Linux io_uring and SLUB sheaf reveal new kernel attack methods

Harvest Season for SLUB: From io_uring vulnerability to Novel Sheaf-Based Exploitation Techniques

Cryptography and Security

Summary

Certain new features added to the Linux operating system to speed up file handling and memory management have unintended security weaknesses. The authors found two unknown flaws in a system called io_uring and showed how one could let a regular user gain full control on the computer even when protections are in place. They also studied a recent memory management addition called sheaf/barn in detail, discovering it breaks assumptions that many known attack techniques rely on. Using this insight, the authors created three new, more flexible ways to exploit these memory features, identifying a new area that attackers might target in the Linux kernel.

What this means in practice

  • For linux kernel developers: Patch and harden io_uring and SLUB sheaf mechanisms using the identified vulnerabilities and new exploitation techniques to improve kernel security.
  • For security operations teams: Monitor for attack methods based on the novel sheaf-based techniques to better detect local privilege escalation attempts on hardened Linux systems.

Authors

Hao-Yu Yang, Yu-Ting Lin

Abstract

The Linux kernel's push for higher I/O performance and more efficient memory management has introduced new mechanisms that, while improving performance, also open new attack surfaces. This research examines two of them together: the io_uring subsystem and the sheaf/barn caching mechanism added to the SLUB allocator in Linux 6.18. In this research, two previously unknown vulnerabilities in io_uring are presented, and one is developed into a complete local privilege escalation chain under a hardened kernel configuration. Building this chain revealed that the sheaf/barn mechanism changes long-standing assumptions behind established exploitation techniques such as cross-cache attack, and that its design also weakens existing SLUB freelist protections. Both observations are analyzed and turned into working primitives. Building on this analysis, three novel sheaf-based exploitation techniques are proposed. Among them, an RCU-sheaf cross-cache technique removes the traditional dependence on the buddy system for moving objects across caches, giving more flexible and reliable control over object migration between cache pools. Together, these results characterize the sheaf/barn layer as a new and largely unexplored attack surface in Linux kernel exploitation.
View PDFOpen arXiv