{"status":"ok","message-type":"work","message-version":"1.0.0","message":{"indexed":{"date-parts":[[2025,4,7]],"date-time":"2025-04-07T11:43:28Z","timestamp":1744026208540,"version":"3.37.3"},"publisher-location":"New York, NY, USA","reference-count":50,"publisher":"ACM","license":[{"start":{"date-parts":[[2023,11,7]],"date-time":"2023-11-07T00:00:00Z","timestamp":1699315200000},"content-version":"vor","delay-in-days":365,"URL":"http:\/\/www.acm.org\/publications\/policies\/copyright_policy#Background"}],"funder":[{"DOI":"10.13039\/100000001","name":"NSF (National Science Foundation)","doi-asserted-by":"publisher","award":["1954466"],"id":[{"id":"10.13039\/100000001","id-type":"DOI","asserted-by":"publisher"}]},{"name":"ONR","award":["N00014-20-1-2008"]}],"content-domain":{"domain":["dl.acm.org"],"crossmark-restriction":true},"short-container-title":[],"published-print":{"date-parts":[[2022,11,7]]},"DOI":"10.1145\/3548606.3560585","type":"proceedings-article","created":{"date-parts":[[2022,11,7]],"date-time":"2022-11-07T11:41:28Z","timestamp":1667821288000},"page":"1963-1976","update-policy":"https:\/\/doi.org\/10.1145\/crossmark-policy","source":"Crossref","is-referenced-by-count":16,"title":["DirtyCred"],"prefix":"10.1145","author":[{"given":"Zhenpeng","family":"Lin","sequence":"first","affiliation":[{"name":"Northwestern University, Evanston, IL, USA"}]},{"given":"Yuhang","family":"Wu","sequence":"additional","affiliation":[{"name":"Northwestern University, Evanston, IL, USA"}]},{"given":"Xinyu","family":"Xing","sequence":"additional","affiliation":[{"name":"Northwestern University, Evanston, IL, USA"}]}],"member":"320","published-online":{"date-parts":[[2022,11,7]]},"reference":[{"key":"e_1_3_2_1_1_1","unstructured":"2022. DirtyCred: Escalating Privilege in Linux Kernel. (2022). https:\/\/zplin.me\/ papers\/DirtyCred.pdf 2022. DirtyCred: Escalating Privilege in Linux Kernel. (2022). https:\/\/zplin.me\/ papers\/DirtyCred.pdf"},{"key":"e_1_3_2_1_2_1","unstructured":"Kristen Carlson Accardi. 2020. Function Granular KASLR. (2020). https:\/\/lwn.net\/Articles\/824307\/ Kristen Carlson Accardi. 2020. Function Granular KASLR. (2020). https:\/\/lwn.net\/Articles\/824307\/"},{"key":"e_1_3_2_1_3_1","volume-title":"https:\/\/hackmd.io\/giRE2P2oQHektZzOG053IQ","author":"Anonymous","year":"2022","unstructured":"Anonymous . 2022. DirtyCred Exploit . ( 2022 ). https:\/\/hackmd.io\/giRE2P2oQHektZzOG053IQ Anonymous. 2022. DirtyCred Exploit. (2022). https:\/\/hackmd.io\/giRE2P2oQHektZzOG053IQ"},{"key":"e_1_3_2_1_4_1","unstructured":"Alex Chapman. 2020. Privileged Container Escape Control Groups release_agent. (2020). https:\/\/ajxchapman.github.io\/containers\/2020\/11\/19\/privileged-container-escape.html Alex Chapman. 2020. Privileged Container Escape Control Groups release_agent. (2020). https:\/\/ajxchapman.github.io\/containers\/2020\/11\/19\/privileged-container-escape.html"},{"key":"e_1_3_2_1_5_1","doi-asserted-by":"publisher","DOI":"10.1145\/3052973.3053029"},{"key":"e_1_3_2_1_6_1","doi-asserted-by":"publisher","DOI":"10.1145\/3372297.3423353"},{"key":"e_1_3_2_1_7_1","doi-asserted-by":"publisher","DOI":"10.1145\/3319535.3363212"},{"key":"e_1_3_2_1_8_1","unstructured":"Jonathan Corbet. 2012. Supervisor mode access prevention. (2012). https:\/\/lwn.net\/Articles\/517475\/ Jonathan Corbet. 2012. Supervisor mode access prevention. (2012). https:\/\/lwn.net\/Articles\/517475\/"},{"key":"e_1_3_2_1_9_1","unstructured":"Jonathan Corbet. 