Linux Kernel Exploitation Notes
Finally, I decided to go deep into kernel exploitation after years of procrastination. I have been competing in CTFs and popping shells on userspace binaries, later exploring larger binaries like V8 and firmwares before stopping right there to upskill myself. Now, it feels too late to learn kernel exploitation with the rise of Autonomous Vulnerability Research. I felt like I was running behind everyone because everyone is busy building agentic workflows for autonomous research while I was still stuck at the fundamentals. Nevertheless, I decided to learn this skill like how it would be a few years before just because I am interested in it.
These notes are basically a dump of everything from my Obsidian vault as I learn the concepts. The note structure will follow a similar pattern throughout. Most of the notes explain concepts via call chains and function calls detailing how things happen inside the Linux kernel, accompanied by source code snippets. Why? Because that is how I figure things out, and I want to maintain the same format for my future self. Some notes below are still blank. Those serve as a todo list to complete in the near future and will be updated soon.
Moreover, these notes contain a significant amount of LLM-generated content because I felt I couldn’t structure my notes properly on my own. It helped to enhance the semantics, improve structure, and, importantly, auto-annotate code snippets from the Linux codebase for easier reference.
If you happen to be exploring this same path, your feedback and corrections are always warmly welcomed. Please feel free to reach out or drop a note on X anytime! Happy Hacking!
├── Internals/ │ ├── Buddy Allocator │ ├── How Google Mitigates Cross-Cache Attacks? │ ├── How Syscalls Work? │ ├── Kernel Module Internals │ └── Linux SLUB Allocator ├── Heap Spraying/ │ ├── msg_msg │ ├── pipe_buffer │ ├── seq_file │ ├── timerfd_ctx │ └── tty_struct ├── KROP/ │ ├── ROP │ └── RopBot / Angrop ├── Page Spraying (Cross-Cache Attacks)/ │ ├── Dirty Creds │ ├── Dirty File │ ├── Dirty Page │ └── PMD Overwrite ├── Targets/ │ ├── Commit Creds │ ├── core_pattern │ └── modprobe_path └── Misc/ └── Misc