Advanced Linux Kernel Exploitation Techniques

Thu, 27 Mar 2025 00:00:00 +0000

Introduction to Linux Kernel Exploitation

Kernel exploitation sits at the top of the difficulty curve in offensive security, and for good reason. Userspace bugs get you code execution as some unprivileged process, but the kernel runs at Ring 0 (or EL1, if you’re on ARM) with unrestricted access to physical memory, every process’s address space, and every privilege check on the system. Pop a bug in the kernel and you’re not just compromising an application, you’re compromising the thing that enforces the rules for every application on the box. That’s why a single kernel LPE (local privilege escalation) bug is often worth more on the exploit market than a browser RCE: it’s the last mile between “I have a foothold” and “I own the machine.”

Linux Syscalls Table (x86-64)

Fri, 13 Sep 2024 00:00:00 +0000

Overview

Every time a program on Linux does something that touches the outside world, reading a file, allocating memory, sending a packet, spawning another process, it eventually has to ask the kernel to do it. User space code can’t just reach into the kernel’s data structures and start editing process tables or filesystem metadata; that would be a security and stability nightmare. Instead, it has to go through a narrow, well-defined door: the system call interface. This post is a reference table for that door on x86-64 Linux, listing every syscall number, its libc-facing name, its man page, and the kernel function that actually handles it once your program’s request lands.

Linux on Prepakis Georgios | Kernelstub | Security Researcher

Advanced Linux Kernel Exploitation Techniques

Introduction to Linux Kernel Exploitation

Linux Syscalls Table (x86-64)

Overview