2017. The current state of kernel page-table isolation. (2017). https:\/\/lwn.net\/Articles\/741878\/ Jonathan Corbet. 2017. The current state of kernel page-table isolation. (2017). https:\/\/lwn.net\/Articles\/741878\/"},{"key":"e_1_3_2_1_10_1","volume-title":"https:\/\/cve.mitre.org\/cgi-bin\/cvename.cgi?name=CVE-2021-4154","author":"The MITRE Corporation","year":"2021","unstructured":"The MITRE Corporation . 2021. CVE-2021--4154. ( 2021 ). https:\/\/cve.mitre.org\/cgi-bin\/cvename.cgi?name=CVE-2021-4154 The MITRE Corporation. 2021. CVE-2021--4154. (2021). https:\/\/cve.mitre.org\/cgi-bin\/cvename.cgi?name=CVE-2021-4154"},{"key":"e_1_3_2_1_11_1","volume-title":"https:\/\/cve.mitre.org\/cgi-bin\/cvename.cgi?name=CVE-2022-0847","author":"The MITRE Corporation","year":"2022","unstructured":"The MITRE Corporation . 2022. CVE-2022-0847. ( 2022 ). https:\/\/cve.mitre.org\/cgi-bin\/cvename.cgi?name=CVE-2022-0847 The MITRE Corporation. 2022. CVE-2022-0847. (2022). https:\/\/cve.mitre.org\/cgi-bin\/cvename.cgi?name=CVE-2022-0847"},{"key":"e_1_3_2_1_12_1","doi-asserted-by":"publisher","DOI":"10.1109\/SP.2014.26"},{"key":"e_1_3_2_1_13_1","unstructured":"Datadog. 2022. Using the Dirty Pipe Vulnerability to Break Out from Containers. (2022). https:\/\/www.datadoghq.com\/blog\/engineering\/dirty-pipe-container-escape-poc\/ Datadog. 2022. Using the Dirty Pipe Vulnerability to Break Out from Containers. (2022). https:\/\/www.datadoghq.com\/blog\/engineering\/dirty-pipe-container-escape-poc\/"},{"key":"e_1_3_2_1_14_1","doi-asserted-by":"publisher","DOI":"10.14722\/ndss.2017.23421"},{"key":"e_1_3_2_1_15_1","unstructured":"Jake Edge. 2013. Kernel address space layout randomization. (2013). https:\/\/lwn.net\/Articles\/569635\/ Jake Edge. 2013. Kernel address space layout randomization. (2013). https:\/\/lwn.net\/Articles\/569635\/"},{"key":"e_1_3_2_1_16_1","unstructured":"Jake Edge. 2020. Control-flow integrity for the kernel. (2020). https:\/\/lwn.net\/Articles\/569635\/ Jake Edge. 2020. Control-flow integrity for the kernel. (2020). https:\/\/lwn.net\/Articles\/569635\/"},{"key":"e_1_3_2_1_17_1","doi-asserted-by":"publisher","DOI":"10.1109\/MICRO.2016.7783743"},{"key":"e_1_3_2_1_18_1","unstructured":"Thomas Garnier. 2016. mm: SLAB freelist randomization. (2016). https:\/\/lwn.net\/Articles\/685047\/ Thomas Garnier. 2016. mm: SLAB freelist randomization. (2016). https:\/\/lwn.net\/Articles\/685047\/"},{"key":"e_1_3_2_1_19_1","doi-asserted-by":"publisher","DOI":"10.1109\/EuroSP.2016.24"},{"key":"e_1_3_2_1_20_1","unstructured":"google. 2022. Kernel Control Flow Integrity. (2022). https:\/\/source.android.com\/devices\/tech\/debug\/kcfi google. 2022. Kernel Control Flow Integrity. (2022). https:\/\/source.android.com\/devices\/tech\/debug\/kcfi"},{"volume-title":"Violets are blue, Giving leets more sweets. All of 2022!","year":"2022","key":"e_1_3_2_1_21_1","unstructured":"Google. 2022a. Roses are red , Violets are blue, Giving leets more sweets. All of 2022! ( 2022 ). https:\/\/security.googleblog.com\/2022\/02\/roses-are-red-violets-are-blue-giving.html Google. 2022a. Roses are red, Violets are blue, Giving leets more sweets. All of 2022! (2022). https:\/\/security.googleblog.com\/2022\/02\/roses-are-red-violets-are-blue-giving.html"},{"key":"e_1_3_2_1_22_1","doi-asserted-by":"publisher","DOI":"10.1007\/978-3-319-62105-0_11"},{"key":"e_1_3_2_1_23_1","doi-asserted-by":"publisher","DOI":"10.1145\/2976749.2978356"},{"volume-title":"https:\/\/github.com\/HexRabbit\/CVE-writeup\/tree\/master\/CVE-2021-34866","year":"2021","key":"e_1_3_2_1_24_1","unstructured":"HexRabbit. 