Abstract: Developing exploits for vulnerabilities is the main way to evaluate the exploitability of kernel vulnerabilities. Spray objects are widely used in the exploitation process to complete malicious behaviors such as malicious content injection and memory layout manipulation. The current researches on spray objects have limitations in two aspects: (1) Spray objects with basic types are ignored; (2) no work can generate the code to edit the contents of spray objects. Therefore, this paper proposes the techniques of automatically generating code to manipulate spray objects for kernel vulnerability exploitation. The techniques consist of spray object identification based on use-define chain analysis and spray object control code generation based on directed fuzzing. The experimental results show that the techniques can identify and generate the control code of 28 spray objects in Linux kernel version 5.15, which can cover all the spray objects identified by the existing work. A total of 23 generated codes can control the spray object to achieve the expected target, with a success rate of 82.1%. The case analysis shows that the control code generated by the techniques can be applied to the exploitation of real-world kernel vulnerabilities.

摘要： 为漏洞开发利用程序是评估内核漏洞可利用性的主要方式。堆喷对象在漏洞利用过程中被广泛使用，以完成数据注入、内存布局等恶意行为。现有对堆喷对象的研究存在两类局限：（1）忽略了类型为基本类型的堆喷对象；（2）无法生成能够编辑堆喷对象内容的代码。因此，提出面向内核漏洞利用的堆喷对象控制代码自动化生成技术。该技术包含了基于使用-定义链分析的堆喷对象识别和基于导向式模糊测试的堆喷对象控制代码生成。实验表明，该技术能够在Linux5.15版本的内核中识别并生成28个堆喷对象的控制代码，覆盖了现有研究识别到的所有堆喷对象。生成的控制代码中共有23个能控制堆喷对象完成预期目标，成功率为82.1%。通过案例分析表明，该技术生成的控制代码可以应用于真实内核漏洞的利用程序开发中。