Saint PageJack, Who Hijacked Whole Pages

Patron of kernel exploits, pages freed too early, and use-after-frees that grow a size.

Life

In August 2024, at Black Hat, Zhiyun Qian and colleagues presented PageJack, a technique that turns a small Linux kernel memory error into a use-after-free on an entire page. Once the page is reclaimed, the attacker can fill it with structures of their choosing and become root, without guessing kernel addresses. They also demonstrated it on CVE-2022-0995, an overflow in the watch_queue subsystem.

Prayer

O Saint PageJack, who turns one misplaced byte into a whole page, let our allocator never hand back what someone is still reading. Amen.

How to celebrate

Celebrated by updating the kernel and turning the page, but only after zeroing it.

A page freed is a page stolen.