Harvest Season for SLUB: From io_uring vulnerability to Novel Sheaf-Based Exploitation Techniques
Researchers show two new Linux io_uring flaws and a sheaf-based local privilege-escalation chain on hardened kernels.
Researchers examine Linux io_uring together with the sheaf/barn caching layer added to the SLUB allocator in Linux 6.18. They disclose two previously unknown io_uring vulnerabilities and turn one into a complete local privilege-escalation chain under a hardened kernel configuration. The work argues that sheaf/barn changes cross-cache assumptions and weakens SLUB freelist protections, then proposes three sheaf-based primitives, including an RCU-sheaf technique that migrates objects across caches without the buddy allocator.
- Two previously unknown io_uring vulnerabilities are presented.
- One flaw is turned into local privilege escalation on a hardened kernel.
- Linux 6.18 sheaf/barn caching weakens long-standing SLUB freelist protections.
- RCU-sheaf cross-cache moves objects without relying on the buddy allocator.
- Products
- Linux kernelio_uringSLUB
From the original article
1 min read at arxiv.orgThe Linux kernel's push for higher I/O performance and more efficient memory management has introduced new mechanisms that, while improving performance, also open new attack surfaces. This research examines two of them together: the io_uring subsystem and the sheaf/barn caching mechanism added to the SLUB allocator in Linux 6. 18.
By Hao-Yu Yang · arxiv.org
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.