{"status":"ok","message-type":"work","message-version":"1.0.0","message":{"indexed":{"date-parts":[[2026,7,2]],"date-time":"2026-07-02T16:00:30Z","timestamp":1783008030382,"version":"3.54.5"},"publisher-location":"New York, NY, USA","reference-count":64,"publisher":"ACM","content-domain":{"domain":["dl.acm.org"],"crossmark-restriction":true},"short-container-title":[],"published-print":{"date-parts":[[2025,11,19]]},"DOI":"10.1145\/3719027.3744841","type":"proceedings-article","created":{"date-parts":[[2025,11,22]],"date-time":"2025-11-22T23:32:38Z","timestamp":1763854358000},"page":"1499-1513","update-policy":"https:\/\/doi.org\/10.1145\/crossmark-policy","source":"Crossref","is-referenced-by-count":1,"title":["Reviving Discarded Vulnerabilities: Exploiting Previously Unexploitable Linux Kernel Bugs Through Control Metadata Fields"],"prefix":"10.1145","author":[{"ORCID":"https:\/\/orcid.org\/0009-0001-4101-4711","authenticated-orcid":false,"given":"Hao","family":"Zhang","sequence":"first","affiliation":[{"name":"Institute of Information Engineering, Chinese Academy of Sciences, Beijing, China"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"ORCID":"https:\/\/orcid.org\/0000-0002-7557-8347","authenticated-orcid":false,"given":"Jian","family":"Liu","sequence":"additional","affiliation":[{"name":"Institute of Information Engineering, Chinese Academy of Sciences, Beijing, China"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"ORCID":"https:\/\/orcid.org\/0000-0002-4162-0404","authenticated-orcid":false,"given":"Jie","family":"Lu","sequence":"additional","affiliation":[{"name":"Institute of Computing Technology, Chinese Academy of Sciences, Beijing, China"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"ORCID":"https:\/\/orcid.org\/0009-0001-7771-3354","authenticated-orcid":false,"given":"Shaomin","family":"Chen","sequence":"additional","affiliation":[{"name":"Institute of Information Engineering, Chinese Academy of Sciences, Beijing, China"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"ORCID":"https:\/\/orcid.org\/0000-0003-4520-6195","authenticated-orcid":false,"given":"Tianshuo","family":"Han","sequence":"additional","affiliation":[{"name":"Institute of Information Engineering\/Chinese Academy of Sciences, Beijing, China"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"ORCID":"https:\/\/orcid.org\/0009-0003-1287-096X","authenticated-orcid":false,"given":"Bolun","family":"Zhang","sequence":"additional","affiliation":[{"name":"Institute of Information Engineering, Chinese Academy of Sciences, Beijing, China"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"ORCID":"https:\/\/orcid.org\/0009-0005-8203-1496","authenticated-orcid":false,"given":"Xiaorui","family":"Gong","sequence":"additional","affiliation":[{"name":"Institute of Information Engineering, Chinese Academy of Science, Beijing, China"}],"role":[{"vocabulary":"crossref","role":"author"}]}],"member":"320","published-online":{"date-parts":[[2025,11,22]]},"reference":[{"key":"e_1_3_2_1_1_1","unstructured":"Popov Alexander. 2018. Linux Kernel Defence Map. https:\/\/a13xp0p0v.github.io\/2018\/04\/28\/Linux-Kernel-Defence-Map.html Accessed: 2025-01-08."