{"status":"ok","message-type":"work","message-version":"1.0.0","message":{"indexed":{"date-parts":[[2026,7,2]],"date-time":"2026-07-02T16:20:08Z","timestamp":1783009208503,"version":"3.54.5"},"publisher-location":"New York, NY, USA","reference-count":77,"publisher":"ACM","license":[{"start":{"date-parts":[[2024,11,21]],"date-time":"2024-11-21T00:00:00Z","timestamp":1732147200000},"content-version":"vor","delay-in-days":372,"URL":"http:\/\/www.acm.org\/publications\/policies\/copyright_policy#Background"}],"funder":[{"DOI":"10.13039\/100000185","name":"Defense Advanced Research Projects Agency","doi-asserted-by":"publisher","award":["HR001118C0060, FA8750-19C-0003, N66001-22-C-4026"],"award-info":[{"award-number":["HR001118C0060, FA8750-19C-0003, N66001-22-C-4026"]}],"id":[{"id":"10.13039\/100000185","id-type":"DOI","asserted-by":"publisher"}]},{"DOI":"10.13039\/100000001","name":"National Science Foundation","doi-asserted-by":"publisher","award":["CNS-2000792"],"award-info":[{"award-number":["CNS-2000792"]}],"id":[{"id":"10.13039\/100000001","id-type":"DOI","asserted-by":"publisher"}]},{"DOI":"10.13039\/100006785","name":"Google","doi-asserted-by":"publisher","award":["2023 Google PhD Fellowship Program"],"award-info":[{"award-number":["2023 Google PhD Fellowship Program"]}],"id":[{"id":"10.13039\/100006785","id-type":"DOI","asserted-by":"publisher"}]}],"content-domain":{"domain":["dl.acm.org"],"crossmark-restriction":true},"short-container-title":[],"published-print":{"date-parts":[[2023,11,15]]},"DOI":"10.1145\/3576915.3623220","type":"proceedings-article","created":{"date-parts":[[2023,11,21]],"date-time":"2023-11-21T12:35:13Z","timestamp":1700570113000},"page":"3093-3107","update-policy":"https:\/\/doi.org\/10.1145\/crossmark-policy","source":"Crossref","is-referenced-by-count":11,"title":["RetSpill: Igniting User-Controlled Data to Burn Away Linux Kernel Protections"],"prefix":"10.1145","author":[{"ORCID":"https:\/\/orcid.org\/0000-0003-0205-7580","authenticated-orcid":false,"given":"Kyle","family":"Zeng","sequence":"first","affiliation":[{"name":"Arizona State University, Tempe, AZ, USA"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"ORCID":"https:\/\/orcid.org\/0000-0003-3593-4615","authenticated-orcid":false,"given":"Zhenpeng","family":"Lin","sequence":"additional","affiliation":[{"name":"Northwestern University, Evanston, IN, USA"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"ORCID":"https:\/\/orcid.org\/0000-0002-4763-7354","authenticated-orcid":false,"given":"Kangjie","family":"Lu","sequence":"additional","affiliation":[{"name":"University of Minnesota, Minneapolis, MN, USA"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"ORCID":"https:\/\/orcid.org\/0000-0001-6733-226X","authenticated-orcid":false,"given":"Xinyu","family":"Xing","sequence":"additional","affiliation":[{"name":"Northwestern University, Evanston, IL, USA"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"ORCID":"https:\/\/orcid.org\/0000-0003-1524-2566","authenticated-orcid":false,"given":"Ruoyu","family":"Wang","sequence":"additional","affiliation":[{"name":"Arizona