# ERACE: Toward Facilitating Exploit Generation for Kernel Race Vulnerabilities
## 4 Design
### Checkpoint Detector
#### 4.3.2 Filtering out Checkpoint Candidates  
As mentioned above, the checkpoint needs to meet two requirements. One is that the value modified by the checkpoint must be in a kernel data structure and it is meaningless if it is just an ordinary value-transfer instruction. The other is that there must be a channel to leak the kernel data modified by the checkpoints to the user space and it does not require root privileges. For the first requirement, we need to determine which kernel structure \(C_{cand}\) modifies. We use \(C_{cand}\) as a starting point to perform backward taint analysis on the modified value to check whether its source comes from \(S\). If it is not in \(S\), then the checkpoint is filtered out. The remaining checkpoint is denoted as \(C_{real}\), which indicates that the source of the leaked memory comes from the kernel structure \(S\). The modified kernel structure and corresponding offset are denoted as \(S_{real}\). Before we expound on the second requirement, we should discuss the communicating mechanism of the kernel. There are three traditional methods of communication between the user space and kernel space, /proc, netlink, and ioctl. The /proc directory is a virtual file system through which users can read data about system hardware and the currently running processes. However, root privileges can access all kernel information. The kernel data that users can view are very limited. Netlink is a kind of duplex communication between the kernel and user but it needs the support of specific kernel functions. For a vulnerability exploitation, the scenarios used are very limited. ioctl is a more flexible communication method and is implemented in many Linux modules. The channel that can obtain the checkpoint information studied in this paper is similar to ioctl. Users can obtain the information in the kernel through the channel provided by the Linux kernel module without affecting the original execution flow of the kernel. There are two main methods for obtaining checkpoint data. First, the kernel module can leak the kernel data to the user space through some important functions. For example, when capturing packets, users can obtain the timestamp and version information of the kernel layer data packets (called by getsockopt). Second, the shared memory between the kernel space and user space can be used to directly obtain the kernel data. There are some functions in the kernel that can leak kernel data to the user space. We use them as the starting points for backward taint analysis. We summarized these functions and called them leaking anchors and they include copy_to_user(), put_user(), copyout(), nla_put(), and akb_put(). Leaking anchors generally contain two important parameters; one is the address of the kernel data, denoted as \(k\_addr\), and the other is the length of the leaked data, denoted as \(k\_len\). We use \(k\_addr\) and \(k\_len\) as the starting points for backward taint analysis and find the sources of \(k\_addr\) and \(k\_len\), denoted as \(S\_addr\) and \(S\_len\), respectively. If \([S\_addr,S\_addr+S\_len]\) belongs to \(S_{real}\), it means that the value modified by the checkpoint can be leaked. Moreover, control-flow analysis should be performed to ensure that the leaking anchors can be reached from the user interface with normal privileges. If a function such as capable(CAP_SYS_ADMIN) appears on the path, it means that root privileges are required to obtain the kernel data. The general taint analysis and control-flow analysis principles are shown in Figure 7. Note that copy_to_user() is only a representative function in leaking anchors and there are other leaking functions mentioned above. Users can also obtain kernel data through the shared memory. ELOISE [19] did not consider this special communication method. Some Linux modules require a large amount of data transmission between the kernel space and user space. To improve the efficiency of data transmission, it is necessary to create a shared memory between the kernel and the user.