Share
## https://sploitus.com/exploit?id=C11C8C92-C7D6-5DB7-9E70-8E079C0B367E
# ๐ SLUBSTICK Exploitation Research
### *Demonstrating Race Conditions in the Linux Kernel SLUB Allocator*
[](https://opensource.org/licenses/MIT)
[](https://en.wikipedia.org/wiki/C_(programming_language))
[](https://www.kernel.org/)
[](https://en.wikipedia.org/wiki/X86-64)
[](https://github.com/yourusername/slubstick-research)
---
### ๐ **Performance Gap Analysis**
| Metric | Fast Path | Slow Path | Ratio |
|--------|-----------|-----------|-------|
| **Min Latency** | ~50 ns | ~5,000 ns | **100x** |
| **Avg Latency** | ~80 ns | ~8,500 ns | **106x** |
| **p99 Latency** | ~150 ns | ~15,000 ns | **100x** |
*Exploitable timing side-channel with >99% distinguishability*
---
[Features](#-features) โข
[Installation](#-installation) โข
[Usage](#-usage) โข
[Technical Details](#-technical-details) โข
[Results](#-results) โข
[References](#-references)
---
## ๐ Overview
This proof-of-concept demonstrates the **SLUBSTICK** exploitation technique, which leverages race conditions between the Linux kernel's SLUB allocator per-CPU freelists and the buddy allocator fallback path. The technique has been used in real-world kernel exploits including:
- **CVE-2021-22555** - Netfilter heap overflow combined with SLUBSTICK
- **CVE-2022-29582** - io_uring use-after-free with cross-cache attack
> โ ๏ธ **DISCLAIMER**: This code is for educational and security research purposes only. Unauthorized use against systems you don't own is illegal and unethical.
---
## ๐ฏ Features
### ๐ฌ Research Capabilities
- โ
Per-CPU freelist simulation
- โ
Buddy allocator fallback analysis
- โ
Race condition window measurement
- โ
Timing side-channel detection
- โ
Heap spray simulation
- โ
Real-time performance profiling
### ๐ Statistical Analysis
- โ
Min/Max/Avg latency tracking
- โ
Percentile calculations (p50, p95, p99)
- โ
20-bucket histogram distribution
- โ
Exploitability metrics
- โ
Race window success rate
- โ
Visual ASCII graphs
---
## ๐ Installation
### Prerequisites
```bash
# Required tools
sudo apt update
sudo apt install build-essential gcc make git
# Optional: For better timing accuracy
sudo apt install linux-tools-common linux-tools-generic
```
### Build from Source
```bash
# Clone the repository
git clone https://github.com/shadowgun-cpu/Poc-SLUBSTICK
cd Poc-SLUBSTICK
# Compile with optimizations
gcc -O2 -Wall -Wextra -o slub slub.c -lpthread -lrt
# Run with elevated privileges (recommended for real-time scheduling)
sudo ./slub
# Or run without sudo (slightly reduced timing accuracy)
./slub
```
### Compilation Options
```bash
# Debug build with symbols
gcc -g -O0 -Wall -Wextra -o slub slub.c -lpthread -lrt
# Optimized build with additional warnings
gcc -O3 -Wall -Wextra -Wpedantic -march=native -o slub slub.c -lpthread -lrt
# Static build (portable)
gcc -O2 -static -o slub slub.c -lpthread -lrt
```
---
## ๐ป Usage
### Basic Execution
```bash
# Run the complete analysis
sudo ./slub
```
### Expected Output
```
โโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโ
โ โ
โ SLUBSTICK Exploitation Technique - PoC โ
โ โ
โ Demonstrates race condition between SLUB per-CPU freelist and โ
โ buddy allocator, enabling cross-cache attacks and UAF exploits โ
โ โ
โโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโ
Configuration:
Target cache: kmalloc-64
Per-CPU pool size: 1024 objects
Slow pool size: 128 pages
Benchmark iterations: 2000
CPU pinning: CPU 0
Page size: 4096 bytes
[โ] Pinned to CPU 0 (per-CPU attack simulation)
[โ] Real-time scheduling enabled
[*] Priming per-CPU freelist...
[โ] Freelist primed with 1024 objects
[*] Running warmup phase...
[โ] System stabilized
[*] Running allocation benchmark...
Progress: [โโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโ] Complete!
