kernel-security-learning - Anything about kernel security. CTF kernel pwn, k

项目说明

Kernel-Security-Learning

Anything about kernel security. CTF kernel pwn & kernel exploit, kernel fuzz and kernel defense paper & kernel debugging technique & kernel C.

Keep updating...

---

1. CTF

1. linux内核漏洞利用初探（1）：环境配置
2. linux内核漏洞利用初探（2）：demo-null_dereference
3. linux内核漏洞利用初探（3）：demo-stack_o
4. 【Linux内核漏洞利用】2018强网杯core_栈溢出
5. 【Linux内核漏洞利用】CISCN2017-babydri漏洞
6. 【Linux内核漏洞利用】0CTF2018-baby-double-fetch
7. 【Linux内核漏洞利用】强网杯2018-solid_core-任意读写
8. 【linux内核漏洞利用】StringIPC—从任意读写到权限提升三种方法
9. 【linux内核漏洞利用】STARCTF 2019 hackme—call_usermodehelper提权路径变量总结
10. 【linux内核漏洞利用】WCTF 2018 klist—竞争UAF-pipe堆喷
11. 【linux内核漏洞利用】TokyoWesternsCTF-2019-gnote Double-Fetch
12. 【linux内核userfaultfd使用】Balsn CTF 2019 - KrazyNote
13. linux内核提权系列教程（1）：堆喷射函数sendmsg与msgsend利用
14. linux内核提权系列教程（2）：任意地址读写到提权的4种方法
15. linux内核提权系列教程（3）：栈变量未初始化漏洞
16. 【linux内核漏洞利用】ret2dir利用方法
17. 【内核漏洞利用】绕过CONFIG_SLAB_FREELIST_HARDENED防护—kernoob两种解法
18. 【Exploit trick】Linux内核中利用msg_msg结构实现任意地址读写
19. 【Exploit trick】针对 cred 结构的 cross cache 利用（corCTF 2022-cache-of-castaways）
20. 【Exploit trick】利用poll_list对象构造kmalloc-32任意释放 (corCTF 2022-CoRJail)

