Thursday, September 15, 2016

Notes about ret2dir & PaX/Grsecurity

A paper "ret2dir: Rethinking Kernel Isolation" was released two years ago. It claimed that ret2dir can bypass modern mitigations including KERNEXEC/UDEREF/SMEP/SMAP/PXN. The author proposed a defensive solution is called eXclusive Page Frame Ownership (XPFO) in the paper. But it was not merge into the vanilla kernel back then. Some guys are trying to merge it again lately.

ret2dir might be a dramatic exploit technique can be useful to bypass mitigations. But it's not that "perfect" when it comes to PaX/Grsecurity. KERNEXEC does much more things than SMEP/PXN simply does not allow kernel code execution from userspace. I'd like to share a few things( truth?):

1, Even under kernel <= 3.9, the kernel patched with PaX/Grsecurity can prevent ret2dir attack without enabling any features. ret2dir only works if a few highly situational conditions satisfied. More detail? Plz ask those who did the tricks;-)

2, The fully ret2dir attack is based on PFN's information. The paper reveals two approaches to get the information:

1) simply read the info from /proc
2) physmap spraying

Unfortunately, all exploits we've found( public exploits & unpacked from malwares) are using the 1st approach in past 18 months. The evidence revealed that all other ret2dir exploits are copycats of these two ret2dir exploit examples( exploit writers aren't work hard?):

IMOHO, ROP is the only option left for ret2dir attack. Otherwise, creating a ROP chains is not that easy on PaX/Grsecurity kernel even without RAP, isn't it?

13 comments:

Unknown said...

شركة كشف تسربات المياه بالقطيف

كشف تسربات المياه بالقطيف

افضل شركة كشف تسربات المياه بالقطيف

شركة كشف تسربات بالقطيف

Ajay yadav said...


Great post keep up the good work. Thank for share amazing blog..


Best distance mba in india

luckys said...

gta 4 apk

akhilapriya said...

Great Information you have shared, Check it once Citysights ny Promo Codes

luckys said...

afdah

Situs Judi Online Terpercaya said...

Yuk Gabung di NAGAQQ: AGEN BANDARQ BANDARQ ONLINE ADUQ ONLINE DOMINOQQ TERBAIK

Yang Merupakan Agen Bandarq, Domino 99, Dan Bandar Poker Online Terpercaya di asia hadir untuk anda semua dengan permainan permainan menarik dan bonus menarik untuk anda semua

Bonus yang diberikan NagaQQ :
* Bonus rollingan 0.5%,setiap senin di bagikannya
* Bonus Refferal 10% + 10%,seumur hidup
* Bonus Jackpot, yang dapat anda dapatkan dengan mudah
* Minimal Depo 15.000
* Minimal WD 20.000

Memegang Gelar atau title sebagai Agen BandarQ Terbaik di masanya

Games Yang di Hadirkan NagaQQ :
* Poker Online
* BandarQ
* Domino99
* Bandar Poker
* Bandar66
* Sakong
* Capsa Susun
* AduQ
* Perang Bacarrat (New Game)

Tersedia Deposit Via pulsa :
Telkomsel & XL

Info Lebih lanjut Kunjungi :
Website : NagaQQ
Facebook : NagaQQ Official
Kontakk : Info NagaQQ
linktree : Agen Judi Online
WHATSAPP 1 : +855977509035
Line : Cs_nagaQQ
TELEGRAM : +855967014811


BACA JUGA BLOGSPORT KAMI YANG LAIN:
agen bandarq terbaik
Winner NagaQQ
Daftar NagaQQ
Agen Poker Online

CrownQQ Official said...

CrownQQ Agen DominoQQ BandarQ dan Domino99 Online Terbesar

Yuk Buruan ikutan bermain di website CrownQQ
Sekarang CROWNQQ Memiliki Game terbaru Dan Ternama loh...

9 permainan :
=> Poker
=> Bandar Poker
=> Domino99
=> BandarQ
=> AduQ
=> Sakong
=> Capsa Susun
=> Bandar 66
=> Perang Baccarat (NEW GAME)

=> Bonus Refferal 20%
=> Bonus Turn Over 0,5%
=> Minimal Depo 20.000
=> Minimal WD 20.000
=> 100% Member Asli
=> Pelayanan DP & WD 24 jam
=> Livechat Kami 24 Jam Online
=> Bisa Dimainkan Di Hp Android
=> Di Layani Dengan 5 Bank Terbaik
=> 1 User ID 9 Permainan Menarik

Ayo gabung sekarang juga hanya dengan
mengklick Agen BandarQ

Link Resmi CrownQQ:
- crownqq01.com
- crownqq01.net
- crownqq01.org

Info Lebih lanjut Kunjungi :
Website : CrownQQ
Daftar CrownQQ : Poker Online
Info CrownQQ : Kontakk
Linktree : Agen Poker Online

WHATSAPP : +855882357563
Line : CS CROWNQQ
Facebook : CrownQQ Official
Kemenangan CrownQQ : Agen BandarQ

Rajabandarq said...