State University, Tempe, AZ, USA"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"ORCID":"https:\/\/orcid.org\/0000-0003-2634-3901","authenticated-orcid":false,"given":"Adam","family":"Doup\u00e9","sequence":"additional","affiliation":[{"name":"Arizona State University, Tempe, AZ, USA"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"ORCID":"https:\/\/orcid.org\/0000-0001-8832-1789","authenticated-orcid":false,"given":"Yan","family":"Shoshitaishvili","sequence":"additional","affiliation":[{"name":"Arizona State University, Tempe, AZ, USA"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"ORCID":"https:\/\/orcid.org\/0000-0001-6424-0001","authenticated-orcid":false,"given":"Tiffany","family":"Bao","sequence":"additional","affiliation":[{"name":"Arizona State University, Tempe, AZ, USA"}],"role":[{"vocabulary":"crossref","role":"author"}]}],"member":"320","published-online":{"date-parts":[[2023,11,21]]},"reference":[{"key":"e_1_3_2_1_1_1","unstructured":"sefcom\/kheaps. https:\/\/github.com\/sefcom\/KHeaps\/blob\/master\/exploit _env\/ CVEs\/CVE-2017-7533\/poc\/poc_cfh_combo.c."},{"key":"e_1_3_2_1_2_1","unstructured":"angr team. angr\/angrop. https:\/\/github.com\/angr\/angrop."},{"key":"e_1_3_2_1_3_1","doi-asserted-by":"publisher","DOI":"10.1145\/1966913.1966919"},{"key":"e_1_3_2_1_4_1","doi-asserted-by":"publisher","DOI":"10.5555\/647253.720278"},{"key":"e_1_3_2_1_5_1","first-page":"1093","volume-title":"29th USENIX Security Symposium (USENIX Security 20)","author":"Chen Weiteng","year":"2020","unstructured":"Weiteng Chen, Xiaochen Zou, Guoren Li, and Zhiyun Qian. {KOOBE}: Towards facilitating exploit generation of kernel {Out-Of-Bounds} write vulnerabilities. In 29th USENIX Security Symposium (USENIX Security 20), pages 1093--1110, 2020."},{"key":"e_1_3_2_1_6_1","doi-asserted-by":"publisher","DOI":"10.1145\/3372297.3423353"},{"key":"e_1_3_2_1_7_1","doi-asserted-by":"publisher","DOI":"10.1145\/3319535.3363212"},{"key":"e_1_3_2_1_8_1","volume-title":"14th USENIX Workshop on Offensive Technologies (WOOT 20)","author":"Cho Haehyun","year":"2020","unstructured":"Haehyun Cho, Jinbum Park, Joonwon Kang, Tiffany Bao, Ruoyu Wang, Yan Shoshitaishvili, Adam Doup\u00e9, and Gail-Joon Ahn. Exploiting uses of uninitialized stack variables in linux kernels to leak kernel pointers. In 14th USENIX Workshop on Offensive Technologies (WOOT 20), 2020."},{"key":"e_1_3_2_1_9_1","doi-asserted-by":"publisher","DOI":"10.1145\/3545948.3545997"},{"key":"e_1_3_2_1_10_1","volume-title":"Kernel address space layout randomization. https:\/\/lwn.net\/Articles\/ 546035\/","author":"Cook Kees","year":"2013","unstructured":"Kees Cook. Kernel address space layout randomization. https:\/\/lwn.net\/Articles\/ 546035\/, 2013."},{"key":"e_1_3_2_1_11_1","volume-title":"Hardened usercopy. https:\/\/lwn.net\/Articles\/693745\/","author":"Cook Kees","year":"2016","unstructured":"Kees Cook. Hardened usercopy. https:\/\/lwn.net\/Articles\/693745\/, 2016."