},{"key":"e_1_3_2_1_2_1","doi-asserted-by":"publisher","DOI":"10.4230\/LIPIcs.ECOOP.2016.2"},{"key":"e_1_3_2_1_3_1","first-page":"7141","volume-title":"SCAVY: Automated Discovery of Memory Corruption Targets in Linux Kernel for Privilege Escalation. In 33rd USENIX Security Symposium (USENIX Security 24)","author":"Avllazagaj Erin","year":"2024","unstructured":"Erin Avllazagaj, Yonghwi Kwon, and Tudor Dumitras. 2024. SCAVY: Automated Discovery of Memory Corruption Targets in Linux Kernel for Privilege Escalation. In 33rd USENIX Security Symposium (USENIX Security 24). USENIX Association, Philadelphia, PA, 7141-7158. https:\/\/www.usenix.org\/conference\/usenixsecurity24\/presentation\/avllazagaj"},{"key":"e_1_3_2_1_4_1","doi-asserted-by":"publisher","DOI":"10.5555\/1247360.1247401"},{"key":"e_1_3_2_1_5_1","first-page":"1093","volume-title":"KOOBE: Towards Facilitating Exploit Generation of Kernel Out-Of-Bounds Write Vulnerabilities. In 29th USENIX Security Symposium (USENIX Security 20)","author":"Chen Weiteng","year":"2020","unstructured":"Weiteng Chen, Xiaochen Zou, Guoren Li, and Zhiyun Qian. 2020b. KOOBE: Towards Facilitating Exploit Generation of Kernel Out-Of-Bounds Write Vulnerabilities. In 29th USENIX Security Symposium (USENIX Security 20). USENIX Association, 1093-1110. https:\/\/www.usenix.org\/conference\/usenixsecurity20\/presentation\/chen-weiteng"},{"key":"e_1_3_2_1_6_1","doi-asserted-by":"publisher","DOI":"10.1145\/3372297.3423353"},{"key":"e_1_3_2_1_7_1","doi-asserted-by":"publisher","DOI":"10.1145\/3319535.3363212"},{"key":"e_1_3_2_1_8_1","doi-asserted-by":"publisher","DOI":"10.1145\/3462699"},{"key":"e_1_3_2_1_9_1","unstructured":"Jonathan Corbet. 2017. ARM pointer authentication. https:\/\/lwn.net\/Articles\/718888\/ Accessed: 2025-01-08."},{"key":"e_1_3_2_1_10_1","unstructured":"Boneh Dan. 2018. Control Hijacking. https:\/\/crypto.stanford.edu\/cs155old\/cs155-spring18\/lectures\/02-ctrl-hijacking.pdf Accessed: 2025-01-08."},{"key":"e_1_3_2_1_11_1","unstructured":"Jones Dave. 2006. Re: memory corruptor in. 18rc1-git. https:\/\/lore.kernel.org\/lkml\/20060714043112.GA20478@redhat.com\/ Accessed: 2025-01-08."},{"key":"e_1_3_2_1_12_1","unstructured":"Linux Kernel Documentation. 2025. The Kernel Address Sanitizer (KASAN). Linux Kernel Documentation. https:\/\/docs.kernel.org\/dev-tools\/kasan.html Accessed: 2025-01-08."},{"key":"e_1_3_2_1_13_1","unstructured":"Google. 2024. syzbot - Kernel Fuzzing Dashboard. Web. https:\/\/syzkaller.appspot.com Accessed: 2025-01-08."},{"key":"e_1_3_2_1_14_1","first-page":"1189","volume-title":"33rd USENIX Security Symposium (USENIX Security 24)","author":"Guo Ziyi","year":"2024","unstructured":"Ziyi Guo, Dang K Le, Zhenpeng Lin, Kyle Zeng, Ruoyu Wang, Tiffany Bao, Yan Shoshitaishvili, Adam Doup\u00e9, and Xinyu Xing. 2024. Take a Step Further: Understanding Page Spray in Linux Kernel Exploitation. In 33rd USENIX Security Symposium (USENIX Security 24). USENIX Association, Philadelphia, PA, 1189-1206. https:\/\/www.usenix.org\/conference\/usenixsecurity24\/presentation\/guo-ziyi"},{"key":"e_1_3_2_1_15_1","first-page":"6203","volume-title":"CARDSHARK: