DirtyFree: Simplified Data-Oriented Programming in the Linux Kernel

—With the advent of Kernel Control-Flow Integrity (KCFI), Data-Oriented Programming (DOP) has emerged as an essential alternative to traditional control-flow hijacking techniques such as Return-Oriented Programming (ROP). Unlike control-flow attacks, DOP manipulates kernel data-flow to achieve privilege escalation without violating control-flow integrity. However, traditional DOP attacks remain complex and exhibit limited practicality due to their multistage nature, typically requiring heap address leakage, arbitrary address read, and arbitrary address write capabilities. Each stage imposes strict constraints on the selection and usage of kernel objects. To address these limitations, we introduce D IRTY F REE , a systematic exploitation method that leverages the arbitrary free primitive. This primitive enables the forced deallocation of attacker-controlled kernel objects, significantly reducing ex-ploitability requirements and simplifying the overall exploitation process. D IRTY F REE provides a systematic method for identifying suitable arbitrary free objects across diverse kernel caches and presents a structured exploitation strategy targeting security-critical objects such as cred . Through extensive evaluation, we successfully identified 14 arbitrary free objects covering most kernel caches, demonstrating D IRTY F REE ’s practical effectiveness by successfully exploiting 24 real-world kernel vulnerabilities. Additionally, we propose and implement two mitigation techniques designed to mitigate D IRTY F REE , effectively preventing exploitation while incurring negligible performance overhead (i.e., 0.28% and -0.55%, respectively).