},{"key":"e_1_3_2_1_12_1","volume-title":"Supervisor mode access prevention. https:\/\/lwn.net\/Articles\/ 517475\/","author":"Corbet Jonathan","year":"2012","unstructured":"Jonathan Corbet. Supervisor mode access prevention. https:\/\/lwn.net\/Articles\/ 517475\/, 2012."},{"key":"e_1_3_2_1_13_1","volume-title":"Practical return-oriented programming. Source boston","author":"Zovi Dino Dai","year":"2010","unstructured":"Dino Dai Zovi. Practical return-oriented programming. Source boston, 2010."},{"key":"e_1_3_2_1_14_1","doi-asserted-by":"publisher","DOI":"10.14722\/ndss.2017.23421"},{"key":"e_1_3_2_1_15_1","volume-title":"Exploitation of a double free vulnerability in ubuntu shiftfs driver. https:\/\/www.synacktiv.com\/en\/publications\/exploitation-of-a-double-free-vulnerability-in-ubuntu-shiftfs-driver-cve-2021-3492.html","author":"Dehors Vincent","year":"2021","unstructured":"Vincent Dehors. Exploitation of a double free vulnerability in ubuntu shiftfs driver. https:\/\/www.synacktiv.com\/en\/publications\/exploitation-of-a-double-free-vulnerability-in-ubuntu-shiftfs-driver-cve-2021-3492.html, 2021."},{"key":"e_1_3_2_1_16_1","doi-asserted-by":"publisher","DOI":"10.1109\/DAC18072.2020.9218535"},{"key":"e_1_3_2_1_17_1","volume-title":"stack: Introduce config_randomize_kstack_offset. https: \/\/lore.kernel.org\/lkml\/YfQ54x8zglPT%2FYnL@dev-arch.archlinux-ax161\/t\/#u","author":"Elver Marco","year":"2022","unstructured":"Marco Elver. stack: Introduce config_randomize_kstack_offset. https: \/\/lore.kernel.org\/lkml\/YfQ54x8zglPT%2FYnL@dev-arch.archlinux-ax161\/t\/#u, 2022."},{"key":"e_1_3_2_1_18_1","unstructured":"Nicolas FABRETTI. Cve-2017-11176: A step-by-step linux kernel exploitation. https:\/\/blog.lexfo.fr\/cve-2017-11176-linux-kernel-exploitation-part4.html."},{"key":"e_1_3_2_1_19_1","volume-title":"Will's root: Cve-2022-0185. https:\/\/www.willsroot.io\/2022\/01\/cve-2022-0185.html","year":"2022","unstructured":"FizzBuzz101. Will's root: Cve-2022-0185. https:\/\/www.willsroot.io\/2022\/01\/cve-2022-0185.html, 2022."},{"key":"e_1_3_2_1_20_1","doi-asserted-by":"publisher","DOI":"10.1109\/EuroSP.2016.24"},{"key":"e_1_3_2_1_21_1","doi-asserted-by":"publisher","DOI":"10.1145\/3372297.3417289"},{"key":"e_1_3_2_1_22_1","unstructured":"Google. Kernel control flow integrity. https:\/\/source.android.com\/docs\/security\/ test\/kcfi."},{"key":"e_1_3_2_1_23_1","unstructured":"Google. Kernel exploit recipes notebook -google docs. https:\/\/docs.google.com\/ document\/d\/1a9uUAISBzw3ur1aLQqKc5JOQLaJYiOP5pe_B4xCT1KA\/edit#."},{"key":"e_1_3_2_1_24_1","unstructured":"Grimm. Notquite0dayfriday\/2021.03.12-linux-iscsi at trunk \u00b7 grimm-co\/notquite0dayfriday. https:\/\/github.com\/grimm-co\/NotQuite0DayFriday\/tree\/ trunk\/2021.03.12-linux-iscsi."},{"key":"e_1_3_2_1_25_1","doi-asserted-by":"publisher","DOI":"10.1007\/978-3-319-62105-0_11"},{"key":"e_1_3_2_1_26_1","volume-title":"Return-oriented programming in risc-v. arXiv preprint arXiv:2007.14995","author":"Gu Garrett","year":"2020","unstructured":"Garrett Gu and Hovav Shacham. Return-oriented programming in risc-v. arXiv preprint arXiv:2007.14995, 2020."