  • 模糊测试器
  • 其他
• 实践
  • 工作坊
  • CTF 题目
  • 其他题目
  • 练习环境
  • 基础设施
• 杂项

书籍

2014：《Android Hacker's Handbook》作者：Joshua J. Drake [书籍]

2012：《A Guide to Kernel Exploitation: Attacking the Core》作者：Enrico Perla 和 Massimiliano Oldani [书籍] [资料]

技术

利用

2026："Kernel-Exploit-Dojo" [代码]

2026："Kernel-Hack-Drill Masterclass" by Alexander Popov [视频]

2026："PhantomMap: GPU-Assisted Kernel Exploitation" by Jiayi Hu et. al [论文] [幻灯片] [视频]

2026："Some notes on the security properties of the pipe_buffer kernel object" by Alexander Popov [文章]

2026："Cross-Cache Attacks for the Linux Kernel via PCP Massaging" by Claudio Migliorelli et. al [论文]

2026："Heap Localization: Cache Side-Channel based Linux Kernel Heap Exploit Techniques" by Yoochan Lee et. al [论文]

2026："Improving Linux Heap Exploit Reliability with FreshSlices and CPU-Bullying" [文章]

2026："DIRTYFREE: Simplified Data-Oriented Programming in the Linux Kernel" [论文]

2026："Table Manners: Diving into Linux pagetables exp techniques" by Lau [幻灯片]

2025："CROSS-X: Generalized and Stable Cross-Cache Attack on the Linux Kernel" by Dong-ok Kim et. al [论文]

2025："BRIDGEROUTER: Automated Capability Upgrading of Out-Of-Bounds Write Vulnerabilities to Arbitrary Memory Write Primitives in the Linux Kernel" [论文]

2025："Extending Kernel Race Windows Using '/dev/shm'" by Faith [文章]

2025："System Register Hijacking: Compromising Kernel Integrity By Turning System Registers Against the System" [论文]

2025："Linux Kernel Exploitation for Beginners" by Kevin Massey [幻灯片] [视频]

2025："KernelGP: Racing Against the Android Kernel" by Chariton Karamitas [视频]

2025："Control Flow Hijacking in the Linux Kernel" by Valeriy Yashnikov [幻灯片] [视频]

2025："Kernel Exploitation Techniques: Turning The (Page) Tables" by Samuel Page [文章]

2025："Linux Kernel Exploitation series" by r1ru [文章] [代码]

2025："Reviving the modprobe_path Technique: Overcoming search_binary_handler() Patch" [文章]

2025："WHEN GOOD KERNEL DEFENSES GO BAD: Reliable and Stable Kernel Exploits via Defense-Amplified TLB Side-Channel Leaks" by Lukas Maar et al. [论文] [成果] [GitHub]

2025："Cross Cache Attack CheetSheet" by Pumpkin Chang [文章]

2024："Cross Cache for Lazy People -- The Padding Spray Method" [文章]

2024："Linux Kernel Use Pipe Object to Do Data-Only Attack" by Pumpkin Chang [文章]

2024："CTF-style Tricks of Linux Kernel Exploitation" by Pumpkin Chang [文章] [第二部分]

2024："Linux Kernel exploitation cheatsheet" by Pumpkin Chang [文章]

2024："SLUB Internals for Exploit Developers" by Andrey Konovalov [幻灯片] [视频]

2024："SCAVY: Automated Discovery of Memory Corruption Targets in Linux Kernel for Privilege Escalation" [论文]

2024："PageJack: A Powerful Exploit Technique With Page-Level UAF" by Zhiyun Qian et. al [幻灯片] [视频] [代码] [总结]

2024："SLUBStick: Arbitrary Memory Writes through Practical Software Cross-Cache Attacks within the Linux Kernel" by Lukas Maar et. al [论文]

2024："Linux Kernel Exploitation - ret2usr" by Sascha Schirra [文章]

2024："Binary Exploitation Notes: Kernel" by Andrej Ljubic [文章]

2024："Take a Step Further: Understanding Page Spray in Linux Kernel Exploitation" [论文]

2024："GhostRace: Exploiting and Mitigating Speculative Race Conditions" [论文]

2024："K-LEAK: Towards Automating the Generation of Multi-Step Infoleak Exploits against the Linux Kernel" [论文]

2024："Beyond Control: Exploring Novel File System Objects for Data-Only Attacks on Linux Systems" [论文]