Exploit Methods/Function pointer overwrite

Details

When an attacker has a write primitive, they can start function pointers to redirect execution. Function pointers exist in a large number of places in the kernel ranging from function pointer tables (e.g. fops), to vector and descriptor tables.

Examples

• security_operations overwrite
• IDT, timer_list_fops, or security_operations overwrite

Mitigations

• make function pointer tables read-only (e.g. PAX_CONSTIFY_PLUGIN)
• make sensitive targets that need only occasional updates only writable during updates (e.g. PAX_KERNEXEC)