---

2. Paper

#### （1）kernel exploit

1. 2014-USENIX：ret2dir: Rethinking Kernel Isolation
2. 2015-CCS：From collision to exploitation_ Unleashing Use-After-Free in Linux Kernel
3. 2016-CCS：Prefetch Side-Channel Attacks - Bypassing SMAP and Kernel ASLR
4. 2016-CCS：Breaking Kernel Address Space Layout Randomization with Intel TSX
5. 2017-CCS：SemFuzz: Semantics-based Automatic Generation of Proof-of-Concept Exploits
6. 2017-NDSS：Unleashing Use-Before-Initialization in the Linux Kernel Using Targeted Stack Spraying — 【note】
7. 2018-USENIX：FUZE-Towards Facilitating Exploit Generation for Kernel Use-After-Free — 【note】【tool-FUZE】
8. 2019-USENIX：KEPLER-Facilitating Control-flow Hijacking Primiti for Linux Kernel — 【note】【tool-KEPLER】
9. 2019-CCS：SLAKE-Facilitating Slab Manipulation for Exploiting in the Linux Kernel — 【note】【tool-SLAKE】
10. 2020-USENIX：KOOBE: Towards Facilitating Exploit Generation of Kernel Out-Of-Bounds Write — 【note】【note2】【tool-KOOBE】
11. 2020-CCS：A Systematic Study of Elastic Objects in Kernel Exploitation — 【note】【note2】【tool-ELOISE】
12. 2020-WOOT：Exploiting Uses of Uninitialized Stack in Linux Kernels to Leak Kernel Pointers
13. 2021-USENIX：ExpRace: Exploiting Kernel Races through Raising Interrupts — 【note】
14. 2021-CCS：Demons in the Shared Kernel: Abstract Resource Attacks Against OS-le — 【note】
15. 2022-USENIX：SyzScope: Re High-Risk Security Impacts of Fuzzer-Exposed Bugs in Linux kernel — 【toolSyzScope】
16. 2022-USENIX：Playing for K(H)eaps: Understanding and Improving Linux Kernel Exploit Reliability — 【note】
17. 2022-S&P：GREBE: Un Exploitation Potential for Linux Kernel Bugs — 【note】 【note2】 【reproduce】 【tool-GREBE】
18. 2022-NDSS：Kasper: Scanning for Generalized Transient Execution Gadgets in the Linux Kernel — 【note】 【tool-Kasper】
19. 2022-CCS：DirtyCred: Escalating Pri in Linux Kernel — 【note】
20. 2023-USENIX：PSPRAY: Timing Side-Channel based Linux Kernel Heap Exploitation Technique — 【note】 【note2】
21. 2023-USENIX：AlphaEXP: An Expert System for Identifying Security-Sensiti Objects — 【note】
22. 2023-S&P：AEM: Facilitating Cross- Exploitability Assessment of Linux Kernel — 【note】
23. 2023-S&P：When Top-down Meets Bottom-up: Detecting and Exploiting Use-After-Cleanup Bugs in Linux Kernel — 【note】 【note2】
24. 2023-CCS：RetSpill: Igniting User-Controlled Data to Burn Away Linux Kernel Protections — 【note】 【tool-RetSpill】
25. 2024-NDSS: SyzBridge: Bridging the Gap in Exploitability Assessment of Linux Kernel Bugs in the Linux Ecosystem - 【note】 【tool-SyzBridge】
26. 2024-NDSS: K-LEAK: Towards Automating the Generation of Multi-Step Infoleak Exploits against the Linux Kernel - 【note】 【tool-K-LEAK】
27. 2024-USENIX：Take a Step Further: Understanding Page Spray in Linux Kernel Exploitation
28. 2024-USENIX：SLUBStick: Arbitrary Memory Writes through Practical Software Cross-Cache Attacks within the Linux Kernel - 【tool-SLUBStick】
29. 2024-USENIX：SCA Discovery of Memory Corruption Targets in Linux Kernel for Pri Escalation
30. 2024-TIFS：Beyond Control-Exploring Novel File System Objects for Data-Only Attacks on Linux Systems
31. 2024-CCS：On Kernel's Safety in the Spectre Era (And KASLR is Formally Dead)
32. 2025-NDSS：KernelSnitch: Side-Channel Attacks on Kernel Data Structures —— 【tool-KernelSnitch】 【slides】
33. 2025-USENIX：When Good Kernel Defenses Go Bad: Reliable and Stable Kernel Exploits TLB Side-Channel Leaks —— 【tool-TLBSideChannel】
34. 2025-USENIX：System Register Hijacking: Compromising Kernel Integrity By Turning System Registers Against the System
35. 2025-USENIX：The Cost of Performance: Breaking ThreadX with Kernel Object Masquerading Attacks
36. 2025-S&P：BridgeRouter: Automated Capability Upgrading of Out-Of-Bounds Write to Arbitrary Memory Write Primitives in the Linux Kernel
37. 2025-CCS: Re Discarded : Exploiting Pre Unexploitable Linux Kernel Bugs Through Control Metadata Fields
38. 2025-CCS：CROSS-X: Generalized and Stable Cross-Cache Attack on the Linux Kernel
39. 2026-NDSS: DirtyFree: Simplified Data-Oriented Programming in the Linux Kernel
40. 2026-NDSS: Cross-Cache Attacks for the Linux Kernel via PCP Massaging
41. 2026-NDSS: SoK: Take a Deep Step into Linux Kernel Hardening Effecti from the Offensi Perspective
42. 2026-S&P: Heap Localization: Cache Side-Channel based Linux Kernel Heap Exploit Techniques
43. 2026-CCS: Pri and Augmenting the Threat of LLM-Automated Linux Pri Escalation

#### Rootcase Analyze

1. 2026-USENIX: KernelRCA: Facilitating Root Cause Analysis of Memory Corruptions in Linux Kernel with Contextual Causality Chain
2. 2026-USENIX: OS-Sanitizer: System-wide Latent Defect Inference in Linux Applications