Understanding and Stablizing Linux Kernel Concurrency Bugs Against the Odds. In 33rd USENIX Security Symposium (USENIX Security 24)","author":"Han Tianshuo","year":"2024","unstructured":"Tianshuo Han, Xiaorui Gong, and Jian Liu. 2024. CARDSHARK: Understanding and Stablizing Linux Kernel Concurrency Bugs Against the Odds. In 33rd USENIX Security Symposium (USENIX Security 24). USENIX Association, Philadelphia, PA, 6203-6218. https:\/\/www.usenix.org\/conference\/usenixsecurity24\/presentation\/han-tianshuo"},{"key":"e_1_3_2_1_16_1","unstructured":"Google Inc. 2024. Syzkaller - kernel fuzzer. https:\/\/github.com\/google\/syzkaller Accessed: 2025-01-08."},{"key":"e_1_3_2_1_17_1","unstructured":"Axboe Jens. 2007. Add CONFIG_DEBUG_SG sg validation. https:\/\/lore.kernel.org\/lkml\/1193076664-13652-11-git-send-email-jens.axboe@oracle.com\/ Accessed: 2025-01-08."},{"key":"e_1_3_2_1_18_1","unstructured":"Cook Kees. 2016. bug: Provide toggle for BUG on data corruption. https:\/\/lore.kernel.org\/all\/1471470132-29499-5-git-send-email-keescook@chromium.org\/ Accessed: 2025-01-08."},{"key":"e_1_3_2_1_19_1","unstructured":"Max Kellermann. 2022. The Dirty Pipe Vulnerability. https:\/\/dirtypipe.cm4all.com Accessed: 2025-01-08."},{"key":"e_1_3_2_1_20_1","first-page":"957","volume-title":"23rd USENIX Security Symposium (USENIX Security 14)","author":"Kemerlis Vasileios P","year":"2014","unstructured":"Vasileios P Kemerlis, Michalis Polychronakis, and Angelos D Keromytis. 2014. ret2dir: Rethinking kernel isolation. In 23rd USENIX Security Symposium (USENIX Security 14). 957-972."},{"key":"e_1_3_2_1_21_1","unstructured":"LangChain Contributors. 2024. LangChain: Building context-aware reasoning applications. https:\/\/github.com\/langchain-ai\/langchain Accessed: 2025-01-08."},{"key":"e_1_3_2_1_22_1","first-page":"2363","volume-title":"30th USENIX Security Symposium (USENIX Security 21)","author":"Lee Yoochan","year":"2021","unstructured":"Yoochan Lee, Changwoo Min, and Byoungyoung Lee. 2021. ExpRace: Exploiting Kernel Races through Raising Interrupts. In 30th USENIX Security Symposium (USENIX Security 21). USENIX Association, 2363-2380. https:\/\/www.usenix.org\/conference\/usenixsecurity21\/presentation\/lee-yoochan"},{"key":"e_1_3_2_1_23_1","doi-asserted-by":"publisher","DOI":"10.14722\/ndss.2024.24935"},{"key":"e_1_3_2_1_24_1","doi-asserted-by":"publisher","DOI":"10.1109\/SP46214.2022.9833683"},{"key":"e_1_3_2_1_25_1","doi-asserted-by":"publisher","DOI":"10.1145\/3548606.3560585"},{"key":"e_1_3_2_1_26_1","doi-asserted-by":"publisher","DOI":"10.1109\/TIFS.2022.3226906"},{"key":"e_1_3_2_1_27_1","volume-title":"USMA: Share Kernel Code. https:\/\/i.blackhat.com\/Asia-22\/Thursday-Materials\/AS-22-YongLiu-USMA-Share-Kernel-Code.pdf Slides presented at Black Hat Asia","author":"Liu Yong","year":"2022","unstructured":"Yong Liu. 2022. USMA: Share Kernel Code. https:\/\/i.blackhat.com\/Asia-22\/Thursday-Materials\/AS-22-YongLiu-USMA-Share-Kernel-Code.pdf Slides presented at Black Hat Asia 2022."},{"key":"e_1_3_2_1_28_1","unstructured":"LKDDB. 