CROSS CACHE ATTACK CHEATSHEET

Summary from the TLDR InfoSec newsletter

This article describes a technique called "cross-cache attack" in Linux kernel exploitation that allows transferring a Use-After-Free (UAF) vulnerability from one object to another, even if they're allocated from different slabs. The attack involves a five-step process: spraying object-A sharing a slab with object-V, allocating a victim object-V, freeing object-V, freeing specific objects to trigger slab recycling through the buddy system, and finally spraying object-B to overlap with the freed object-V's memory. The article provides detailed code examples and experimental results, including a timing-based technique called SLUBStick that helps determine the state of slab allocation in the kernel.