Organizer
Partner Company
Dirty Ptrace: Exploiting Undocumented Behaviors in Kernel mmap Handlers
Xingyu Jin, Martijn Bogaard
Abstract
Flawed mmap implementations in Linux kernel drivers have repeatedly led to privilege escalation vulnerabilities for decades. In this talk, we will discuss several recent real-world examples — including an 0-day we identified from an in-the-wild exploit (CVE-2024-44068) and several GPU bugs we discovered, including a Linux kernel bug (CVE-2024-46852) — demonstrating canonical classes of memory corruption issues in driver-level mmap implementations.
Furthermore, we discuss a less known vulnerability class, "Dirty Ptrace" we identified within the Linux kernel's memory management design. An undocumented edge case in the Linux kernel, it allows unprivileged debuggers to (surprisingly) overwrite the underlying memory of read-only mmap’ed memory due to insufficient permission checks.
“Dirty Ptrace” may affect multiple products, including Nvidia GPU (CVE‑2025‑23244) and PowerVR GPU (CVE-2024-49739, CVE-2025-25177) drivers. We will present an exploit demo and discuss potential improvements to the Linux kernel memory management design.
Speaker Info
Xingyu Jin is a security researcher at Google working on low-level Pixel / Android offensive research. He used to work on Android exploit detections and reverse engineering in the past.
Martijn Bogaard is a security engineer at Google working on low-level device security. On a day-by-day basis he reviews code for vulnerabilities, writes fuzzers and once in a while writes an exploit for an interesting vulnerability he finds.