2018. CONFIG_REFCOUNT_FULL: Perform full reference count validation at the expense of speed. https:\/\/cateee.net\/lkddb\/web-lkddb\/REFCOUNT_FULL.html Accessed: 2025-01-08."},{"key":"e_1_3_2_1_29_1","unstructured":"LKDDB. 2024a. CONFIG_DEBUG_CREDENTIALS: Debug credential management. https:\/\/cateee.net\/lkddb\/web-lkddb\/DEBUG_CREDENTIALS.html Accessed: 2025-01-08."},{"key":"e_1_3_2_1_30_1","unstructured":"LKDDB. 2024b. CONFIG_DEBUG_NOTIFIERS: Debug notifier call chains. https:\/\/cateee.net\/lkddb\/web-lkddb\/DEBUG_NOTIFIERS.html Accessed: 2025-01-08."},{"key":"e_1_3_2_1_31_1","unstructured":"LKDDB. 2024c. CONFIG_DEBUG_VIRTUAL: Debug VM translations. https:\/\/cateee.net\/lkddb\/web-lkddb\/DEBUG_VIRTUAL.html Accessed: 2025-01-08."},{"key":"e_1_3_2_1_32_1","unstructured":"LKDDB. 2024d. CONFIG_STATIC_USERMODEHELPER: Force all usermode helper calls through a single binary. https:\/\/cateee.net\/lkddb\/web-lkddb\/STATIC_USERMODEHELPER.html Accessed: 2025-01-08."},{"key":"e_1_3_2_1_33_1","first-page":"4051","volume-title":"33rd USENIX Security Symposium (USENIX Security 24)","author":"Maar Lukas","year":"2024","unstructured":"Lukas Maar, Stefan Gast, Martin Unterguggenberger, Mathias Oberhuber, and Stefan Mangard. 2024. SLUBStick: Arbitrary Memory Writes through Practical Software Cross-Cache Attacks within the Linux Kernel. In 33rd USENIX Security Symposium (USENIX Security 24). USENIX Association, Philadelphia, PA, 4051-4068. https:\/\/www.usenix.org\/conference\/usenixsecurity24\/presentation\/maar-slubstick"},{"key":"e_1_3_2_1_34_1","unstructured":"Midas. 2021. Linux Kernel Exploitation Technique: Overwriting modprobe_path. https:\/\/lkmidas.github.io\/posts\/20210223-linux-kernel-pwn-modprobe\/ Accessed: 2025-04-01."},{"key":"e_1_3_2_1_35_1","unstructured":"MITRE.org. [n.d.]. https:\/\/cve.mitre.org\/"},{"key":"e_1_3_2_1_36_1","unstructured":"OpenAI. 2024. OpenAI o1 System Card. https:\/\/cdn.openai.com\/o1-system-card.pdf Accessed: 2025-01-08."},{"key":"e_1_3_2_1_37_1","unstructured":"Semmle. 2021. CodeQL. https:\/\/codeql.github.com\/ Accessed: 2025-01-08."},{"key":"e_1_3_2_1_38_1","unstructured":"syzbot. 2023a. KASAN: slab-use-after-free Write in gfs2_qd_dealloc. https:\/\/syzkaller.appspot.com\/bug?extid=29c47e9e51895928698c Accessed: 2025-01-08."},{"key":"e_1_3_2_1_39_1","unstructured":"syzbot. 2023b. KASAN: slab-use-after-free Write in mini_qdisc_pair_swap. https:\/\/syzkaller.appspot.com\/bug?extid=b53a9c0d1ea4ad62da8b Accessed: 2025-01-08."},{"key":"e_1_3_2_1_40_1","unstructured":"syzbot. 2023c. KASAN: slab-use-after-free Write in sco_chan_del. https:\/\/syzkaller.appspot.com\/bug?extid=cf54c1da6574b6c1b049 Accessed: 2025-01-08."},{"key":"e_1_3_2_1_41_1","unstructured":"syzbot. 2023d. KASAN: slab-use-after-free Write in sco_sock_timeout. https:\/\/syzkaller.appspot.com\/bug?extid=4c0d0c4cde787116d465 Accessed: 2025-01-08."},{"key":"e_1_3_2_1_42_1","unstructured":"syzbot. 2023 e. KASAN: use-after-free Write in j1939_sock_pending_del. https:\/\/syzkaller.appspot.com\/bug?extid=07bb74aeafc88ba7d5b4 Accessed: 2025-01-08."},{"key":"e_1_3_2_1_43_1","unstructured":"syzbot. 