# ERACE: Toward Facilitating Exploit Generation for Kernel Race Vulnerabilities
## 6 Evaluation
### Effectiveness  
This section mainly tests the effectiveness of ERACE in facilitating the process of exploiting the race vulnerability (see Table 2 for the experimental results). In general, ERACE can effectively help researchers generate exploits, and the identified checkpoints can increase the success rate of the privilege escalation. \begin{table}
\begin{tabular}{c c c c c} \hline \hline \multirow{2}{*}{**CVE**} & \multirow{2}{*}{**\# of Checkpoints**} & \multirow{2}{*}{**Public Exploit**} & \multicolumn{2}{c}{**Generated Exploit**} \\ \cline{3-5}  & & & **Without** & **Use** \\  & & & **Checkpoints** & **Checkpoints** \\ \hline CVE-2015-8550 & ✗ & ✗ & ✗ & ✗ \\ \hline CVE-2016-6516 & 4 & ✗ & ✗ & ✗ \\ \hline CVE-2016-8655 & 22 & ✓ & ✗ & ✓ \\ \hline CVE-2017-10661 & 2 & ✗ & ✗ & ✓ \\ \hline CVE-2017-11176 & 35 & ✓ & ✗ & ✓ \\ \hline \hline \end{tabular}
\end{table} 
Table 2: Effectiveness of ERACE. # of checkpoints indicates the number of checkpoints ERACE could find. We compare whether the exploit succeeded in escaping privilege by using and not using checkpoints. ✗ means it has no checkpoints or public exploit, or it fails to exploit the vulnerability. ✓ means it has public exploit or it succeeds in exploiting the vulnerability. Among these 23 vulnerabilities, exploits of only 3 vulnerabilities were publicly available and ERACE helped 13 vulnerabilities to achieve exploitation. We found a total of 294 checkpoints in the modules where the 23 vulnerabilities were located, which can be used by researchers to check whether race conditions or heap spraying has been satisfied. Among the 13 successfully exploited vulnerabilities, we compared whether the vulnerabilities could be successfully exploited by using and not using checkpoints. We found that eight of them could not be successfully exploited without using checkpoints. This shows that it is necessary to consider the use of checkpoints when exploiting race vulnerabilities. If heap spraying is performed without confirming whether the race condition has been satisfied, it consumes a limited amount of heap-spraying space and time and also makes the system unstable. Then, if it goes to the next exploitation stage without confirming whether the heap spraying has succeeded, it will further reduce the exploitation success rate. There were five vulnerabilities that were successfully exploited without using checkpoints, namely CVE-2017-15265, CVE-2019-18683, 2021-26708, 7341 [23], and e010 [27]. As fewer checkpoints were identified in the modules where the three vulnerabilities were located, no suitable checkpoints could help to exploit these three vulnerabilities. The main reason is that some kernel modules are implemented with less code and fewer functionalities and they contain fewer interfaces for users to access kernel data. We analyzed 10 vulnerabilities that failed the exploitation. Four of them failed because the race point was not identified and the other six failed because their exploit primitives were restricted. For example, CVE-2016-6516 could only overwrite a continuous 12 bytes to 0, but modifying the credentials required 28 bytes to escalate privilege. Hence, we could not exploit the vulnerability at the time. We also made some interesting discoveries. The CVE-2016-8655