#### （2）kernel detection

1. 2012-OSDI：Improving integer security for systems with KINT
2. 2014-Black Hat：QSEE TrustZone Kernel Integer O
3. 2014-USENIX：Static Analysis of in System Software - The 90, 000 #ifdefs Issue
4. 2014-OSDI：SKI：Exposing Kernel Concurrency Bugs through Systematic Schedule Exploration
5. 2015-SOSP：Cross-checking semantic correctness: The case of finding file system bugs — 【tool-JUXTA】
6. 2016-USENIX：UniSan-Proacti Memory Initialization to Eliminate Data Leakages — 【note】【tool-unisan】
7. 2016-USENIX：APISan: Sanitizing API Usages through Semantic Cross-Checking — 【tool-apisan】
8. 2017-EUROSYS：DangSan - Scalable Use-after-free Detection — 【tool-dangsan】
9. 2017-USENIX-ATC：CAB-Fuzz：Practical Concolic Testing Techniques for {COTS} Operating Systems
10. 2017-CCS：DIFUZE-Interface Aware Fuzzing for Kernel Drivers — 【note】【tool-difuze】
11. 2017-USENIX：Digtool- A Framework for Detecting Kernel — 【note】【note2】【note3】【note4】
12. 2017-USENIX：How Double-Fetch Situations turn into DoubleFetch — 【note】【tool】
13. 2017-USENIX：DR. CHECKER- A Soundy Analysis for Linux Kernel Drivers — 【tool-dr_checker】
14. 2017-USENIX：kAFL- Hardware-Assisted Feedback Fuzzing for OS Kernels — 【note】【tool-kAFL】
15. 2018-S&P：DEADLINE-Precise and Scalable Detection of Double-Fetch Bugs in OS Kernels — 【note】【note2】【note3】【tool-DEADLINE】
16. 2018-CCS：Check It Again- Detecting Lacking-Recheck Bugs in OS Kernels — 【note】【note2】【tool-LRSan】
17. 2018-USENIX：MoonShine：Optimizing OS Fuzzer Seed Selection with Trace Distillation — 【note】【note2】【tool-moonshine】
18. 2018-NDSS：K-Miner: Unco Memory Corruption in Linux — 【note】【note2】【tool-K-Miner】
19. 2019-S&P：Razzer：Finding Kernel Race Bugs through Fuzzing — 【note】【note2】【note3】【tool-razzer】
20. 2019-WOOT-Workshop：Unicorefuzz- On the of Emulation for Kernelspace Fuzzing — 【tool-unicorefuzz】
21. 2019-FSE：Detecting Concurrency Memory Corruption — 【tool-CONVUL】
22. 2019-S&P：Fuzzing File Systems Input Space Exploration — 【note】 【note2】【tool-JANUS】
23. 2019-USENIX：Detecting Missing-Check Bugs and Context-Aware Criticalness and Constraints Inferences — 【tool-CRIX】
24. 2019-USENIX-ATC：Effecti Analysis of Concurrency Use-After-Free Bugs in Linux Device Drivers — 【note】
25. 2019-NDSS：PeriScope：An Effecti and Fuzzing Framework for the Hardware-OS Boundary — 【note】【tool-periscope】
26. 2018-USENIX-ATC：DSAC: Effecti Analysis of Sleep-in-Atomic-Context Bugs in Kernel Modules
27. 2020-TOCS：Effecti of Sleep-in-atomic-context Bugs in the Linux Kernel
28. 2020-NDSS：HFL: Hybrid Fuzzing on the Linux Kernel — 【note】【note2】【note3】
29. 2020-S&P：Krace: Data Race Fuzzing for Kernel File Systems — 【note】
30. 2020-USENIX：Agamotto: Accelerating Kernel Dri with Lightweight Machine Checkpoints — presentation
31. 2020-USENIX：Muzz: Thread-aware Grey-box Fuzzing for Effective Bug Hunting in Multithreaded Programs — 【note】
32. 2020-CCS：Exaggerated Error Handling Hurts! An In-Depth Study and Context-Aware Detection —【note】
33. 2020-FSE：UBITect: A Precise and Scalable Method to Detect Use-Before-Initialization Bugs in Linux Kernel — 【note】
34. 2020-LPC：KCSAN-Data-race detection in the Linux kernel
35. 2021-NDSS：Detecting Kernel Memory Leaks in Specialized Modules With Ownership Reasoning — 【note】
36. 2021-NDSS：KUBO: Precise and Scalable Detection of User-triggerable Undefined Behavior Bugs in OS Kernel — 【note】
37. 2021-USENIX：Detecting Kernel Refcount Bugs with Two-Dimensional Consistency Checking — 【note】
38. 2021-USENIX：Understanding and Detecting Disordered Error Handling with Precise Function Pairing — 【note】
39. 2021-USENIX：An Analysis of Speculative Type Confusion in the Wild