2024a. KASAN: slab-use-after-free Write in __hci_acl_create_connection_sync. https:\/\/syzkaller.appspot.com\/bug?extid=3f0a39be7a2035700868 Accessed: 2025-01-08."},{"key":"e_1_3_2_1_44_1","unstructured":"syzbot. 2024b. KASAN: slab-use-after-free Write in l2tp_session_delete. https:\/\/syzkaller.appspot.com\/bug?extid=c041b4ce3a6dfd1e63e2 Accessed: 2025-01-08."},{"key":"e_1_3_2_1_45_1","unstructured":"syzbot. 2025a. KASAN: slab-use-after-free Write in io_submit_one. https:\/\/syzkaller.appspot.com\/bug?extid=e1dc29a4daf3f8051130 Accessed: 2025-03-31."},{"key":"e_1_3_2_1_46_1","unstructured":"syzbot. 2025b. KASAN: slab-use-after-free Write in recv_work. https:\/\/syzkaller.appspot.com\/bug?extid=6b0df248918b92c33e6a Accessed: 2025-03-31."},{"key":"e_1_3_2_1_47_1","unstructured":"syzbot. 2025c. KASAN: slab-use-after-free Write in sco_conn_put. https:\/\/syzkaller.appspot.com\/bug?extid=55d58a05f0b5fd2ea0c7 Accessed: 2025-03-31."},{"key":"e_1_3_2_1_48_1","unstructured":"syzbot. 2025d. KASAN: slab-use-after-free Write in sk_skb_reason_drop. https:\/\/syzkaller.appspot.com\/bug?extid=0fd4135ebd713ba973dc Accessed: 2025-03-31."},{"key":"e_1_3_2_1_49_1","doi-asserted-by":"publisher","DOI":"10.1145\/3576915.3623146"},{"key":"e_1_3_2_1_50_1","unstructured":"Linus Torvalds. 2024. The Linux Kernel. https:\/\/www.kernel.org Accessed: 2025-01-08."},{"key":"e_1_3_2_1_51_1","unstructured":"Nikolenko Vitaly. 2016. CVE-2016-6187: Exploiting Linux kernel heap off-by-one. https:\/\/duasynt.com\/blog\/cve-2016-6187-heap-off-by-one-exploit Accessed: 2025-04-01."},{"key":"e_1_3_2_1_52_1","first-page":"4229","volume-title":"AlphaEXP: An Expert System for Identifying Security-Sensitive Kernel Objects. In 32nd USENIX Security Symposium (USENIX Security 23)","author":"Wang Ruipeng","year":"2023","unstructured":"Ruipeng Wang, Kaixiang Chen, Chao Zhang, Zulie Pan, Qianyu Li, Siliang Qin, Shenglin Xu, Min Zhang, and Yang Li. 2023. AlphaEXP: An Expert System for Identifying Security-Sensitive Kernel Objects. In 32nd USENIX Security Symposium (USENIX Security 23). USENIX Association, Anaheim, CA, 4229-4246. https:\/\/www.usenix.org\/conference\/usenixsecurity23\/presentation\/wang-ruipeng"},{"key":"e_1_3_2_1_53_1","volume-title":"Dirty Pagetable: A Novel Exploitation Technique To Rule Linux Kernel. https:\/\/yanglingxi1993.github.io\/dirty_pagetable\/dirty_pagetable.html Accessed: 2025-01-08.","author":"Wu Nicolas","year":"2023","unstructured":"Nicolas Wu. 2023. Dirty Pagetable: A Novel Exploitation Technique To Rule Linux Kernel. https:\/\/yanglingxi1993.github.io\/dirty_pagetable\/dirty_pagetable.html Accessed: 2025-01-08."},{"key":"e_1_3_2_1_54_1","first-page":"2041","volume-title":"Understanding and Detecting Disordered Error Handling with Precise Function Pairing. In 30th USENIX Security Symposium (USENIX Security 21)","author":"Wu Qiushi","year":"2021","unstructured":"Qiushi Wu, Aditya Pakki, Navid Emamdoost, Stephen McCamant, and Kangjie Lu. 2021. Understanding and Detecting Disordered Error Handling with Precise Function Pairing. In 30th USENIX Security Symposium (USENIX Security 21). USENIX Association, 