SCAVY: Automated Discovery of Memory Corruption Targets in Linux Kernel for Privilege Escalation

Kernel privilege-escalation exploits typically leverage memory-corruption vulnerabilities to overwrite particular memory locations. These memory corruption targets play a critical role in the exploits, as they determine which privileged resources (e.g. files, memory, and operations) the adversary may access and what privileges (e.g. read, write, and unrestricted) they may gain. While prior research has made important advances in discovering vulnerabilities, and in automating their exploitation, it relies on the few memory corruption targets that have been discovered manually so far. We propose SCAVY, a framework that automatically discovers memory corruption targets for privilege escalation in the Linux kernel. The key insight behind SCAVY is to extend the search beyond the kernel data structures that include function pointers, or pointers to such structures, and that were studied in prior work while accounting for approximately one tenth of the kernel structures. Additionally, the search is bug-type agnostic, as it considers any memory corruption capability. To this end, we develop novel and scalable techniques that combine fuzzing and differential analysis to automatically explore and detect privilege escalation by comparing the accessibility of resources between executions with and without corruption. This allows SCAVY to determine that corrupting a certain field puts the system in an exploitable state, independently of the vulnerability exploited. SCAVY found 955 PoC, from which we identify 17 fields belonging to 12 structures -when corrupted they have shown to reach a privilege escalation state. We further develop 6 exploits for 5 vulnerabilities. Our findings show that memory corruption targets can change the security implications of vulnerabilities, urging researchers to proactively discover memory corruption targets.