Ret2page - The Art of Exploiting Use-After-Free Vulnerabilities in the Dedicated Cache

Explore a groundbreaking exploitation technique called "Ret2page" in this 35-minute Black Hat conference talk. Delve into the intricacies of taming both SLUB and BUDDY allocators to reduce time and memory consumption while improving physical page reuse success rates. Analyze two typical Use-After-Free vulnerabilities fixed in the previous year to evaluate Ret2page's effectiveness compared to cross-cache attack techniques. Learn how to exploit these vulnerabilities, bypass general mitigations like KASLR and PAN, and construct universal Android rooting solutions to achieve arbitrary kernel memory read/write capabilities and gain root privileges.

Ret2page: The Art of Exploiting Use-After-Free Vulnerabilities in the Dedicated Cache