2041-2058. https:\/\/www.usenix.org\/conference\/usenixsecurity21\/presentation\/wu-qiushi"},{"key":"e_1_3_2_1_55_1","first-page":"1187","volume-title":"KEPLER: Facilitating Control-flow Hijacking Primitive Evaluation for Linux Kernel Vulnerabilities. In 28th USENIX Security Symposium (USENIX Security 19)","author":"Wu Wei","year":"2019","unstructured":"Wei Wu, Yueqi Chen, Xinyu Xing, and Wei Zou. 2019. KEPLER: Facilitating Control-flow Hijacking Primitive Evaluation for Linux Kernel Vulnerabilities. In 28th USENIX Security Symposium (USENIX Security 19). USENIX Association, Santa Clara, CA, 1187-1204. https:\/\/www.usenix.org\/conference\/usenixsecurity19\/presentation\/wu-wei"},{"key":"e_1_3_2_1_56_1","first-page":"781","volume-title":"FUZE: Towards Facilitating Exploit Generation for Kernel Use-After-Free Vulnerabilities. In 27th USENIX Security Symposium (USENIX Security 18)","author":"Wu Wei","year":"2018","unstructured":"Wei Wu, Yueqi Chen, Jun Xu, Xinyu Xing, Xiaorui Gong, and Wei Zou. 2018. FUZE: Towards Facilitating Exploit Generation for Kernel Use-After-Free Vulnerabilities. In 27th USENIX Security Symposium (USENIX Security 18). USENIX Association, Baltimore, MD, 781-797. https:\/\/www.usenix.org\/conference\/usenixsecurity18\/presentation\/wu-wei"},{"key":"e_1_3_2_1_57_1","first-page":"4247","volume-title":"Mitigating Security Risks in Linux with KLAUS: A Method for Evaluating Patch Correctness. In 32nd USENIX Security Symposium (USENIX Security 23)","author":"Wu Yuhang","year":"2023","unstructured":"Yuhang Wu, Zhenpeng Lin, Yueqi Chen, Dang K Le, Dongliang Mu, and Xinyu Xing. 2023. Mitigating Security Risks in Linux with KLAUS: A Method for Evaluating Patch Correctness. In 32nd USENIX Security Symposium (USENIX Security 23). USENIX Association, Anaheim, CA, 4247-4264. https:\/\/www.usenix.org\/conference\/usenixsecurity23\/presentation\/wu-yuhang"},{"key":"e_1_3_2_1_58_1","first-page":"89","volume-title":"31st USENIX Security Symposium (USENIX Security 22)","author":"Yoo Sungbae","year":"2022","unstructured":"Sungbae Yoo, Jinbum Park, Seolheui Kim, Yeji Kim, and Taesoo Kim. 2022. In-Kernel Control-Flow Integrity on Commodity OSes using ARM Pointer Authentication. In 31st USENIX Security Symposium (USENIX Security 22). USENIX Association, Boston, MA, 89-106. https:\/\/www.usenix.org\/conference\/usenixsecurity22\/presentation\/yoo"},{"key":"e_1_3_2_1_59_1","first-page":"7177","volume-title":"ShadowBound: Efficient Heap Memory Protection Through Advanced Metadata Management and Customized Compiler Optimization. In 33rd USENIX Security Symposium (USENIX Security 24)","author":"Yu Zheng","year":"2024","unstructured":"Zheng Yu, Ganxiang Yang, and Xinyu Xing. 2024. ShadowBound: Efficient Heap Memory Protection Through Advanced Metadata Management and Customized Compiler Optimization. In 33rd USENIX Security Symposium (USENIX Security 24). USENIX Association, Philadelphia, PA, 7177-7193. https:\/\/www.usenix.org\/conference\/usenixsecurity24\/presentation\/yu-zheng"},{"key":"e_1_3_2_1_60_1","first-page":"71","volume-title":"31st USENIX Security Symposium (USENIX Security 22)","author":"Zeng Kyle","year":"2022","unstructured":"Kyle