RetSpill: Igniting User-Controlled Data to Burn Away Linux Kernel Protections

Document Outline

• Abstract
• 1 Introduction
• 2 Background
• 3 Threat Model
• 4 Exploitation Technique Design
  • 4.1 Data Spillage
  • 4.2 Data Spillage Sources
  • 4.3 Weaponizing Spilled User Space Data
• 5 RetSpill vs Modern Defenses
• 6 Semi-Automatic RetSpill
  • 6.1 Snapshotting the Triggering System Call
  • 6.2 Identifying User-controllable Data
  • 6.3 ROP Chain Generation
• 7 Evaluation
  • 7.1 Data Spillage Feasibility
  • 7.2 Semi-Automation Effectiveness
  • 7.3 Protection Bypass
• 8 Defense
• 9 Discussion
• 10 Related Work
• 11 Conclusion
• 12 Acknowledgement
• References
• 13 Appendix