Exploiting null-dereferences in the Linux kernel

Part 3 of the MTE As Implemented series, examining kernel-side support for Arm Memory Tagging Extension, its performance costs, and gaps observed in real implementations.

This is a technical blog post about TLB flushing bugs in kernels, intended for people interested in kernel security and memory management.

A report on an arbitrary recursion bug in the Linux kernel, triggerable by a local user on Ubuntu systems installed with home directory encryption support, with exploit code published.

A guest post describing CVE-2017-7308, a signedness bug in Linux packet sockets leading to a heap out-of-bounds write and local privilege escalation, found via syzkaller.

A Windows exploitation technique post showing how path lookup behavior can be leveraged to reliably win race conditions, with worked examples and exploitation implications.

Research describing a quiet technique for defeating KASLR that avoids noisy crashes or corruption, discussing how the leakage works and what mitigations could help.