Dongchen Xie

$ cat contact.txt

Email  /  CV  /  Github

Skills

Timeline

Research

I'm interested in kernel security. My research is about linux kernel vulnerability exploitation.

In this paper, we propose a practical approach that enables arbitrary memory writes from kernel OOB vulnerabilities with limited capabilities. Our method leverages two special kinds of kernel objects to upgrade the capability from an uncontrolled overwrite to a controlled overwrite, ultimately achieving arbitrary memory write.

In this paper, we propose a novel and practical path exploration strategy that focuses on the coverage of define-use relations in the subject binary. We develop a fuzzing approach for exploring these define-use relations in a progressive and self-supervised way.

Code Showcase

/* Capability upgrade: OOB write -> Arbitrary write */
static int trigger_oob_write(int fd, size_t offset) {
    struct bridge_obj *obj;
    void *spray_buf;

    /* Step 1: Spray vulnerable slab cache */
    spray_buf = heap_spray(KMALLOC_256, NUM_SPRAY);

    /* Step 2: Trigger OOB via ioctl */
    ioctl(fd, VULN_IOCTL, &overflow_data);

    /* Step 3: Upgrade to arbitrary write */
    obj = find_bridge_object(spray_buf);
    obj->write_target = (void *)MODPROBE_PATH;
    trigger_controlled_write(obj, payload, sizeof(payload));

    return 0;
}

Miscellanea

We design a virtual network emulator based on iSula containers, achieving unified management of virtual node clusters with the ONOS controller.

We utilize the lower-layer P4 and upper-layer deep learning for detecting incoming traffic, intercepting more than 94% of malicious traffic.

We add stress-related testing of Intel's open-source project LKP in a container environment to enhance the RAS features of the Linux system.

Feel free to steal this website's source code.