• Overview

• How Syscalls Work?
• Kernel Module Internals
• Namespaces-Cggroups-Capabilities
• Virtual File System
• MM
  • Buddy Allocator
  • How Google Mitigates Cross-Cache Attacks?
  • How page fault is handled ?
  • Linux SLUB Allocator
  • Page Cache
  • What if a process could "mov cr3, 0xdeadface" ?

• FUSE - Filesystem in Userspace
• Hole Punching - dev-shm
• Userfaultfd
• timerfd-epoll

• msg_msg
• pipe_buffer
• seq_file
• setxattr
• sockets
• timerfd_ctx
• tty_struct

• Dirty Creds
• Dirty File
• Dirty Page
• PCPLost - PCP Massaging
• PMD Overwrite

• Aarch ROP
• RetSpill
• RopBot / Angrop
• x86 ROP

• Commit Creds
• core_pattern
• modprobe_path

• Misc