LinkDoorAndroidNetlink内核模块中的隐藏攻击面

#BHASIA @BlackHatEventsLinkDoor: A Hidden Attack Surface in the Android Netlink Kernel ModulesChao Ma, Han Yan, Tim XiaBaidu AIoT Security TeamAbout usBaidu AIoT Security Team•Focus on Android / Linux platform•Aim to discover 0day vulnerability and explore possible defensesMembers•Chao Ma (machao2019@gmail.com)•Han Yan (yanhan05@baidu.com)•Tim Xia (xialiangzhao@baidu.com)Agenda•Introduction•Attack Surface Analysis•Case Study•PoC and Exploitation•ConclusionIntroduction•Background of Netlink•Programming model of Classic Netlink•Flaws of Classic Netlink•Programming model of Generic NetlinkIntroductionBackgroundof Netlink•Mainly used for bidirectional communication between the kernel and user-space processes•Support full-duplex, asynchronous and multicast communication•Two categories in usage:Classic Netlink and Generic NetlinkIntroductionProgramming model of Classic Netlink •(Classic) Netlink socket is supported since 1999 with Linux 2.2•The programming modelIntroductionFlaws of Classic N