Exploiting Recursion in the Linux Kernel

A guest post describing CVE-2017-7308, a signedness bug in Linux packet sockets leading to a heap out-of-bounds write and local privilege escalation, found via syzkaller.

Ubuntu Server silently puts the first user in the lxd group, root-equivalent by design. The seeded lxd-installer socket lets lxd users install LXD password-free and reach host root; vendor won't fix.

Part 3 of the MTE As Implemented series, examining kernel-side support for Arm Memory Tagging Extension, its performance costs, and gaps observed in real implementations.

An examination of how null pointer dereferences in the Linux kernel can be turned into exploitable primitives under modern configurations, with examples and mitigations.

This is a technical blog post about TLB flushing bugs in kernels, intended for people interested in kernel security and memory management.

A Project Zero deep dive into a design flaw around task_t in the XNU kernel, demonstrating sandbox escapes and privilege escalation and how each mitigation was defeated.