# ERACE: Toward Facilitating Exploit Generation for Kernel Race Vulnerabilities
## 8 Conclusions  
In this paper, we show that it is challenging to exploit kernel race vulnerabilities. Aiming to address the problem of the exploiting process taking considerable time and requiring extremely high professional knowledge, we developed ERACE, an effective framework for facilitating the process of exploiting kernel race vulnerabilities. To be more specific, we introduce the implementation of ERACE. The race-point detector uses low-level virtual machine (LLVM) static analysis to search for all possible race instruction pairs and kcov [17] to dynamically record the execution path of the PoC. The vulnerability analyzer uses the instrumentation mechanism to identify the timing relationships among the race instructions, uses static analysis to identify the triggering type of the vulnerability, and records the vulnerability context. The checkpoint detector uses LLVM static analysis to identify the checkpoints and records the system calls to which the checkpoints belong. Finally, based on the vulnerability information collected above, we finish generating the exploit.  
We choose 23 real-world kernel race vulnerabilities to demonstrate the utility of ERACE. We successfully detect the race points of 19 vulnerabilities, the timing relationships among the race instructions, and the triggering types of 17 vulnerabilities, and assist in generating exploits for 13 vulnerabilities. Based on these findings, we can safely conclude that ERACE can effectively help security researchers simplify the analysis process of kernel race vulnerabilities, select appropriate exploitation methods, and use checkpoints to increase the success rates of exploitations. Furthermore, the relaxed alias analysis also helps to identify more race candidates, which may be beneficial for detecting race vulnerabilities.  
In the future, we will extend the functionality of ERACE to adapt to more scenarios. First, when identifying race points, we did not perform lockset-based analysis on the alias variables, which may have led to false positives. ERACE uses dynamic execution paths to filter out unexecuted race instructions to reduce false positives. By performing lockset-based analysis, we can exclude race instructions with correct locking, further reduce false alarms, and reduce manual analysis. For example, refs. [57; 58; 59] each applied lockset-based analysis to detect data race vulnerabilities. Second, ERACE is only suitable for single-variable race vulnerabilities. For multi-variable race vulnerabilities, the execution order of the race instructions is so complicated that it was impossible for ERACE to identify the exact timing relationships. Next, we will improve ERACE to enable it to analyze multi-variable race vulnerabilities.  
Conceptualization, D.L. and P.W.; methodology, D.L.; software, D.L.; validation, P.W., X.Z. and B.W.; formal analysis, B.W.; investigation, D.L.; resources, X.Z.; data curation, X.Z.; writing--original draft preparation, D.L.; writing--review and editing, D.L.; visualization, P.W.; supervision, X.Z.; project administration, X.Z. All authors have read and agreed to the published version of the manuscript.  
This work was supported by the Natural Science Foundation of China (61902412, 61902405, 62272472)), the National High-Level Personnel for Defense Technology Program (2017-JCJQ-ZQ-013), the Natural Science Foundation of Hunan Province of China under grant no. 2021 JJ40692, and the Research Project of the National University of Defense Technology (ZK20-17, ZK20-09).  
Not applicable.  
The authors declare no conflict of interest.