Explore a groundbreaking exploitation technique called "Ret2page" in this 35-minute Black Hat conference talk. Delve into the intricacies of taming both SLUB and BUDDY allocators to reduce time and memory consumption while improving physical page reuse success rates. Analyze two typical Use-After-Free vulnerabilities fixed in the previous year to evaluate Ret2page's effectiveness compared to cross-cache attack techniques. Learn how to exploit these vulnerabilities, bypass general mitigations like KASLR and PAN, and construct universal Android rooting solutions to achieve arbitrary kernel memory read/write capabilities and gain root privileges.
Ret2page - The Art of Exploiting Use-After-Free Vulnerabilities in the Dedicated Cache
Overview
Syllabus
Ret2page: The Art of Exploiting Use-After-Free Vulnerabilities in the Dedicated Cache
Taught by
Black Hat
Related Courses
-
The Art of Exploiting UAF by Ret2bpf in Android Kernel
-
Use-After-Use-After-Free - Exploit UAF by Generating Your Own
-
Use After Free Exploitation - Detecting and Exploiting Heap Vulnerabilities
-
Evils in the Sparse Texture Memory - Exploiting Kernel Vulnerabilities in GPU APIs
-
FUZE - Towards Facilitating Exploit Generation for Kernel Use-After-Free Vulnerabilities
