# ERACE: Toward Facilitating Exploit Generation for Kernel Race Vulnerabilities
## 7 Related Works
This is because the kernel environment is more complicated and requires more system calls to complete the exploitation. However, the research on automatic exploit generation originates from vulnerabilities in the user space and the techniques used are similar. APEG [42] studied the automatic exploitation of real software vulnerabilities for the first time, but APEG needs software that contains vulnerabilities and a relatively patched version. Exploits generated by APEG can only trigger vulnerabilities. AEG [43] and Mayhem [44] are both end-to-end systems that can fully exploit vulnerabilities. The former relies on the source code and the latter only requires binary files. The latter applies concolic symbolic execution and index-based memory modeling. FLOWSTITCH [45] first proposed a model based on data-flow stitching, which can generate valid inputs to bypass DEP, CFI, and even ASLR mitigations. The Q [46] scheme is based on ROP and uses a small amount of unrandomized code to automatically generate an ROP chain, which can effectively bypass W@X and ASLR mitigations. For heap vulnerabilities, one of the most difficult vulnerabilities to exploit, [47; 48; 49; 50] each proposed their own solutions. [PERSON] [47] is able to explore exploitable states that are different from the crash path based on the PoC. HeapHopper [48] is based on model checking and symbolic execution and it can automatically analyze the exploitability of the heap implementation in the case of memory corruption. SHRIKE [49] can automatically arrange a heap layout on the PHP interpreter and perform control-flow hijacking. ARCHHEAP [50] can systematically search undeveloped heap exploit primitives without considering their underlying implementations. **Kernel vulnerability exploitation. ** This paper refers to previous research on two aspects, which are not the focus of this paper. The first bypasses mainstream mitigation mechanisms such as SMAP, SMEP, and KASLR [19; 51; 52]. The second applies the follow-up exploitation stage after determining the triggering type of the race vulnerability [13; 14; 15; 53; 54; 55]. Next, we introduce the existing techniques for kernel vulnerabilities. Refs. [14; 53; 54] each proposed new exploitation techniques, among which [PERSON] [14] discovered a new ROP construction method for vulnerabilities that can only hijack the control flow once. Ref. [53] used the shared space physmap between the kernel space and user space to bypass SMAP and SMEP mitigations. Ref. [54] proposed a new kernel heap-spraying mechanism for when the physmap page is not executable. Refs. [19; 51; 52] studied how to bypass the kernel address space layout randomization. ELOISE [19] used an elastic object in the kernel. Refs. [51; 52] used the side-channel technique to leak the kernel address. Ref. [55] proposed a deterministic stack-spraying technique and memory-consuming stack-spraying technique to control the uninitialized variables on the kernel stack. FUZE [13] is a framework for facilitating a kernel UAF exploitation and adopts the kernel fuzzing and symbolic execution techniques to explore system calls that are useful for UAF exploitation and mitigation bypassing. [PERSON] [15] modeled three kernel vulnerabilities: UAF, double-free, and 0 OB vulnerabilities. It can identify kernel objects and the corresponding system calls that are useful for heap spraying, and reorganize slabs to obtain the expected slab layout. [PERSON] [16] summarized the challenges in exploiting OOB access vulnerabilities. A new technique for capability-oriented fuzzing was proposed to search for certain capabilities. Symbolic tracing was used to automatically analyze 0 OB vulnerabilities and identify the appropriate target objects. The process of locating race points in this paper is similar to that of FUZE [13], but FUZE aims at exploiting UAF vulnerabilities. Memory allocation points and release points can be located according to the KASAN warning report. However, there is no existing tool for locating race points.