Mau Dapatkan Uang Dengan Mudah...
Yuk join bersama Rajabandarq Situs Bandarq, DominoQQ, Poker Online terbaik di asia dengan 9 game yang paling seru...

Buruan Daftar Disini >>> Daftar Rajabandarq
Klik Disini : Situs BandarQ
Klik Disini : Poker Online

Baca juga :

- Blogger : 24berita harian
- Blogger : Kisahselebindo
- Blogger : myrenew22
- Blogger : Panduan Bermain Game Judi Online
- Blogger : Dunia Fauna

TiketQQ said...

TiketQQ
SITUS BANDARQ

Yunita wijaya said...

SUPER BIG PROMO DI SITUS SAHABAT KARTU
=============================================
Hai Teman - Teman Smuanya, Yang Hobi Bermain Judi Online
Anda Merasa Capek, DEPOSIT Teruss..Tapi Tidak Pernah Withdraw ?
=============================================
Nikmati Seluruh Game Berkualitas & Raih Kemenangan Anda Di SAHABAT KARTU!!
Game Yang di Hadirkan SAHABAT KARTU Yaitu :
* Poker Online
* BandarQ
* Domino99
* Bandar Sakong
* Sakong
* BANDAR66
* AduQ
* Sakong
* Perang Baccarat
==========================================
SPECIAL PROMO KHUSUS MEMBER SETIA SAHABAT KARTU
- Minimal DP & WD Cuma Rp. 20.000
- BONUS CASHBACK 0.5% ( Setiap Hari Senin )
- REFERRAL 15% ( Seumur Hidup )
- 100% NON ROBOT & 100% TANPA ADMIN BERMAIN
- 100% GAMPANG MENANG
- JACKPOT HARIAN HINGGA JUTA RUPIAH
- MENERIMA DEPOSIT VIA PULSA XL DAN TSEL TANPA POTONGAN
======================================
AKSES KAMI DI LINK RESMI :
- okekartu.com
- okekartu.org
- okekartu.info
- okekartu.net
=====================
* Livechat : SAHABAT KARTU
* LINE : Cs_sahabatkartu
* Whatsapp : +85581734028

Sahabatkartu: Situs Poker Online, DominoQQ, Domino99, BandarQ Terpercaya

jenni chen said...

Mau Dapatkan Uang Dengan Mudah...
Yuk join bersama Rajabandarq Situs Bandarq, DominoQQ, Poker Online terbaik di asia dengan 9 game yang paling seru...

Buruan Daftar Disini >>> Daftar Rajabandarq
Klik Disini : Situs BandarQ
Klik Disini : Poker Online

Baca juga :

- Blogger : 24berita harian
- Blogger : Kisahselebindo
- Blogger : myrenew22
- Blogger : Panduan Bermain Game Judi Online
- Blogger : Dunia Fauna

stevanie said...

sdomino99.org Merupakan Salah Satu Situs yang terpercaya Di Indonesia
dominowin99 Memiliki Permainan Yang Mudah Dimainkan & 100% Mudah Menang Lohh..
Cukup Dengan 1 USER ID Anda Bisa Bermain 9 GAME Berkualitas :
* Poker
* Domino99
* AduQ
* Capsa Susun
* Sakong
* Bandar Poker
* BANDARQ ONLINE
* BANDAR66 ONLINE
+++++++++++++++++++++++++++++++
AKSES LINK ALTERNATIF TERBARU :
- sdomino99.com
- sdomino99net
- sdomino99.org
- sdomino99.info

< Contact Us >
Info Lebih Lanjut Hubungi :
W.A : +6285974599065


Sahabatdomino : Situs QQ Online, Agen Domino99 dan BandarQ Online Terbesar Di Asia

MEJAQQ said...

MEJAQQ: AGEN JUDI POKER DOMINOQQ BANDARQ ONLINE TERBESAR DI ASIA

Yang Merupakan Agen Judi Poker DominoQQ BandarQ Online Terbesar di Asia Hadir Untuk Anda Semua Dengan Games dan Bonus Yang Menarik!

Bonus yang Kami Berikan di MEJAQQ :
* Bonus Rollingan 0.5% Kali 2
* Bonus Referral 10% + 10% Seumur Hidup (X-tra Untuk Para Pencari Bonus Referral di Indonesia)
* Dan Masih Banyak Bonus Menarik Lainnya yang Bisa Anda Dapatkan di MEJAQQ!
*Dan Kami Juga Menyediakan Deposit Pulsa Tanpa Adanya Potongan Pulsa!
Buruan Kunjungi Sekarang Juga ^^

9 Games Yang di Hadirkan MEJAQQ:
*- POKER
*- DOMINO QQ
*- CAPSA SUSUN
*- BANDAR POKER
*- BANDAR Q
*- BANDAR 66
*- SAKONG
*- ADU Q
*- PERANG BACCARAT

Info Lebih lanjut Kunjungi :
Website : Mejayes(.)org
Line : Mejaqq_official
WA 1 : +85515620767
TELEGRAM : +85515620767

Kunjungi Juga situs kami di :
MEJAQQ
MEJAYES
BANDARQ ONLINE
QQ ONLINE
Informasi Terbaru
SITUS BANDARQ