Part 2 of our Android kernel exploit chain (CVE-2023-20938): the stale read returns garbage until you control what reclaims the freed slot.
Land the right object there and it hands back a live kernel pointer instead. That’s your KASLR bypass.
www.eshard.comKernel UaF to Root #2: Making the Freed Slot Hand Back an Address We Chose | eShardPart 2 of our Android Binder exploit series: reclaiming a freed slot to leak a kernel address and defeat KASLR, traced step by step with Epoch.