},{"key":"e_1_3_2_1_27_1","volume-title":"Detecting a container escape with cilium and ebpf - isovalent. https: \/\/isovalent.com\/blog\/post\/2021-11-container-escape\/","year":"2021","unstructured":"Isovalent. Detecting a container escape with cilium and ebpf - isovalent. https: \/\/isovalent.com\/blog\/post\/2021-11-container-escape\/, 2021."},{"key":"e_1_3_2_1_28_1","doi-asserted-by":"publisher","DOI":"10.1145\/3243734.3243739"},{"key":"e_1_3_2_1_29_1","volume-title":"Cve-2022--29582: An io_uring vulnerability. https: \/\/ruia-ruia.github.io\/2022\/08\/05\/CVE-2022-29582-io-uring\/","author":"Jayden Rivers David Bouman","year":"2022","unstructured":"David Bouman Jayden Rivers. Cve-2022--29582: An io_uring vulnerability. https: \/\/ruia-ruia.github.io\/2022\/08\/05\/CVE-2022-29582-io-uring\/, 2022."},{"key":"e_1_3_2_1_30_1","volume-title":"Monitoring surveillance vendors: A deep dive into in-the-wild android full chains","author":"Jin Xingyu","year":"2021","unstructured":"Xingyu Jin, Christian Resell, Clement Lecigne, and Neal Richard. Monitoring surveillance vendors: A deep dive into in-the-wild android full chains in 2021. https:\/\/i.blackhat.com\/USA-22\/Wednesday\/US-22-Jin-Monitoring-Surveillance-Vendors.pdf, 2022."},{"key":"e_1_3_2_1_31_1","first-page":"957","volume-title":"23rd USENIX Security Symposium (USENIX Security","author":"Kemerlis Vasileios P","year":"2014","unstructured":"Vasileios P Kemerlis, Michalis Polychronakis, and Angelos D Keromytis. ret2dir: Rethinking kernel isolation. In 23rd USENIX Security Symposium (USENIX Security, pages 957--972, 2014."},{"key":"e_1_3_2_1_32_1","first-page":"459","volume-title":"21st USENIX Security Symposium (USENIX Security 12)","author":"Kemerlis Vasileios P","year":"2012","unstructured":"Vasileios P Kemerlis, Georgios Portokalidis, and Angelos D Keromytis. {kGuard}: Lightweight kernel protection against {Return-to-User} attacks. In 21st USENIX Security Symposium (USENIX Security 12), pages 459--474, 2012."},{"key":"e_1_3_2_1_33_1","unstructured":"Andrey Konovalov. Project zero: Exploiting the linux kernel via packet sockets. https:\/\/googleprojectzero.blogspot.com\/2017\/05\/exploiting-linux-kernel-via-packet.html."},{"key":"e_1_3_2_1_34_1","volume-title":"Function granular kaslr [lwn.net]. https:\/\/lwn.net\/Articles\/832434\/","author":"Kristen Carlson Accardi Alexander Lobakin","year":"2020","unstructured":"Alexander Lobakin Kristen Carlson Accardi. Function granular kaslr [lwn.net]. https:\/\/lwn.net\/Articles\/832434\/, 2020."},{"key":"e_1_3_2_1_35_1","volume-title":"Introduce static_usermodehelper to mediate call_usermodehelper() - patchwork. https:\/\/lore.kernel.org\/all\/ 20170116165044.GC29693@kroah.com\/","author":"Kroah-Hartman Greg","year":"2017","unstructured":"Greg Kroah-Hartman. Introduce static_usermodehelper to mediate call_usermodehelper() - patchwork. https:\/\/lore.kernel.org\/all\/ 20170116165044.GC29693@kroah.com\/, 2017."