40. 2021-USENIX：Static Detection of Unsafe DMA Accesses in Device Drivers — 【note】
41. 2021-CCS：Statically Disco High-Order Taint Style in OS Kernels — 【note】 【note2】
42. 2021-CCS：Detecting Missed Security Operations Through Differential Checking of Object-based Similar Paths — 【note】
43. 2021-SOSP：HEALER: Relation Learning Guided Kernel Fuzzing — 【tool-healer】 【note】 【note2】 【note3】
44. 2021-S&P：A No Analysis Infrastructure to Instrument Untrusted Execution Flow Across User-Kernel Spaces
45. 2022-NDSS：An In-depth Analysis of Duplicated Linux Kernel Bug Reports — 【note】
46. 2022-NDSS：Progressi Detection of UBI bugs in the Linux Kernel — 【note】
47. 2022-NDSS：Semantic-Informed Dri Without Both the Hardware Devices and the Emulators — 【note】 【note2】
48. 2022-USENIX：LinKRID: Imbalance Reference Counting in Linux kernel with Symbolic Execution — 【note】 【note2】
49. 2022-USENIX：OS-Aware Prioritization Se Analysis
50. 2023-NDSS：No Grammar, No Problem: Towards Fuzzing the Linux Kernel without System-Call Descriptions
51. 2023-USENIX：FirmSolo: Enabling dynamic analysis of binary Linux-based IoT kernel modules — 【note】
52. 2023-USENIX：Mitigating Security Risks in Linux with KLAUS: A Method for E Patch Correctness
53. 2023-USENIX：BoKASAN: Binary-only Kernel Address Sanitizer for Effecti Fuzzing
54. 2023-USENIX：ACTOR: Action-Guided Kernel Fuzzing
55. 2023-USENIX：Uncontained: Unco Container Confusion in the Linux Kernel
56. 2023-USENIX：DDRace: Finding Concurrency UAF in Linux Drivers with Directed Fuzzing
57. 2023-S&P：SyzDescribe: Principled, Automated, Static Generation of Syscall Descriptions for Kernel Drivers — 【tool-SyzDescribe】
58. 2023-S&P：Precise Detection of Kernel Data Races with Probabilistic Lockset Analysis
59. 2023-S&P：SEGFUZZ: Segmentizing Thread Interleaving to Disco Concurrency Bugs through Fuzzing — 【tool-segfuzz】
60. 2023-CCS：SyzDirect: Directed Greybox Fuzzing for Linux Kernel — 【tool-Syzdirect】
61. 2024-NDSS: MOCK: Optimizing Kernel Fuzzing Mutation with Context-aware Dependency - 【tool-mock】
62. 2024-S&P: To Boldly Go Where No Fuzzer Has Gone Before: Finding Bugs in Linux' Wireless Stacks through Devices - 【tool-】
63. 2024-S&P: SyzGen++: Dependency Inference for Augmenting Kernel Dri 【tool-SyzGen++】
64. 2024-USENIX：CARDSHARK Understanding and Stablizing Linux Kernel Concurrency Bugs Against the Odds
65. 2024-USENIX：Detecting Kernel Memory Bugs through Inconsistent Memory Management Intention Inferences
66. 2024-USENIX：StateFuzz: System Call-Based State-Aware Linux Dri
67. 2024-SOSP：OZZ: Identifying Kernel Out-of-Order Concurrency Bugs with In-Vi Access Reordering - 【tool-ozz】
68. 2024-CCS：CountDown: Refcount-guided Fuzzing for Exposing Temporal Memory Errors in Linux Kernel —— slides 【tool-countdown】
69. 2024-CCS：Le Binary Co for Effecti Guidance in Kernel Fuzzing
70. 2024-CCS：Toss a Fault to BpfChecker: Re Implementation Flaws for eBPF runtimes with Differential Fuzzing —— 【tool-BpfCheckerSource】
71. 2025-NDSS：Statically Disco Use-After-Free in the Linux Kernel
72. 2025-NDSS：A Comprehensi Safety Analysis of Bootloaders
73. 2025-USENIX：Finding Metadata Inconsistencies in Distributed File Systems Operation Modeling
74. 2025-CCS：SyzSpec: Specification Generation for Linux Kernel Fuzzing Symbolic Execution
75. 2025-CCS：SyzParam: Incorporating Runtime Parameters into Kernel Dri
76. 2026-NDSS: Accurate Identification of the g Commit based on Differential Analysis of Patching Patterns
77. 2026-S&P: StepStone: LLM-Based GPU Kernel Dri Libraries
78. 2026-S&P: NetPanic: The Attack Surface You Can't Syscall
79. 2026-USENIX: Static Detection of TOCTOU Bugs Caused by Kernel Races