2021. CVE-2021--34866 Writeup. ( 2021 ). https:\/\/github.com\/HexRabbit\/CVE-writeup\/tree\/master\/CVE-2021-34866 HexRabbit. 2021. CVE-2021--34866 Writeup. (2021). https:\/\/github.com\/HexRabbit\/CVE-writeup\/tree\/master\/CVE-2021-34866"},{"key":"e_1_3_2_1_25_1","volume-title":"Linux: UAF via double-fdput.","author":"Horn Jann","year":"2022","unstructured":"Jann Horn . 2022 . Linux: UAF via double-fdput. (2022). https:\/\/bugs.chromium.org\/p\/project-zero\/issues\/detail?id=808 Jann Horn. 2022. Linux: UAF via double-fdput. (2022). https:\/\/bugs.chromium.org\/p\/project-zero\/issues\/detail?id=808"},{"key":"e_1_3_2_1_26_1","unstructured":"David Howells. 2022. CREDENTIALS IN LINUX. (2022). https:\/\/www.kernel.org\/doc\/Documentation\/security\/credentials.txt David Howells. 2022. CREDENTIALS IN LINUX. (2022). https:\/\/www.kernel.org\/doc\/Documentation\/security\/credentials.txt"},{"key":"e_1_3_2_1_27_1","doi-asserted-by":"publisher","DOI":"10.14722\/ndss.2022.23060"},{"key":"e_1_3_2_1_28_1","doi-asserted-by":"publisher","DOI":"10.1109\/SP.2013.23"},{"key":"e_1_3_2_1_29_1","volume-title":"SMEP: What is it, and how to beat it on Windows.","author":"Jurczyk Mateusz","year":"2011","unstructured":"Mateusz Jurczyk . 2011 . SMEP: What is it, and how to beat it on Windows. (2011). https:\/\/j00ru.vexillium.org\/2011\/06\/smep-what-is-it-and-how-to-beat-it-on-windows\/ Mateusz Jurczyk. 2011. SMEP: What is it, and how to beat it on Windows. (2011). https:\/\/j00ru.vexillium.org\/2011\/06\/smep-what-is-it-and-how-to-beat-it-on-windows\/"},{"key":"e_1_3_2_1_30_1","unstructured":"Max Kellermann. 2022. The Dirty Pipe Vulnerability. (2022). https:\/\/dirtypipe.cm4all.com\/ Max Kellermann. 2022. The Dirty Pipe Vulnerability. (2022). https:\/\/dirtypipe.cm4all.com\/"},{"key":"e_1_3_2_1_31_1","volume-title":"Proceedings of the 23rd USENIX Conference on Security Symposium.","author":"Kemerlis Vasileios P","year":"2014","unstructured":"Vasileios P Kemerlis , Michalis Polychronakis , and Angelos D Keromytis . 2014 . ret2dir: Rethinking kernel isolation . In Proceedings of the 23rd USENIX Conference on Security Symposium. Vasileios P Kemerlis, Michalis Polychronakis, and Angelos D Keromytis. 2014. ret2dir: Rethinking kernel isolation. In Proceedings of the 23rd USENIX Conference on Security Symposium."},{"key":"e_1_3_2_1_32_1","volume-title":"Proceedings of the 21st USENIX Conference on Security Symposium.","author":"Kemerlis Vasileios P","year":"2012","unstructured":"Vasileios P Kemerlis , Georgios Portokalidis , and Angelos D Keromytis . 2012 . $$kGuard$$: Lightweight Kernel Protection against $$Return-to-User$$ Attacks . In Proceedings of the 21st USENIX Conference on Security Symposium. Vasileios P Kemerlis, Georgios Portokalidis, and Angelos D Keromytis. 2012. $$kGuard$$: Lightweight Kernel Protection against $$Return-to-User$$ Attacks. In Proceedings of the 21st USENIX Conference on Security Symposium."},{"key":"e_1_3_2_1_33_1","doi-asserted-by":"publisher","DOI":"10.1109\/SP.2019.00002"},{"key":"e_1_3_2_1_34_1","unstructured":"Zhenpeng Lin. 2021. How AUTOSLAB Changes the Memory Unsafety Game. (2021). https:\/\/grsecurity.net\/how_autoslab_changes_the_memory_unsafety_game\/ Zhenpeng Lin. 2021. How AUTOSLAB Changes the Memory Unsafety Game. (2021). https:\/\/grsecurity.net\/how_autoslab_changes_the_memory_unsafety_game\/"},{"key":"e_1_3_2_1_35_1","doi-asserted-by":"publisher","DOI":"10.1109\/SP46214.2022.9833683"},{"key":"e_1_3_2_1_36_1","doi-asserted-by":"crossref","unstructured":"Linux. 