Linux kernel exploitation: from user to ring 0

The kernel is the most privileged layer: a bug there (in a syscall, a driver, networking) lets an unprivileged process gain kernel-mode execution and become root.

The classes and mitigations

Typical bugs: use-after-free and overflows in the slab (kmalloc), race conditions (the famous Dirty COW/Dirty Pipe), null-deref. The goal is often overwriting the process's cred or hijacking a kernel function pointer.

Kernel defences: KASLR (randomizes the base), SMEP/SMAP (kernel does not execute/read userland memory), KPTI, stack canary. Modern exploits use leaks to beat KASLR and techniques like cross-cache or kernel ROP.

// classic goal: commit_creds(prepare_kernel_cred(0)) -> root

Defence

Timely patching (kernel bugs go public fast), enable all mitigations, reduce the surface (block unneeded syscalls with seccomp, unnecessary modules), namespaces/lockdown, and kernel hardening (grsecurity-like, KSPP). Less exposed kernel code, fewer reachable bugs.