},{"key":"e_1_3_2_1_36_1","doi-asserted-by":"publisher","DOI":"10.1007\/978-3-319-95174-4_10"},{"key":"e_1_3_2_1_37_1","unstructured":"Dang Le. Learning linux kernel exploitation - part 1. https:\/\/lkmidas.github.io\/ posts\/20210123-linux-kernel-pwn-part-1\/#the-simplest-exploit-ret2usr."},{"key":"e_1_3_2_1_38_1","volume-title":"Learning linux kernel exploitation - part 3 - midas blog. https:\/\/ lkmidas.github.io\/posts\/20210205-linux-kernel-pwn-part-3\/","author":"Le Dang","year":"2021","unstructured":"Dang Le. Learning linux kernel exploitation - part 3 - midas blog. https:\/\/ lkmidas.github.io\/posts\/20210205-linux-kernel-pwn-part-3\/, 2021."},{"key":"e_1_3_2_1_39_1","first-page":"2363","volume-title":"30th USENIX Security Symposium (USENIX Security 21)","author":"Lee Yoochan","year":"2021","unstructured":"Yoochan Lee, Changwoo Min, and Byoungyoung Lee. {ExpRace}: Exploiting kernel races through raising interrupts. In 30th USENIX Security Symposium (USENIX Security 21), pages 2363--2380, 2021."},{"key":"e_1_3_2_1_40_1","volume-title":"How autoslab changes the memory unsafety game. https:\/\/ grsecurity.net\/how_autoslab_changes_the_memory_unsafety_game","author":"Lin Zhenpeng","year":"2021","unstructured":"Zhenpeng Lin. How autoslab changes the memory unsafety game. https:\/\/ grsecurity.net\/how_autoslab_changes_the_memory_unsafety_game, 2021."},{"key":"e_1_3_2_1_41_1","first-page":"2078","volume-title":"Kang Li. GREBE: Unveiling Exploitation Potential for Linux Kernel Bugs. In 2022 IEEE Symposium on Security and Privacy (S&P)","author":"Lin Zhenpeng","year":"2022","unstructured":"Zhenpeng Lin, Yueqi Chen, Yuhang Wu, Dongliang Mu, Chensheng Yu, Xinyu Xing, and Kang Li. GREBE: Unveiling Exploitation Potential for Linux Kernel Bugs. In 2022 IEEE Symposium on Security and Privacy (S&P), pages 2078--2095. IEEE, 2022."},{"key":"e_1_3_2_1_42_1","doi-asserted-by":"publisher","DOI":"10.1145\/3548606.3560585"},{"key":"e_1_3_2_1_43_1","volume-title":"Pax - structleak. https:\/\/linxz.tech\/post\/compilers\/2021-10-10-structleak\/","year":"2021","unstructured":"Linxz. Pax - structleak. https:\/\/linxz.tech\/post\/compilers\/2021-10-10-structleak\/, 2021."},{"key":"e_1_3_2_1_44_1","doi-asserted-by":"publisher","DOI":"10.1145\/2976749.2978366"},{"key":"e_1_3_2_1_45_1","doi-asserted-by":"publisher","DOI":"10.14722\/ndss.2017.23387"},{"key":"e_1_3_2_1_46_1","volume-title":"Turning \\x00\\x00 into 10000$ | security-research. https:\/\/google.github.io\/security-research\/pocs\/linux\/cve-2021-22555\/ writeup.html","author":"Nguyen Andy","year":"2021","unstructured":"Andy Nguyen. Cve-2021--22555: Turning \\x00\\x00 into 10000$ | security-research. https:\/\/google.github.io\/security-research\/pocs\/linux\/cve-2021-22555\/ writeup.html, 2021."},{"key":"e_1_3_2_1_47_1","unstructured":"OSDev.org. Supervisor memory protection - osdev wiki. https:\/\/wiki.osdev.org\/ Supervisor_Memory_Protection."