#kernelCTF

lol 9 Linux Kernel exploits in 6 minutes. #kernelCTF @koczkatamas

A good discussion about @GoogleVRP #kernelCTF 😄 on Day[0] Podcast @dayzerosec /cc @koczkatamas

#kernelctf #CVE-2025-* exploits + documentation for each vulns are available:

Theori leads #kernelCTF again! 🏆 ✅ LTS 6.6.69/COS 109 0-day ✅ LTS 6.6.75/COS 105 1-day ✅ LTS 6.6.77/COS 109/Mitigation 0-day Theori locked in the first valid flag for LTS 6.6.77 at @Google's CTF. Also, last year our researchers @v4bel & @_qwerty_po made history as the first to exploit VSock, pushing kernelCTF’s attack surface even further! 🥳 #Theori #LinuxKernel #VulnerabilityResearch #zeroday

The "Randomized slab caches for kmalloc()" patch was merged into mainline. With CONFIG_RANDOM_KMALLOC_CACHES=y, each kmalloc cache is split into 16. kmalloc uses a random one for each allocation based on the code location. Choices change every reboot.

Controversial change. Cross-cache will still work and will even become more reliable, as there's gonna be less noise in each cache. Also 30% memory overhead in QEMU (only for slab memory?). Although I think on real workloads it should be lower.

@andreyknvl We are planning to test it with our cross-cache protection (CONFIG_SLAB_VIRTUAL[1]) enabled on #kernelCTF[2], paying $21k for pwning it. More details on Discord[3]. [1] [2] [3]