```
### Understanding the Results
The tool outputs three main sections:
1. **Performance Analysis** - Latency statistics for fast/slow paths
2. **Race Condition Analysis** - Exploitable timing windows
3. **Attack Surface Summary** - Exploitation primitives and mitigations
---
## ๐ฌ Technical Details
### Architecture Overview
```
โโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโ
โ Application Layer โ
โ (Controlled Allocations) โ
โโโโโโโโโโโโโโโโโโโโโโโโฌโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโ
โ
โผ
โโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโ
โ Per-CPU Freelist Cache โ โโโโ FAST PATH
โ (Lockless, ~50-150ns) โ (Exploitable)
โโโโโโโโโโโโฌโโโโโโโโโโโโโโโโโโโ
โ Cache Miss
โผ
โโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโ
โ Buddy Allocator (mmap) โ โโโโ SLOW PATH
โ (Syscall, ~5,000-15,000ns) โ (Race Window)
โโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโ
```
### Key Components
#### 1. **Fast Path Simulation**
Mimics SLUB's per-CPU freelist behavior:
- Lockless LIFO structure
- Cache-line prefetching
- O(1) allocation/deallocation
```c
void *fast_alloc(void) {
if (fast_index > 0) {
__builtin_prefetch(&fast_pool[fast_index - 1], 0, 3);
return fast_pool[--fast_index];
}
return NULL;
}
```
#### 2. **Slow Path Simulation**
Emulates buddy allocator page allocation:
- System call overhead (mmap)
- Page fault handling
- Memory zeroing
```c
void *slow_alloc(void) {
void *ptr = mmap(NULL, 4096, PROT_READ | PROT_WRITE,
MAP_PRIVATE | MAP_ANONYMOUS, -1, 0);
if (ptr != MAP_FAILED) {
memset(ptr, 0, 4096); // Simulate page zeroing
}
return ptr;
}
```
#### 3. **Race Window Measurement**
Measures the exploitable window between free and reallocation:
```c
// Time the vulnerable window
clock_gettime(CLOCK_MONOTONIC, &start);
fast_free(victim); // Free object
void *attacker = fast_alloc(); // Attacker allocation
clock_gettime(CLOCK_MONOTONIC, &end);
uint64_t window = nsec_diff(start, end); // Race window in nanoseconds
```
---
## ๐ Results
### Typical Performance Characteristics
๐ Click to view sample output
```
โโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโ
PERFORMANCE ANALYSIS
โโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโ
[FAST PATH - Per-CPU Freelist]
Allocations: 1543
Min latency: 42 ns
Median (p50): 78 ns
p95 latency: 125 ns
p99 latency: 187 ns
Max latency: 342 ns
Avg latency: 84 ns
Fast Path Latency Distribution:
Range (ns) Count Graph
โโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโ
0 - 100 1234 โโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโ
100 - 200 287 โโโโโโโโโโโ
200 - 300 18 โ
300 - 400 4 โ
[SLOW PATH - Buddy Allocator]
Allocations: 457
Min latency: 4821 ns
Median (p50): 8234 ns
p95 latency: 14521 ns
p99 latency: 18934 ns
Max latency: 23847 ns
Avg latency: 8642 ns
[EXPLOITATION METRICS]
Performance gap: 102.88x slower
Timing side-channel: 8558 ns delta
Distinguishable: YES (>1ฮผs)
[RACE CONDITION ANALYSIS]
Samples collected: 500
Avg race window: 6234 ns
Exploitable windows: 487 (97.40%)
Exploitation viable: YES
```
### Exploitation Feasibility
| Factor | Status | Notes |
|--------|--------|-------|
| **Timing Side-Channel** | โ
Viable | >100x distinguishable gap |
| **Race Window** | โ
Viable | 5-10ฮผs average window |
| **Freelist Control** | โ
Viable | Predictable exhaustion |
| **Cross-Cache Attack** | โ
Viable | Buddy allocator fallback |
---
## ๐ก๏ธ Exploitation Primitives
### Attack Vector Breakdown
```mermaid
graph TD
A[Attacker Capabilities] --> B{Heap Spray}
A --> C{Timing Control}
B --> D[Fill Per-CPU Cache]
C --> D
D --> E[Exhaust Freelist]
E --> F[Trigger Slow Path]
F --> G[Race Window Opens]
G --> H[UAF / Type Confusion]
H --> I[Privilege Escalation]
```
### Required Primitives
1. **Allocation Control**
