Search papers, labs, and topics across Lattice.
The Linux IOCTL Census provides a comprehensive, source-derived inventory of the ioctl control-code surface in the Linux kernel, identifying 586 ioctl dispatch entry points and 1,289 command codes across 878 modules. This work is crucial as it highlights the extensive and poorly documented attack surface presented by ioctl handlers, which can lead to serious vulnerabilities if not properly managed. By backtesting against 22 recent CVEs, the census not only reveals the potential for unprivileged access but also offers a structured dataset for further research and security assessments.
The Linux IOCTL Census reveals a staggering 1,298 command codes, exposing a vast and underexplored attack surface in the kernel that could be exploited if left unchecked.
The ioctl system call is Linux's catch-all device-control interface. A userspace program opens a device node and hands the driver a numeric command code and an argument buffer, and the driver does whatever that code means, whether configuring hardware, reading back state, or moving data into and out of the kernel. Drivers define these commands themselves, by the thousand, and parse their arguments in kernel context, which makes ioctl handlers one of the broadest and least uniform local attack surfaces in the kernel. A handler that trusts an argument length it never validates can read or write kernel memory out of bounds, and the command space is catalogued in no central place. We present the Linux IOCTL Census, a source-derived and queryable inventory of that surface. An allmodconfig build compiles 878 modules across 169 subtrees, and over them a single deterministic libclang pass over the kernel source recovers 586 ioctl dispatch entry points, 1,289 decoded _IOC command codes, 3,583 controlled-input sinks, and 1,298 permission gates. A second pass encodes the kernel's own documented threat model as a queryable column, separating the capability-ungated ioctl surface, an upper bound on unprivileged reach rather than proven reach, from the part a hard capability gate puts out of scope. We backtest the census against 22 recent in-tree ioctl CVEs and release the structural tier as open data, on a schema shared with the companion Windows IOCTL Census so a single query spans both operating systems.
