国科大密码学院王跃武研究员指导学生，针对Linux系统上的提权攻击和防御开展研究。在27th Information Security Conference (ISC)发表了题为“A Lightweight Defense Scheme against Usermode Helper Privilege Escalation Using Linux Capability”的研究论文。2024年10月，论文第一作者参加了ISC 2024国际会议，并在会上对该项研究工作进行了英文汇报。Abstract：A new attack path is discovered in Linux privilege escalation attacks. Among the 50 exploits we have collected over the past 3 years, 19 leverage usermode helper to execute arbitrary code with root privileges, making it the most prevalent attack method. Existing research focuses on protecting permission mechanisms but falls short, as the attackers don’t attempt to modify their permissions. Instead, they exploit the regular routine of usermode helper by tampering with the path of usermode helper file which the kernel is about to execute. To address this, we propose a lightweight defense mechanism based on the fine-grained access control provided by Linux capability. The novelty of our approach lies in the fact that we didn’t use capability as a process property. Instead, we attach capabilities to valid usermode helper files and verify these files before execution. We identify the optimal point for insertion capability checks by statically analyzing kernel source code through LLVM. Our prototype implementation on Linux v6.6.3 demonstrates that our scheme effectively blocks these privilege escalation attacks with negligible performance overhead.论文信息：Jingzi Meng, Yuewu Wang, Lingguang Lei, Chunjing Kou, and Peng Wang: “A Lightweight Defense Scheme against Usermode Helper Privilege Escalation Using Linux Capability,” in Information Security Conference (ISC 2024)