- Ability to trigger allocations in target cache (e.g., kmalloc-64)
- Spray heap with controlled data
2. **Timing Control**
- Trigger allocations at specific times
- Control free/alloc sequences
3. **Information Leak**
- Timing oracle OR
- Memory disclosure primitive
4. **Race Capability**
- Execute code during race window (5-10ฮผs typically sufficient)
---
## ๐ Mitigations
### Kernel Hardening Options
```bash
# Enable recommended mitigations
CONFIG_SLAB_FREELIST_RANDOM=y # Randomize freelist order
CONFIG_SLAB_FREELIST_HARDENED=y # Obfuscate freelist metadata
CONFIG_INIT_ON_ALLOC_DEFAULT_ON=y # Zero allocations by default
CONFIG_INIT_ON_FREE_DEFAULT_ON=y # Zero on free
```
### Runtime Protections
| Mitigation | Introduced | Effectiveness |
|------------|-----------|---------------|
| Freelist Randomization | Linux 4.7 | Moderate |
| Freelist Hardening | Linux 4.14 | High |
| Init-on-alloc | Linux 5.3 | Very High |
| Improved SLUB | Linux 5.17+ | Very High |
### Detection Strategies
- **Monitor allocation patterns**: Unusual freelist exhaustion
- **Timing analysis**: Detect repeated slow-path triggers
- **KASLR**: Makes heap spraying more difficult
- **KPTI**: Reduces timing precision from userspace
---
## ๐ References
### Academic Papers
- **"The SLAB Allocator: An Object-Caching Kernel Memory Allocator"** - Bonwick (1994)
- **"SLUB: The Unqueued Slab Allocator"** - Corbet (2007)
- **"Exploiting the SLUB Allocator"** - Wicked (2021)
### CVE References
- [CVE-2021-22555](https://vulners.com/cve/CVE-2021-22555) - Netfilter heap overflow
- [CVE-2022-29582](https://vulners.com/cve/CVE-2022-29582) - io_uring use-after-free
- [CVE-2022-27666](https://vulners.com/cve/CVE-2022-27666) - ESP transformation UAF
### Additional Resources
- [Linux Kernel SLUB Implementation](https://github.com/torvalds/linux/blob/master/mm/slub.c)
- [Kernel Exploit Development Tutorial](https://lkmidas.github.io/posts/20210123-linux-kernel-pwn-part-1/)
- [Project Zero: Exploiting the Linux Kernel](https://googleprojectzero.blogspot.com/)
---
## ๐ค Contributing
Contributions are welcome! Please follow these guidelines:
1. Fork the repository
2. Create a feature branch (`git checkout -b feature/improvement`)
3. Make your changes with clear commit messages
4. Add tests if applicable
5. Submit a pull request
### Code Style
- Follow Linux kernel coding style
- Use 4-space indentation
- Add comments for complex logic
- Include docstrings for functions
---
## ๐ License
This project is licensed under the MIT License - see the [LICENSE](LICENSE) file for details.
```
MIT License
Copyright (c) 2026 [alae eddine]
Permission is hereby granted, free of charge, to any person obtaining a copy
of this software and associated documentation files (the "Software"), to deal
in the Software without restriction...
```
---
## โ๏ธ Legal & Ethical Notice
```
โโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโ
โ โ ๏ธ EDUCATIONAL USE ONLY โ
โ โ
โ This code is provided for: โ
โ โ Security research โ
โ โ Educational purposes โ
โ โ Vulnerability analysis โ
โ โ Defense development โ
โ โ
โ Unauthorized access to computer systems is illegal. โ
โ Always obtain proper authorization before testing. โ
โ โ
โ The author assumes no liability for misuse of this software. โ
โโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโ
```
---
## ๐ค Author
**[ALae eddine]**
---
## ๐ Acknowledgments
- Linux kernel development team for SLUB allocator
- Security researchers who discovered and documented SLUBSTICK
- The InfoSec community for ongoing kernel security research
---
## ๐ Project Stats
---
### ๐ก Found this research useful?
โญ **Star this repository** to show your support!
---
**Made with โค๏ธ for the security research community**
*Last updated: February 2026*