},{"key":"e_1_3_2_1_48_1","doi-asserted-by":"publisher","DOI":"10.1145\/3064176.3064216"},{"key":"e_1_3_2_1_49_1","volume-title":"Cve-2017-2636: Exploit the race condition in the n_hdlc linux kernel driver. https:\/\/a13xp0p0v.github.io\/2017\/03\/24\/CVE-2017-2636.html","author":"Popov Alexander","year":"2017","unstructured":"Alexander Popov. Cve-2017-2636: Exploit the race condition in the n_hdlc linux kernel driver. https:\/\/a13xp0p0v.github.io\/2017\/03\/24\/CVE-2017-2636.html, 2017."},{"key":"e_1_3_2_1_50_1","unstructured":"Alexander Popov. Stackleak: A long way to the linux kernel mainline. https: \/\/events19.linuxfoundation.org\/wp-content\/uploads\/2017\/11\/STACKLEAK-A-Long-Way-to-the-Linux-Kernel-Mainline-Alexander-Popov-Positive-Technologies.pdf 2018."},{"key":"e_1_3_2_1_51_1","volume-title":"security: allow using clang's zero initialization for stack variables. https:\/\/lwn.net\/Articles\/823152\/","author":"Potapenko Alexander","year":"2020","unstructured":"Alexander Potapenko. security: allow using clang's zero initialization for stack variables. https:\/\/lwn.net\/Articles\/823152\/, 2020."},{"key":"e_1_3_2_1_52_1","doi-asserted-by":"publisher","DOI":"10.1109\/SP40000.2020.00041"},{"key":"e_1_3_2_1_53_1","volume-title":"randomize kernel stack offset upon syscall. https:\/\/lwn.net\/ Articles\/785484\/","author":"Reshetova Elena","year":"2019","unstructured":"Elena Reshetova. randomize kernel stack offset upon syscall. https:\/\/lwn.net\/ Articles\/785484\/, 2019."},{"key":"e_1_3_2_1_54_1","volume-title":"Kernote writeup. https:\/\/org.anize.rs\/0CTF-2021-finals\/pwn\/ kernote","author":"Rizzo Matteo","year":"2021","unstructured":"Matteo Rizzo. Kernote writeup. https:\/\/org.anize.rs\/0CTF-2021-finals\/pwn\/ kernote, 2021."},{"key":"e_1_3_2_1_55_1","doi-asserted-by":"publisher","DOI":"10.1007\/s11416-017-0299-1"},{"key":"e_1_3_2_1_56_1","volume-title":"Real-time kernel protection (rkp). https:\/\/www.samsungknox.com\/ en\/blog\/real-time-kernel-protection-rkp","year":"2016","unstructured":"Samsung. Real-time kernel protection (rkp). https:\/\/www.samsungknox.com\/ en\/blog\/real-time-kernel-protection-rkp, 2016."},{"key":"e_1_3_2_1_57_1","volume-title":"20th USENIX Security Symposium (USENIX Security 11)","author":"Schwartz Edward J","year":"2011","unstructured":"Edward J Schwartz, Thanassis Avgerinos, and David Brumley. Q: Exploit hardening made easy. In 20th USENIX Security Symposium (USENIX Security 11), 2011."},{"key":"e_1_3_2_1_58_1","doi-asserted-by":"publisher","DOI":"10.1145\/3372297.3417234"},{"key":"e_1_3_2_1_59_1","doi-asserted-by":"publisher","DOI":"10.1109\/SP.2013.45"},{"key":"e_1_3_2_1_60_1","volume-title":"Kcfi support [lwn.net]. https:\/\/lwn.net\/Articles\/893164\/","author":"Tolvanen Sami","year":"2022","unstructured":"Sami Tolvanen. Kcfi support [lwn.net]. https:\/\/lwn.net\/Articles\/893164\/, 2022."},{"key":"e_1_3_2_1_61_1","unstructured":"Linus Torvalds. Kernel stack documentation. https:\/\/docs.kernel.org\/x86\/kernel-stacks.html."