Track papers across labs, topics, and trends.
Search papers, labs, and topics across Lattice.
This paper addresses the critical challenge of bridging the gap between abstract exploit strategies and concrete operations in Linux kernel vulnerability exploitation by introducing a systematic characterization of six classes of exploit primitives. It presents PrimSynth, a multi-agent framework that iteratively discovers, validates, and synthesizes these exploit primitives through coordinated agents, achieving a 100% primitive match rate and high strategy synthesis rates. The results demonstrate PrimSynth's effectiveness in extracting and synthesizing multi-primitive exploitation chains across various real-world Linux kernel vulnerabilities, significantly enhancing automated exploitation capabilities.
Achieving a 100% match rate for exploit primitives, PrimSynth transforms how we automate vulnerability exploitation in the Linux kernel.
Linux kernel vulnerabilities are critical to downstream systems. Despite extensive research on automated kernel exploitation, a fundamental challenge remains the conceptual gap between abstract exploit strategies and concrete technical operations. To fill this gap, this paper introduces a systematic characterization that formalizes six classes of exploit primitives from logical capability to validatable effect. Then, an extended exploit strategy representation is proposed, which couples primitive upgrading strategies with primitive path code synthesis rules governing object constraints, temporal sequencing, environment prerequisites, and validation constraints. Building upon this foundation, this paper presents \textsc{PrimSynth}, a multi-agent framework that encapsulates these representations through coordinated agents to discover, validate, and synthesize exploit primitives for memory corruption vulnerabilities in the Linux kernel. These agents operate in an iterative closed loop until valid primitives are found, leveraging validation signals as evidence of exploitable state transitions to ground primitive synthesis decisions. An automated method for extracting and validating primitives is also proposed based on vulnerability-directed execution and a rebootable validation environment. \textsc{PrimSynth} is evaluated on 16 real-world Linux kernel CVEs spanning 5 vulnerability types. Experimental results show that PrimSynth achieves reliable primitive extraction, maintaining a 100% primitive match rate. For primitive synthesis, PrimSynth successfully synthesizes multi-primitive exploitation chains with 82.4% strategy synthesis rate (SSR) when the public PoC is available and a 61.3% SSR without the guidance of primitive hypotheses.