bk99.de entertain the web since 1997

bk99.de
HN · Kernel securityCurated

Cache invalidation in Linux memory management

Summary

Jann Horn analyses CVE-2018-17182, in which stale VMA cache entries created an exploitable kernel state after memory changes. The bug was assigned CVE-2018-17182. Kernels from version 3.16 onwards were affected.

Ideas

  • Page faults look up the responsible virtual memory region.
  • A per-thread cache speeds up repeated VMA lookups.
  • mremap did not fully invalidate the cache states involved.
  • Stale pointers enabled a use-after-free attack in the kernel.

Insights

  • Cache correctness is part of the security boundary and not just a performance detail.
  • Optimisations multiply the states that every change has to keep consistent.
  • Kernel configuration can greatly change the practical exploitability of the same bug.

Facts

  • Several stable kernel series received fixes in September 2018.

Recommendations

  • Install kernel security updates promptly and reboot afterwards.
  • Specifically check optimisation paths for complete invalidation.

References

Read the original article

Search the Web Archive

HN · 2023

Safer C arrays in the Linux kernel

Kees Cook describes converting fake flexible C arrays into unambiguous structures with checkable bounds. Real flexible array members use empty brackets at the end of the structure. GCC and Clang support -fstrict-flex-arrays.

HN · 2026

Dirty Frag: a note on a Linux privilege escalation

The oss-security post describes a chained local Linux privilege escalation and its problematic disclosure before a coordinated fix. The publication contains working demonstration code for x86-64 systems. Chaining vulnerabilities makes individually limited bugs system-critical together.

HN · 2025

Oniux: Tor isolation with Linux namespaces

The Tor Project presents oniux, which starts any Linux program in isolated Tor network namespaces. oniux is Linux-specific and written in Rust. The tool combines Linux namespaces, Arti and onionmasq.