},{"key":"e_1_3_2_1_62_1","volume-title":"Linux kernel calling convention source code. https:\/\/ elixir.bootlin.com\/linux\/v5.17\/source\/arch\/x86\/entry\/calling.h#L18","author":"Torvalds Linus","unstructured":"Linus Torvalds. Linux kernel calling convention source code. https:\/\/ elixir.bootlin.com\/linux\/v5.17\/source\/arch\/x86\/entry\/calling.h#L18."},{"key":"e_1_3_2_1_63_1","unstructured":"Linus Torvalds. native_write_cr4. https:\/\/elixir.bootlin.com\/linux\/v6.0\/source\/ arch\/x86\/kernel\/cpu\/common.c#L447."},{"key":"e_1_3_2_1_64_1","unstructured":"Linus Torvalds. Page table isolation (pti) documentation. https:\/\/www.kernel.org\/ doc\/html\/latest\/x86\/pti.html."},{"key":"e_1_3_2_1_65_1","volume-title":"Linux kernel source: arch\/x86\/include\/asm\/ptrace.h. https: \/\/elixir.bootlin.com\/linux\/v5.17\/source\/arch\/x86\/include\/asm\/ptrace.h#L59","author":"Torvalds Linux","unstructured":"Linux Torvalds. Linux kernel source: arch\/x86\/include\/asm\/ptrace.h. https: \/\/elixir.bootlin.com\/linux\/v5.17\/source\/arch\/x86\/include\/asm\/ptrace.h#L59."},{"key":"e_1_3_2_1_66_1","unstructured":"Linux Torvalds. Linux kernel source code: fs\/select.c. https:\/\/elixir.bootlin.com\/ linux\/v5.17\/source\/fs\/select.c#L982."},{"key":"e_1_3_2_1_67_1","unstructured":"Linux Torvalds. Linux kernel source: fs\/read_write.c. https:\/\/elixir.bootlin.com\/ linux\/v5.17\/source\/fs\/read_write.c#L899."},{"key":"e_1_3_2_1_68_1","first-page":"3753","volume-title":"31st USENIX Security Symposium (USENIX Security 22)","author":"Wang Lun","year":"2022","unstructured":"Lun Wang, Usmann Khan, Joseph Near, Qi Pang, Jithendaraa Subramanian, Neel Somani, Peng Gao, Andrew Low, and Dawn Song. {PrivGuard}: Privacy regulation compliance made easier. In 31st USENIX Security Symposium (USENIX Security 22), pages 3753--3770, 2022."},{"key":"e_1_3_2_1_69_1","doi-asserted-by":"publisher","DOI":"10.1109\/ACCESS.2019.2937585"},{"key":"e_1_3_2_1_70_1","first-page":"1187","volume-title":"28th USENIX Security Symposium (USENIX Security 19)","author":"Wu Wei","year":"2019","unstructured":"Wei Wu, Yueqi Chen, Xinyu Xing, and Wei Zou. {KEPLER}: Facilitating control-flow hijacking primitive evaluation for linux kernel vulnerabilities. In 28th USENIX Security Symposium (USENIX Security 19), pages 1187--1204, 2019."},{"key":"e_1_3_2_1_71_1","first-page":"781","volume-title":"27th USENIX Security Symposium (USENIX Security 18)","author":"Wu Wei","year":"2018","unstructured":"Wei Wu, Yueqi Chen, Jun Xu, Xinyu Xing, Xiaorui Gong, and Wei Zou. {FUZE}: Towards facilitating exploit generation for kernel {Use-After-Free} vulnerabilities. In 27th USENIX Security Symposium (USENIX Security 18), pages 781--797, 2018."},{"key":"e_1_3_2_1_72_1","doi-asserted-by":"publisher","DOI":"10.1145\/2076021.2048092"},{"key":"e_1_3_2_1_73_1","first-page":"89","volume-title":"31st USENIX Security Symposium (USENIX Security 22)","author":"Yoo Sungbae","year":"2022","unstructured":"Sungbae Yoo, Jinbum Park, Seolheui Kim, Yeji Kim, and Taesoo Kim. {In-Kernel} {Control-Flow} integrity on commodity {OSes} using {ARM} pointer authentication. In 31st USENIX Security Symposium (USENIX Security 22), pages 89--106, 2022."