#### （3）kernel defense

1. 2011-NDSS：Practical Protection of Kernel Integrity for Commodity OS from Untrusted Extensions
2. 2011-NDSS：SigGraph - Brute Force Scanning of Kernel Data Structure Instances Using Graph-based Signatures
3. 2011-NDSS：Efficient Monitoring of Untrusted Kernel-Mode Execution
4. 2012-NDSS：Kruiser - Semi-synchronized Non-blocking Concurrent Kernel Heap Buffer O Monitoring
5. 2012-OSDI：Improving Integer Security for Systems with KINT
6. 2012-S&P：Smashing the Gadgets - Hindering Return-Oriented Programming Using In-place Code Randomization
7. 2012-USS：Enhanced Operating System Security Through Efficient and Fine-grained Address Space Randomization
8. 2013-EUROSYS：Process firewalls - protecting processes during resource access
9. 2013-NDSS：Attack Surface Metrics and Automated Compile-Time OS Kernel Tailoring
10. 2013-S&P：Just-In-Time Code Reuse - On the Effecti of Fine-Grained Address Space Layout Randomization
11. 2014-CCS：A Tale of Two Kernels - Towards Ending Kernel Hardening Wars with Split Kernel
12. 2014-NDSS：ROPecker - A Generic and Practical Approach For Defending Against ROP Attacks
13. 2014-OSDI：Jitk - A Trustworthy In-Kernel Interpreter Infrastructure
14. 2014-S&P：KCoFI - Complete Control-Flow Integrity for Commodity Operating System Kernels
15. 2014-S&P：Dancing with Giants - Wimpy Kernels for On-Demand Isolated I/O
16. 2015-NDSS：Pre Use-after-free with Dangling Pointers Nullification
17. 2016-NDSS：Enforcing Kernel Security In with Data Flow Integrity
18. 2016-OSDI：Light-Weight Contexts - An OS Abstraction for Safety and Performance
19. 2016-OSDI：EbbRT - A Framework for Building Per-Application Library Operating Systems
20. 2017-EUROSYS：A Characterization of State Spill in Modern Operating Systems
21. 2017-EUROSYS：kRˆX: Comprehensi Protection Against Just-In-Time Code Reuse 【slides】
22. 2017-NDSS：PT-Rand - Practical Mitigation of Data-only Attacks against Page Tables
23. 2017-S&P：NORAX - Enabling Execute-Only Memory for COTS Binaries on AArch64
24. 2017-CCS：FreeGuard - A Faster Secure Heap Allocator
25. 2017-USENIX：Lock-in-Pop - Securing Pri Operating System Kernels by Keeping on the Beaten Path
26. 2017-USENIX：Can’t Touch This: Software-only Mitigation against Rowhammer Attacks targeting Kernel Memory
27. 2017-USENIX：Oscar: A Practical Page-Permissions-Based Scheme for Thwarting Dangling Pointers
28. 2019-S&P：LBM - A Security Framework for Peripherals within the Linux Kernel
29. 2019-S&P：SoK - Shining Light on Shadow Stacks
