Skip to main content

39. Introduction to Linux Kernel Exploitation: The World of LPE

Kernel exploitation is called the pinnacle of hacking. LPE (Local Privilege Escalation), which obtains root from ordinary user privileges, appears regularly in the pwn category of CTFs and is also a key stage in real APT attacks.

Why the Kernel?​

Even after successfully executing code through a userspace vulnerability, the privileges ultimately cannot exceed that process's uid. But executing code at the kernel level changes the story—you can replace the credentials wholesale with commit_creds(prepare_kernel_cred(NULL)) and become root.

Major Attack Surfaces​

Driver vulnerabilities are the most common. Custom device drivers under /dev/ vary widely in code quality, so heap overflows, UAFs, and race conditions occur frequently.

Syscall interfaces — Improper user-input validation in ioctl, mmap, and read/write handlers becomes the trigger.

Core Technique: ret2usr​

This was the simplest method in the past.

  1. Prepare shellcode in userspace (commit_creds(prepare_kernel_cred(0)) + iretq)
  2. Overwrite the kernel EIP/RIP with the shellcode address
  3. The kernel jumps to the userspace address → obtain root

This is now blocked by SMEP (Supervisor Mode Execution Prevention), but CTFs often provide environments with SMEP disabled.

Bypassing SMEP: ROP in Kernel Space​

When SMEP is enabled, the kernel cannot execute user pages. In that case, use ROP gadgets inside the kernel.

Kernel text-region gadget chain
→ prepare_kernel_cred(0)
→ commit_creds()
→ swapgs; iretq
→ return to userspace

Read symbol addresses from /proc/kallsyms (requires root); CTFs usually provide /tmp/kallsyms or an environment configuration instead.

Setting Up a Practice Environment​

# Configure a kernel debugging environment with QEMU
qemu-system-x86_64 \
  -kernel bzImage \
  -initrd rootfs.cpio.gz \
  -append "console=ttyS0 nosmep nopti" \
  -s -S  # GDB remote debugging

After enabling the GDB stub with -s -S:

gdb vmlinux
target remote :1234

Tools​

  • syzkaller — A kernel fuzzer with which Google found hundreds of CVEs
  • exploit-db kernel section — Reference for real CVE PoCs
  • pwndbg + GDB — Also useful for kernel debugging

Closing Thoughts​

Kernel exploitation has a high barrier to entry, but once the kernel is compromised, there is no way to stop it. Layers of mitigations such as KASLR, SMEP, SMAP, and KPTI are in place, but bypass techniques continue to evolve in both CTFs and the real world. Work your way up from basic pwn—the kernel is not going anywhere.