DirtyFree: Simplified Data-Oriented Programming in the Linux Kernel

DirtyFree: Simplified Data-Oriented Programming in the Linux Kernel

Speakers: Yoochan Lee

Conference: NDSS Symposium

YouTube: https://www.youtube.com/watch?v=IGtBZj6BjW8

Overview

This talk presents DirtyFree, a simplified data-oriented programming (DOP) exploitation method for the Linux kernel that uses the arbitrary free primitive as its central building block instead of the traditional trifecta of information leak, arbitrary read, and arbitrary write. The key insight is that arbitrary free can transform almost any kernel object into a use-after-free state, and by targeting privilege-related structures like struct cred, an attacker can achieve privilege escalation through privilege placement -- freeing a low-privilege credential object and having a high-privilege one allocated in its place.

The researchers from the Max Planck Institute for Security and Privacy systematically identified 14 arbitrary free objects in the Linux kernel through automated static analysis, and successfully exploited 24 out of 31 publicly known vulnerabilities using DirtyFree -- outperforming prior DOP techniques under modern mitigations including slab virtual memory isolation (SLUB mitigation) that has rendered cross-cache attacks like Dirty Page Table impractical.

Background

▶ Watch: From bugs to exploits: the evolution from ROP to data-oriented programming (0:00)

Turning a kernel vulnerability into a working exploit requires bridging the gap between a bug and system compromise. Traditional exploitation approaches fall into two categories: control-flow attacks (like ROP/JOP) and data-oriented attacks. With the advent of kernel Control-Flow Integrity (kCFI), control-flow attacks have become significantly harder, shifting focus to data-oriented programming.

Traditional DOP in the kernel requires three strong primitives: information leakage, arbitrary read, and arbitrary write. Satisfying all three with a single vulnerability is extremely difficult. Cross-cache attacks were proposed to reduce this complexity, but slab virtual mitigation (SLUB isolation) has made those techniques impractical in modern kernel configurations. This leaves traditional DOP as often the only remaining option -- but its high primitive requirements make it inaccessible for many real-world vulnerabilities.

The arbitrary free primitive -- the ability to free a kernel object at an attacker-controlled address -- was previously considered impractical. Only a few arbitrary free objects were known, finding them was difficult, and the primitive does not directly grant arbitrary memory writes. It was typically used only as a minor auxiliary step in exploitation chains.

Key Findings

▶ Watch: Static analysis pipeline identifies 14 arbitrary free objects (4:00)

14 arbitrary free objects identified: Automated static analysis of the Linux kernel source discovered 14 objects that can serve as arbitrary free primitives, dramatically expanding the known set.

24 out of 31 vulnerabilities exploited: DirtyFree successfully exploited 24 publicly known kernel vulnerabilities, outperforming all prior DOP techniques under modern mitigations.

Fewer primitive requirements: Unlike traditional DOP requiring information leak + arbitrary read + arbitrary write, DirtyFree needs only an arbitrary free primitive. With partial pointer overwrites, even the information leak step can be skipped entirely.

Survives modern mitigations: DirtyFree works under kCFI, slab virtual mitigation, and other modern kernel defenses. Unlike Dirty Page Table (which requires cross-cache attacks defeated by SLUB mitigation), DirtyFree uses cross-cache free which survives slab isolation because it frees objects in different allocation pools.

Survives type-specific allocators: As discussed in Q&A, even the trend toward per-type kernel allocators does not mitigate DirtyFree, because the technique only needs to corrupt a pointer in the arbitrary free object -- the actual free operation works across allocation pools.

Technical Deep Dive

▶ Watch: struct cred as target: io_uring spray and privilege placement (8:00)

Arbitrary Free Mechanics: When an object A is freed, the kernel releases it and invalidates the pointer. If the pointer is corrupted to point to object B instead, and the free operation is triggered, the kernel does not validate the pointer -- it frees object B. Any other reference to object B becomes a dangling pointer, creating a use-after-free condition.

Static Analysis Pipeline for Identifying Arbitrary Free Objects: Four steps:

1. Scan kernel source and extract all kfree() call sites
2. Collect the pointer passed to each kfree call
3. Run backward taint analysis to trace where the pointer originates and which structure fields control it
4. Verify that the structure is allocatable from userspace and the path is reachable

An arbitrary free object must be: (1) allocatable by the user, (2) contain a pointer field, and (3) have that pointer used in a kfree operation.