30. 2019-S&P：SoK - Sanitizing for Security
31. 2019-USENIX：PeX: A Permission Check Analysis Framework for Linux Kernel
32. 2019-USENIX：ERIM: Secure, Efficient In-process Isolation with Protection Keys (MPK)
33. 2019-USENIX：LXDs - Towards Isolation of Kernel Subsystems
34. 2019-USENIX：SafeHidden: An Efficient and Secure Information Hiding Technique Using Re-randomization
35. 2020-S&P：xMP: Selecti Protection for Kernel and User Space
36. 2020-S&P：SEIMI: Efficient and Secure SMAP-Enabled Intra-process Memory Isolation — 【note】
37. 2021-USENIX：Undo Workarounds for Kernel Bugs
38. 2021-USENIX：SHARD: Fine-Grained Kernel Specialization with Context-Aware Hardening
39. 2021-USENIX：Pre Use-After-Free Attacks with Fast Forward Allocation
40. 2022-NDSS：Pre Kernel Hacks with HAKCs
41. 2022-USENIX：Midas: Systematic Kernel TOCTTOU Protection
42. 2023-S&P：EC: Embedded Systems Compartmentalization Isolation
43. 2023-S&P：uSwitch: Fast Kernel Context Isolation with Implicit Context Switches
44. 2023-USENIX：PET: Prevent Discovered Errors from Being Triggered in the Linux Kernel
45. 2023-USENIX：A Hybrid Alias Analysis and Its Application to Global Protection in the Linux Kernel
46. 2023-USENIX：Moat: Towards Safe BPF Kernel Extension
47. 2024-USENIX：SeaK: Rethinking the Design of a Secure Allocator for OS Kernel
48. 2024-CCS：Safeslab: Mitigating Use-After-Free Protection Keys —— 【tool-safeslab】
49. 2024-CCS：The Illusion of Randomness: An Empirical Analysis of Address Space Layout Randomization Implementations
50. 2024-CCS：PeTAL: Ensuring Access Control Integrity against Data-only Attacks on Linux —— 【tool-petal】
51. 2024-CCS：Beyond the edges of kernel control-flow hijacking protection with hek-cfi —— 【slides】
52. 2025-USENIX：Approximation Enforced Execution of Untrusted Linux Kernel Extensions
53. 2025-USENIX：EKC: A Portable and Extensible Kernel Compartment for De-Pri Commodity OS
54. 2025-NDSS：BULKHEAD: Secure, Scalable, and Efficient Kernel Compartmentalization with PKS
55. 2025-NDSS：: Protecting Code Before Deploying Patches
56. 2025-S&P：IUBIK: Isolating User Bytes in Commodity Operating System Kernels Tagging Extensions
57. 2025-CCS：Tide: An Efficient Kernel-le Execution En on AArch64 Adjusting Output Address Size
58. 2026-S&P: PORTGPT: Towards Automated Backporting Using Large Language Models
59. 2026-USENIX: kSFS: Repurposing a Microkernel-like Interface for Fast and Secure In-Kernel Linux File Systems
60. 2026-USENIX: DMGuard: Safeguarding Kernels from Physical-Page Use-After-Free

