@andreyknvl.bsky.social
Security engineer at http://xairy.io. Focusing on the Linux kernel. Maintaining @linkersec.bsky.social. Trainings at http://xairy.io/trainings.
This is still not fixed btw.
08.11.2025 11:48 — 👍 0 🔁 0 💬 0 📌 0
kernelCTF: CVE-2025-38477
kernelCTF entry for a race condition in the network scheduler subsystem.
Most notably, shows a technique of putting controlled data into unmapped sections of vmlinux.
github.com/n132/securit...
Defeating KASLR by Doing Nothing at All
Article by Seth Jenkins about a few problems with physical memory KASLR on arm64 devices.
googleprojectzero.blogspot.com/2025/11/defe...
Updates for the Linux kernel exploitation collection 😋
github.com/xairy/linux-...
Oops! It's a kernel stack use-after-free: Exploiting NVIDIA's GPU Linux drivers
Article by Robin Bastide about exploiting a NULL-pointer-dereference that led to a UAF access to the kernel stack in the NVIDIA GPU driver.
blog.quarkslab.com/nvidia_gpu_k...
Merge commit: git.kernel.org/pub/scm/linu...
RFC to replace per-CPU partials: lore.kernel.org/linux-mm/202...
LWN article: lwn.net/Articles/101...
Sheaves support has been merged into SLUB.
Opt-in for now, but planned to replace the per-CPU partial slab layer for all caches in the future.
Gonna have to revise the slab shaping strategies once this happens.
Delivered a workshop at BalcCon this weekend on emulating/sniffing/MitM'ing USB devices with Raw Gadget and a Raspberry Pi.
All materials are public, so can go through the workshop on your own if you're interested.
github.com/xairy/raw-ga...
Updated syzkaller documentation on USB fuzzing to explain how to handle certain tricky cases (e.g. driver quirks applied based on Vendor/Product IDs).
github.com/google/syzka...
I also suspect that the CVE-2025-38494/5 fix is what actually fixes CVE-2024-50302.
Assuming the used chain was portable enough to also cover devices with CONFIG_INIT_ON_ALLOC_DEFAULT_ON=y, replacing kmalloc with kzalloc possibly did nothing.
bsky.app/profile/andr...
"Wrote" is a strong word for this, I just cleaned up the reproducer from this syzbot report:
syzkaller.appspot.com/bug?extid=fb...
The report has been public on the dashboard for over 2 months now. And there's plenty of other USB bugs that are still not fixed.
Wrote a trigger for CVE-2025-38494/5 (an integer underflow in the HID subsystem) that leaks 64 KB of OOB memory over USB.
Still works on Pixels and Ubuntus (but the bug is fixed in stable kernels).
github.com/xairy/kernel...
Updated the collection of USB hacking links.
github.com/xairy/usb-ha...
Whoever is coming to BalCCon: I will be teaching a workshop Attacking USB with Raw Gadget (covering basics of USB emulation and sniffing).
If you wish to attend, you must bring Raspberry Pi 5 along with a few other things, see the workshop description.
github.com/xairy/raw-ga...
Updates for the Linux kernel exploitation collection 😋
github.com/xairy/linux-...
Linux Kernel netfilter: ipset: Missing Range Check LPE
ssd-disclosure.com/linux-kernel...
Announcing #Pwn2Own Ireland for 2025! We return to the Emerald Isle with our new partner #Meta & a $1,000,000 WhatsApp bounty. Plus new USB vectors on phones & more. Read the details https://www.zerodayinitiative.com/blog/2025/7/30/pwn2own-returns-to-ireland-with-a-one-million-dollar-whatsapp-target
31.07.2025 19:10 — 👍 5 🔁 4 💬 1 📌 0
Documented instructions for setting up KGDB on Pixel 8.
Including getting kernel log over UART via USB-Cereal, building/flashing custom kernel, breaking into KGDB via /proc/sysrq-trigger or by sending SysRq-G over serial, dealing with watchdogs, etc.
xairy.io/articles/pix...
Linux Kernel Hardening: Ten Years Deep
Talk by Kees Cook about the relevance of various Linux kernel vulnerability classes and the mitigations that address them.
Video: www.youtube.com/watch?v=c_Nx...
Slides: static.sched.com/hosted_files...
Bypass Kernel Barriers: Fuzzing Linux Kernel in Userspace With LKL
Xuan Xing & Eugene Rodionov gave a talk about fuzzing the Linux kernel interfaces fully in user space using LKL (Linux Kernel Library).
Video: www.youtube.com/watch?v=Wxmi...
Slides: static.sched.com/hosted_files...
Exploiting the Linux Kernel on October 26 — November 1 online via Ringzer0.
ringzer0.training/countermeaas...
Exploiting the Linux Kernel on October 6–9 in Paris at Hexacon @hexacon.bsky.social.
www.hexacon.fr/trainer/kono...
Exploiting the Linux Kernel on September 1–3 in Berlin at Nullcon.
nullcon.net/berlin-2025/...
Fuzzing the Linux Kernel on August 4–5 online via Black Hat US.
www.blackhat.com/us-25/traini...
Schedule for my Fuzzing/Exploiting the Linux Kernel trainings for the rest of the year ⬇️
01.07.2025 22:01 — 👍 1 🔁 0 💬 1 📌 0
Updates for the Linux kernel exploitation collection 😋
github.com/xairy/linux-...
RVAsec 2025: Kevin Massey - Linux Kernel Exploitation for Beginners
youtu.be/YfjHCt4SzQc
Linux Kernel Exploitation For
Beginners
rvasec.com/slides/2025/...
KernelGP: Racing Against the Android Kernel
Talk by Chariton Karamitas about ways to use FUSE for kernel exploitation from unprivileged SELinux contexts on Android.
www.youtube.com/watch?v=DJBG...
Linux Kernel Exploitation series
Awesome series of articles by r1ru that outlines many commonly-used modern exploitation techniques.
r1ru.github.io/categories/l...
with offensivecon around the corner, i figured id write another post on linux kernel exploitation techniques - this time i cover the world of page table exploitation! enjoy 🤓
sam4k.com/page-table-k...