2022a. File management in the Linux kernel. (2022). https:\/\/www.kernel.org\/doc\/Documentation\/security\/credentials.txt Linux. 2022a. File management in the Linux kernel. (2022). https:\/\/www.kernel.org\/doc\/Documentation\/security\/credentials.txt","DOI":"10.1145\/3548606.3560585"},{"key":"e_1_3_2_1_37_1","unstructured":"Linux. 2022b. FUSE's introduction in the Linux kernel user's and administrator's guide. (2022). https:\/\/www.kernel.org\/doc\/html\/latest\/filesystems\/fuse.html Linux. 2022b. FUSE's introduction in the Linux kernel user's and administrator's guide. (2022). https:\/\/www.kernel.org\/doc\/html\/latest\/filesystems\/fuse.html"},{"key":"e_1_3_2_1_38_1","volume-title":"Proceedings of the 27th USENIX Conference on Security Symposium.","author":"Lipp Moritz","year":"2018","unstructured":"Moritz Lipp , Michael Schwarz , Daniel Gruss , Thomas Prescher , Werner Haas , Anders Fogh , Jann Horn , Stefan Mangard , Paul Kocher , Daniel Genkin , 2018 . Meltdown: Reading kernel memory from user space . Proceedings of the 27th USENIX Conference on Security Symposium. Moritz Lipp, Michael Schwarz, Daniel Gruss, Thomas Prescher, Werner Haas, Anders Fogh, Jann Horn, Stefan Mangard, Paul Kocher, Daniel Genkin, et al. 2018. Meltdown: Reading kernel memory from user space. Proceedings of the 27th USENIX Conference on Security Symposium."},{"volume-title":"Nathan Burow. Preventing Kernel Hacks with HAKC. In Proceedings 2022 Network and Distributed System Security Symposium.","author":"McKee Derrick","key":"e_1_3_2_1_39_1","unstructured":"Derrick McKee , Yianni Giannaris , Carolina Ortega Perez , Howard Shrobe , Mathias Payer , Hamed Okhravi , and Nathan Burow. Preventing Kernel Hacks with HAKC. In Proceedings 2022 Network and Distributed System Security Symposium. Derrick McKee, Yianni Giannaris, Carolina Ortega Perez, Howard Shrobe, Mathias Payer, Hamed Okhravi, and Nathan Burow. Preventing Kernel Hacks with HAKC. In Proceedings 2022 Network and Distributed System Security Symposium."},{"key":"e_1_3_2_1_40_1","unstructured":"Larry McVoy and Carl Staelin. 2022. LMbench - Tools for Performance Analysis. (2022). http:\/\/lmbench.sourceforge.net\/ Larry McVoy and Carl Staelin. 2022. LMbench - Tools for Performance Analysis. (2022). http:\/\/lmbench.sourceforge.net\/"},{"key":"e_1_3_2_1_41_1","volume-title":"https:\/\/www.phoronix-test-suite.com\/","author":"Media Phoronix","year":"2022","unstructured":"Phoronix Media . 2022. Open-Source, Automated Benchmarking . ( 2022 ). https:\/\/www.phoronix-test-suite.com\/ Phoronix Media. 2022. Open-Source, Automated Benchmarking. (2022). https:\/\/www.phoronix-test-suite.com\/"},{"key":"e_1_3_2_1_42_1","unstructured":"Samsung Knox News. 2016. Real-time Kernel Protection (RKP). (2016). https:\/\/www.samsungknox.com\/en\/blog\/real-time-kernel-protection-rkp Samsung Knox News. 2016. Real-time Kernel Protection (RKP). (2016). https:\/\/www.samsungknox.com\/en\/blog\/real-time-kernel-protection-rkp"},{"key":"e_1_3_2_1_43_1","doi-asserted-by":"publisher","DOI":"10.1109\/SP40000.2020.00041"},{"key":"e_1_3_2_1_44_1","doi-asserted-by":"publisher","DOI":"10.1109\/ACCESS.2022.3153064"},{"key":"e_1_3_2_1_45_1","doi-asserted-by":"publisher","DOI":"10.14722\/ndss.2016.23218"},{"key":"e_1_3_2_1_46_1","unstructured":"Dan Williams. 