other resources：

1. security things in every of Linux mainline
2. PaX code analysis
3. A Decade of Linux Kernel , their Mitigation and Open Problems-2017
4. 10_years_of_linux_security_by_grsecurity_2020—— security mechanism timeline
5. linux-kernel-defence-map
6. linux_mitigations
7. The State of Kernel Self Protection-2018

#### （4） Android

1. 2020-USEINX：Automatic Hot Patch Generation for Android Kernels—自动给安卓打补丁 【note】
2. 2025-USENIX：The Doom of Device Drivers: Your Android Device (Most Likely) has N-Day Kernel

---

3. CVE

1. Linux kernel 4.20 BPF 整数溢出漏洞分析
2. 【kernel exploit】C 错误处理负值导致访问用户空间
3. 【kernel exploit】C null任意地址写漏洞
4. 【C】Linux xfrm模块越界读写提权漏洞分析
5. 【kernel exploit】C DCCP拥塞控制协议Double-Free提权分析
6. 【kernel exploit】C AF_PACKET 环形缓冲区溢出漏洞
7. 【kernel exploit】C Phoenix Talon漏洞分析与利用
8. 【kernel exploit】C 竞态Double-Free漏洞调试
9. 【C】Linux ebpf模块整数扩展问题导致提权漏洞分析
10. 【kernel exploit】C UDP报文处理不一致导致堆溢出
11. 【kernel exploit】C 空指针引用漏洞
12. 【kernel exploit】C sctp_sendmsg()空指针引用漏洞
13. 【kernel exploit】C 逻辑漏洞绕过 mmap_min_addr 限制
14. 【kernel exploit】C xfrm UAF 8字节写NULL提权分析
15. 【kernel exploit】C：eBPF 错误处理导致越界读写
16. 【kernel exploit】BPF漏洞挖掘与C 整数溢出漏洞
17. 【kernel exploit】C sudo漏洞分析与利用
18. 【kernel exploit】C 四字节写特殊竞争UAF转化为内核任意读写
19. 【kernel exploit】C eBPF边界计算错误漏洞
20. 【kernel exploit】C eBPF 32位边界计算错误漏洞
21. 【kernel exploit】C 2字节堆溢出写0漏洞提权分析
22. 【kernel exploit】C 内核类型混淆漏洞利用分析
23. 【kernel exploit】C 错误释放任意file对象-DirtyCred利用
24. 【kernel exploit】C 6pack协议解码溢出漏洞利用
25. 【kernel exploit】C TIPC协议MSG_CRYPTO消息溢出利用
26. 【kernel exploit】C Dirty Pipe 漏洞分析与利用
27. 【kernel exploit】C File System Context 整数溢出漏洞利用
28. 【kernel exploit】C 堆溢出1比特置1漏洞利用
29. 【kernel exploit】C nftables 栈溢出漏洞分析与利用
30. 【kernel exploit】C Double-free 漏洞 DirtyCred 利用
31. 【kernel exploit】C UNIX_GC错误释放io_uring注册的file结构-UAF
32. 【kernel exploit】C open模块kmalloc-0x10000堆溢出利用（pipe_buffer任意文件写技术）
33. 【kernel exploit】C nftables OOB写堆指针漏洞利用
34. 从 PWN2OWN C 看内核页风水
35. 【kernel exploit】C nftables错误链表操作导致UAF写的漏洞利用
36. 【kernel exploit】C nftable堆溢出漏洞利用（list_head任意写）
37. 【kernel exploit】C io_uring物理内存越界读写（伪造sock对象）
38. 【kernel exploit】C nftables UAF漏洞-Dirty Pagedirectory利用方法
39. 【kernel exploit】C-UAF漏洞分析
40. 【kernel exploit】C perf_event竞态UAF漏洞-ROP提权

---

4. Exploitation Techniques

---

5. Tool

---

6. Debug & other techniques

1. linux双机调试
2. linux内核漏洞利用初探（1）：环境配置
3. 【linux内核调试】SystemTap使用技巧
4. 【linux内核调试】使用Ftrace来Hook linux内核函数
5. 【linux内核调试】ftrace/kprobes/SystemTap内核调试方法对比
6. 【KVM】KVM学习—实现自己的内核

---

Reference:

linux-security-papers

linux-kernel-exploitation

GoSSIP_Software Security Group

项目信息

开发语言：C

Star 数：776

技术要点

该项目属于CTF思路方向的开源资源，代码结构清晰，适合安全研究人员学习参考。项目围绕Anything about kernel security. CTF kernel pwn, kernel exploit, kernel fuzz and kernel defense paper, kernel debugging technique, kernel CVE debug.展开，提供了可运行的实现，对理解相关安全机制、工具原理与攻防技术具有较高的研究价值。

从技术实现角度看，此类项目的核心在于对底层原理的深入理解与工程化落地。开发者在研究过程中可以结合官方文档与社区讨论，梳理项目的初始化流程、核心模块职责与数据流转，逐步掌握其中的技术细节与设计思路。

使用与学习建议

1. 下载源码压缩包，解压到本地环境。

2. 根据项目类型准备对应的运行环境与依赖。

3. 按照 README 中的步骤完成配置与部署。

4. 在隔离的测试环境中运行验证，避免影响生产系统。

免责声明

本资源来源于开源社区，仅供安全研究、技术学习与合法授权范围内的攻防演练使用，请勿用于任何非法或侵害他人权益的用途。使用本项目产生的一切后果由使用者自行承担。