  The widespread deployment of control-flow integrity has propelled non-control
data attacks into the mainstream. In the domain of OS kernel exploits, by
corrupting critical non-control data, local attackers can directly gain root
access or privilege escalation without hijacking the control flow. As a result,
OS kernels have been restricting the availability of such non-control data.
This forces attackers to continue to search for more exploitable non-control
data in OS kernels. However, discovering unknown non-control data can be
daunting because they are often tied heavily to semantics and lack universal
patterns.
  We make two contributions in this paper: (1) discover critical non-control
objects in the file subsystem and (2) analyze their exploitability. This work
represents the first study, with minimal domain knowledge, to
semi-automatically discover and evaluate exploitable non-control data within
the file subsystem of the Linux kernel. Our solution utilizes a custom analysis
and testing framework that statically and dynamically identifies promising
candidate objects. Furthermore, we categorize these discovered objects into
types that are suitable for various exploit strategies, including a novel
strategy necessary to overcome the defense that isolates many of these objects.
These objects have the advantage of being exploitable without requiring KASLR,
thus making the exploits simpler and more reliable. We use 18 real-world CVEs
to evaluate the exploitability of the file system objects using various exploit
strategies. We develop 10 end-to-end exploits using a subset of CVEs against
the kernel with all state-of-the-art mitigations enabled.