Zeng, Yueqi Chen, Haehyun Cho, Xinyu Xing, Adam Doup\u00e9, Yan Shoshitaishvili, and Tiffany Bao. 2022. Playing for K(H)eaps: Understanding and Improving Linux Kernel Exploit Reliability. In 31st USENIX Security Symposium (USENIX Security 22). USENIX Association, Boston, MA, 71-88. https:\/\/www.usenix.org\/conference\/usenixsecurity22\/presentation\/zeng"},{"key":"e_1_3_2_1_61_1","doi-asserted-by":"publisher","DOI":"10.1145\/3576915.3623220"},{"key":"e_1_3_2_1_62_1","volume-title":"Beyond Control: Exploring Novel File System Objects for Data-Only Attacks on Linux Systems. arXiv:2401.17618 [cs.CR] https:\/\/arxiv.org\/abs\/2401.17618","author":"Zhou Jinmeng","year":"2024","unstructured":"Jinmeng Zhou, Jiayi Hu, Ziyue Pan, Jiaxun Zhu, Wenbo Shen, Guoren Li, and Zhiyun Qian. 2024. Beyond Control: Exploring Novel File System Objects for Data-Only Attacks on Linux Systems. arXiv:2401.17618 [cs.CR] https:\/\/arxiv.org\/abs\/2401.17618"},{"key":"e_1_3_2_1_63_1","volume-title":"SyzBridge: Bridging the Gap in Exploitability Assessment of Linux Kernel Bugs in the Linux Ecosystem. In 31st Annual Network and Distributed System Security Symposium, NDSS.","author":"Zou Xiaochen","year":"2024","unstructured":"Xiaochen Zou, Yu Hao, Zheng Zhang, Juefei Pu, Weiteng Chen, and Zhiyun Qian. 2024. SyzBridge: Bridging the Gap in Exploitability Assessment of Linux Kernel Bugs in the Linux Ecosystem. In 31st Annual Network and Distributed System Security Symposium, NDSS."},{"key":"e_1_3_2_1_64_1","first-page":"3201","volume-title":"31st USENIX Security Symposium (USENIX Security 22)","author":"Zou Xiaochen","year":"2022","unstructured":"Xiaochen Zou, Guoren Li, Weiteng Chen, Hang Zhang, and Zhiyun Qian. 2022. SyzScope: Revealing High-Risk Security Impacts of Fuzzer-Exposed Bugs in Linux kernel. In 31st USENIX Security Symposium (USENIX Security 22). USENIX Association, Boston, MA, 3201-3217. https:\/\/www.usenix.org\/conference\/usenixsecurity22\/presentation\/zou t"}],"event":{"name":"CCS '25: ACM SIGSAC Conference on Computer and Communications Security","location":"Taipei Taiwan","acronym":"CCS '25","sponsor":["SIGSAC ACM Special Interest Group on Security, Audit, and Control"]},"container-title":["Proceedings of the 2025 ACM SIGSAC Conference on Computer and Communications Security"],"original-title":[],"link":[{"URL":"https:\/\/dl.acm.org\/doi\/pdf\/10.1145\/3719027.3744841","content-type":"unspecified","content-version":"vor","intended-application":"similarity-checking"}],"deposited":{"date-parts":[[2025,12,22]],"date-time":"2025-12-22T22:08:56Z","timestamp":1766441336000},"score":1,"resource":{"primary":{"URL":"https:\/\/dl.acm.org\/doi\/10.1145\/3719027.3744841"}},"subtitle":[],"short-title":[],"issued":{"date-parts":[[2025,11,19]]},"references-count":64,"alternative-id":["10.1145\/3719027.3744841","10.1145\/3719027"],"URL":"https:\/\/doi.org\/10.1145\/3719027.3744841","relation":{},"subject":[],"published":{"date-parts":[[2025,11,19]]},"assertion":[{"value":"2025-11-22","order":3,"name":"published","label":"Published","group":{"name":"publication_history","label":"Publication History"}}]}}