https://blog.omiilgo.com/tags/kernel/ Recent content in Kernel on Security Notes Hugo en-us Thu, 20 Jun 2024 10:00:00 +0800 https://blog.omiilgo.com/posts/android-kernel-lpe-classes/ Thu, 20 Jun 2024 10:00:00 +0800 https://blog.omiilgo.com/posts/android-kernel-lpe-classes/ Futex, perf_event, and get_user-era Android kernel LPE classes as broken invariants. No kernel exploit code. A toy C file-TOCTOU analog, a planted strcpy, ASAN output. https://blog.omiilgo.com/posts/dirty-pipe-class-analysis/ Thu, 03 Mar 2022 10:30:00 +0800 https://blog.omiilgo.com/posts/dirty-pipe-class-analysis/ Toy splice/pipe lab on a temp file we own, uname -r vs CVE-2022-0847, SIGSEGV on a PROT_READ map — not a setuid hijack. https://blog.omiilgo.com/posts/linux-lkm-and-syscall-hooking-concepts/ Sat, 14 Sep 2019 10:00:00 +0800 https://blog.omiilgo.com/posts/linux-lkm-and-syscall-hooking-concepts/ Lab LKM that logs openat on a VM, insmod/rmmod, dmesg artifacts — module does not hide files or hook the table for concealment.