RC RANDOM CHAOS

kernel-exploitation

3 posts

The kernel is still C
Article

The kernel is still C

An OpenBSD kernel use-after-free (CWE-416, CVSS 7.8) escalates a local user to root via pool reclaim and cr_uid overwrite. Mechanism, exploit path, and the BSD telemetry gap.

 Every kernel launch is an ioctl into ring 0
Article

Every kernel launch is an ioctl into ring 0

Launching a CUDA kernel crosses into ring 0 via the NVIDIA kernel-mode driver - the real attack surface behind GPU compute, its CVE class, and detection gaps.

 Sandi Metz's 2016 essay is a bug-class taxonomy
Article

Sandi Metz's 2016 essay is a bug-class taxonomy

The 2016 'wrong abstraction' rule read as a memory-corruption bug class: use-after-free, type confusion, double-free, from DirtyCOW to Dirty Pipe and DirtyCred.