2018. Randomize free memory. (2018). https:\/\/lwn.net\/Articles\/767614\/ Dan Williams. 2018. Randomize free memory. (2018). https:\/\/lwn.net\/Articles\/767614\/"},{"key":"e_1_3_2_1_47_1","volume-title":"Proceedings of the 28th USENIX Conference on Security Symposium.","author":"Wu Wei","year":"2019","unstructured":"Wei Wu , Yueqi Chen , Xinyu Xing , and Wei Zou . 2019 . {KEPLER}: Facilitating control-flow hijacking primitive evaluation for Linux kernel vulnerabilities . In Proceedings of the 28th USENIX Conference on Security Symposium. Wei Wu, Yueqi Chen, Xinyu Xing, and Wei Zou. 2019. {KEPLER}: Facilitating control-flow hijacking primitive evaluation for Linux kernel vulnerabilities. In Proceedings of the 28th USENIX Conference on Security Symposium."},{"key":"e_1_3_2_1_48_1","doi-asserted-by":"publisher","DOI":"10.1145\/2810103.2813637"},{"key":"e_1_3_2_1_49_1","volume-title":"In-Kernel Control-Flow Integrity on Commodity OSes using ARM Pointer Authentication. arXiv preprint arXiv:2112.07213","author":"Yoo Sungbae","year":"2021","unstructured":"Sungbae Yoo , Jinbum Park , Seolheui Kim , Yeji Kim , and Taesoo Kim . 2021. In-Kernel Control-Flow Integrity on Commodity OSes using ARM Pointer Authentication. arXiv preprint arXiv:2112.07213 ( 2021 ). Sungbae Yoo, Jinbum Park, Seolheui Kim, Yeji Kim, and Taesoo Kim. 2021. In-Kernel Control-Flow Integrity on Commodity OSes using ARM Pointer Authentication. arXiv preprint arXiv:2112.07213 (2021)."},{"key":"e_1_3_2_1_50_1","volume-title":"Proceedings of the 31st USENIX Conference on Security Symposium.","author":"Zeng Kyle","year":"2022","unstructured":"Kyle Zeng , Yueqi Chen , Haehyun Cho , Xinyu Xing , Adam Doup\u00e9 , Yan Shoshitaishvili , and Tiffany Bao . 2022 . Playing for K(H)eaps: Understanding and Improving Linux Kernel Exploit Reliability . In Proceedings of the 31st USENIX Conference on Security Symposium. Kyle Zeng, Yueqi Chen, Haehyun Cho, Xinyu Xing, Adam Doup\u00e9, Yan Shoshitaishvili, and Tiffany Bao. 2022. Playing for K(H)eaps: Understanding and Improving Linux Kernel Exploit Reliability. In Proceedings of the 31st USENIX Conference on Security Symposium."}],"event":{"name":"CCS '22: 2022 ACM SIGSAC Conference on Computer and Communications Security","sponsor":["SIGSAC ACM Special Interest Group on Security, Audit, and Control"],"location":"Los Angeles CA USA","acronym":"CCS '22"},"container-title":["Proceedings of the 2022 ACM SIGSAC Conference on Computer and Communications Security"],"original-title":[],"link":[{"URL":"https:\/\/dl.acm.org\/doi\/pdf\/10.1145\/3548606.3560585","content-type":"application\/pdf","content-version":"vor","intended-application":"syndication"},{"URL":"https:\/\/dl.acm.org\/doi\/pdf\/10.1145\/3548606.3560585","content-type":"unspecified","content-version":"vor","intended-application":"similarity-checking"}],"deposited":{"date-parts":[[2023,11,7]],"date-time":"2023-11-07T12:44:34Z","timestamp":1699361074000},"score":1,"resource":{"primary":{"URL":"https:\/\/dl.acm.org\/doi\/10.1145\/3548606.3560585"}},"subtitle":["Escalating Privilege in Linux Kernel"],"short-title":[],"issued":{"date-parts":[[2022,11,7]]},"references-count":50,"alternative-id":["10.1145\/3548606.3560585","10.1145\/3548606"],"URL":"https:\/\/doi.org\/10.1145\/3548606.3560585","relation":{},"subject":[],"published":{"date-parts":[[2022,11,7]]},"assertion":[{"value":"2022-11-07","order":2,"name":"published","label":"Published","group":{"name":"publication_history","label":"Publication History"}}]}}