Linux Kernel Double-Fetch Race Condition & KASAN Memory Debugging

Vulnerability Overview Vulnerability Type: Double-Fetch Race Condition in the Linux kernel. Cause: When kernel modules process user-space data, they execute (read) operations on the same data twice. Between these two reads, the user-space data may be modified, causing the kernel to make decisions based on inconsistent data, which can lead to logic errors or crashes. Trigger Method: By interacting with the kernel via a custom kernel module and modifying the user buffer between the two fetches. Scope of Impact Affected Components: The Linux kernel and kernel modules that rely on user-space data (e.g., handling paths). Impact: - May cause kernel crashes (Kernel Crash / Panic). - Under specific configurations, it can be exploited for local privilege escalation or system instability. - The document notes that this issue was reproduced on ARM64 platforms. Remediation 1. Code-Level Fixes: - Avoid repeated / operations on the same user data within critical paths. - Copy the data into a kernel buffer in a single operation before processing, or complete it in one call. 2. Using KASAN (Kernel Address Sanitizer): - Enabling KASAN during kernel compilation allows for automatic detection of memory errors, including inconsistencies caused by double-fetch. - The document provides the complete build process for enabling KASAN on ARM64 (see the code block below). POC / Exploitation Code 1. Approach to Triggering Double-Fetch (Pseudocode) 2. Kernel Build Commands for Enabling KASAN (ARM64) 3. Common Build Errors and Solutions 4. KASAN Detection Principle (Brief) KASAN tracks the access status of each byte using Shadow Memory. When an illegal access is detected (such as use-after-free or inconsistencies caused by double-fetch), it prints a detailed call stack, facilitating issue localization. Summary This page describes a Double-Fetch race condition vulnerability in the Linux kernel and provides a complete workflow for memory error detection using KASAN. The core remediation strategy is to avoid redundant reads of user data, or to use KASAN to assist in locating and verifying the fix.

Goal Reached Thanks to every supporter — we hit 100%!

Linux Kernel Double-Fetch Race Condition & KASAN Memory Debugging