Exploitation Method -- Privilege Placement: The target object for arbitrary free must satisfy four requirements:

1. Privilege-related: Must control process privileges (to avoid additional exploitation steps)
2. Low-privilege sprayable: An unprivileged process must be able to allocate many instances for reliable targeting
3. High-privilege sprayable: A privileged object of the same type must be allocatable to occupy the freed slot
4. Enables meaningful actions: The replaced object must enable full system control, not just limited privilege modifications

struct cred as the target: The credential structure controls process privileges in the Linux kernel. Low-privilege cred objects are sprayed using io_uring instances. After freeing a low-privilege cred via arbitrary free, a root-privilege cred is allocated at the same location. Operations under that context execute with root privileges, enabling writes to /etc/passwd for privilege escalation.

Partial Overwrite Optimization: By partially overwriting only the low 2-3 bytes of the pointer in the arbitrary free object, the attacker can redirect it to the sprayed cred region without knowing the full address, eliminating the need for an information leak primitive entirely.

Demo / Proof of Concept

▶ Watch: Results: 24 out of 31 vulnerabilities exploited (10:00)

The researchers evaluated DirtyFree against 31 publicly known Linux kernel vulnerabilities, successfully exploiting 24 of them (77.4% success rate). The exploitation flow:

1. Spray user-privilege struct cred objects
2. Partially overwrite the pointer in an arbitrary free object to target one of the sprayed creds
3. Trigger the arbitrary free, freeing the target cred
4. Allocate a root-privilege cred at the freed location
5. Use io_uring file operations under the replaced context to write to /etc/passwd, adding a new root user

DirtyFree outperformed all prior DOP techniques under modern mitigations, demonstrating its practical superiority.

Defensive Implications

▶ Watch: Q&A: DirtyFree vs Dirty Page Table and SLUB mitigation (16:00)

DirtyFree raises serious concerns about the adequacy of current kernel exploit mitigations:

SLUB mitigation is insufficient: While slab virtual isolation effectively blocks cross-cache attacks (defeating Dirty Page Table), it does not prevent cross-cache free operations. The arbitrary free primitive operates across allocation pool boundaries, making slab isolation irrelevant for this technique.

Type-specific allocators do not help: Even the kernel community's move toward per-type allocators for sensitive structures like struct cred and struct msg_msg does not mitigate DirtyFree, because the cross-cache free operates across allocation pools regardless of type isolation.

Pointer validation at kfree: The root cause is that kfree() does not validate that the freed pointer actually belongs to the calling context. Adding runtime pointer provenance checking or reference counting could mitigate this class of attack, but at potentially significant performance cost.

Memory-safe languages: The underlying requirement is a memory corruption vulnerability. The kernel community's ongoing adoption of Rust for new subsystems addresses the root cause but does not help existing C code.

Credential structure hardening: Making struct cred more difficult to spray or replace could raise the bar for this specific exploitation path, though the general technique could potentially target other privilege-related structures.

Key Takeaways

• DirtyFree simplifies Linux kernel exploitation by using arbitrary free as the sole main primitive, eliminating the need for information leak, arbitrary read, and arbitrary write
• Automated static analysis identified 14 arbitrary free objects in the Linux kernel, dramatically expanding the known attack surface
• 24 out of 31 real-world kernel vulnerabilities were successfully exploited, outperforming all prior DOP techniques under modern mitigations
• The technique survives slab virtual mitigation (SLUB isolation), kCFI, and type-specific allocators
• Partial pointer overwrites eliminate the information leak requirement entirely
• struct cred privilege placement via io_uring provides reliable privilege escalation to root

About the Speaker(s)

Yoochan Lee is a postdoctoral researcher at the Max Planck Institute for Security and Privacy (MPI-SP). The research was conducted with Hakwan and Professor Thorsten Holz. Lee is currently on the academic job market. The work represents cutting-edge kernel exploitation research that directly challenges assumptions about the effectiveness of modern kernel defense mechanisms.