},{"key":"e_1_3_2_1_74_1","unstructured":"Kyle Zeng. [cve-2022-1786] a journey to the dawn. https:\/\/blog.kylebot.net\/2022\/ 10\/16\/CVE-2022-1786\/."},{"key":"e_1_3_2_1_75_1","first-page":"71","volume-title":"31st USENIX Security Symposium (USENIX Security 22)","author":"Zeng Kyle","year":"2022","unstructured":"Kyle Zeng, Yueqi Chen, Haehyun Cho, Xinyu Xing, Adam Doup\u00e9, Yan Shoshi-taishvili, and Tiffany Bao. Playing for {K (H) eaps}: Understanding and improving linux kernel exploit reliability. In 31st USENIX Security Symposium (USENIX Security 22), pages 71--88, 2022."},{"key":"e_1_3_2_1_76_1","volume-title":"Kernel ibt beginnings. https:\/\/lwn.net\/ml\/linux-kernel\/ 20211122170301.764232470@infradead.org\/","author":"Zijlstra Peter","year":"2021","unstructured":"Peter Zijlstra. [x86: Kernel ibt beginnings. https:\/\/lwn.net\/ml\/linux-kernel\/ 20211122170301.764232470@infradead.org\/, 2021."},{"key":"e_1_3_2_1_77_1","first-page":"3201","volume-title":"31st USENIX Security Symposium (USENIX Security 22)","author":"Zou Xiaochen","year":"2022","unstructured":"Xiaochen Zou, Guoren Li, Weiteng Chen, Hang Zhang, and Zhiyun Qian. SyzS-cope: Revealing High-Risk Security Impacts of Fuzzer-Exposed Bugs in Linux kernel. In 31st USENIX Security Symposium (USENIX Security 22), pages 3201--3217, 2022."}],"event":{"name":"CCS '23: ACM SIGSAC Conference on Computer and Communications Security","location":"Copenhagen Denmark","acronym":"CCS '23","sponsor":["SIGSAC ACM Special Interest Group on Security, Audit, and Control"]},"container-title":["Proceedings of the 2023 ACM SIGSAC Conference on Computer and Communications Security"],"original-title":[],"link":[{"URL":"https:\/\/dl.acm.org\/doi\/10.1145\/3576915.3623220","content-type":"unspecified","content-version":"vor","intended-application":"text-mining"},{"URL":"https:\/\/dl.acm.org\/doi\/pdf\/10.1145\/3576915.3623220","content-type":"application\/pdf","content-version":"vor","intended-application":"syndication"},{"URL":"https:\/\/dl.acm.org\/doi\/pdf\/10.1145\/3576915.3623220","content-type":"unspecified","content-version":"vor","intended-application":"similarity-checking"}],"deposited":{"date-parts":[[2025,8,21]],"date-time":"2025-08-21T01:44:14Z","timestamp":1755740654000},"score":1,"resource":{"primary":{"URL":"https:\/\/dl.acm.org\/doi\/10.1145\/3576915.3623220"}},"subtitle":[],"short-title":[],"issued":{"date-parts":[[2023,11,15]]},"references-count":77,"alternative-id":["10.1145\/3576915.3623220","10.1145\/3576915"],"URL":"https:\/\/doi.org\/10.1145\/3576915.3623220","relation":{},"subject":[],"published":{"date-parts":[[2023,11,15]]},"assertion":[{"value":"2023-11-21","order":3,"name":"published","label":"Published","group":{"name":"publication_history","label":"Publication History"}}]}}