Automating Kernel Pwn: How KernJC Simplifies Linux Vulnerability Reproduction

Reproducing a Linux kernel vulnerability is often described as 'dirty work.' For security researchers, the path from a CVE ID to a working exploit environment is littered with manual compilation errors, incorrect version metadata, and missing configuration flags. At Black Hat, the Curiosity Security Team from the National University of Singapore introduced KernJC, a revolutionary tool designed to automate the generation of vulnerable kernel environments. By leveraging patch analysis and graph-based configuration discovery, KernJC removes the guesswork from kernel exploitation research.

The Reproducibility Crisis in Kernel Security

When a new kernel vulnerability is disclosed, the security community rushes to analyze the root cause. However, a significant gap exists between having a Proof of Concept (PoC) and actually triggering the bug. The National Vulnerability Database (NVD) is the industry standard for tracking these flaws, but it is surprisingly fallible. Researchers found that many versions claimed to be vulnerable by the NVD were actually already patched. If you try to run an exploit on a patched kernel, you will never see a crash, leading to wasted hours of debugging.

Furthermore, the Linux kernel is modular. Features like eBPF, NetFilter, or KVM are only included if specific Kconfig options are selected during the build process. Many vulnerabilities reside in these optional subsystems. If a researcher builds a kernel with default settings, the vulnerable code path might not even be compiled into the binary. Identifying the exact web of dependencies—including 'hidden' configs that are automatically selected by others—is a Herculean task.

Technical Deep Dive: How KernJC Works

KernJC solves these problems using two core methodologies: Patch-based version detection and Graph-based configuration resolution.

Identifying Truly Vulnerable Versions

Instead of trusting the NVD, KernJC performs Patch Analysis. When given a CVE, the tool identifies the specific commit that fixed the bug. It then performs 'backward tracking.' Starting from the latest version claimed to be vulnerable, KernJC attempts to apply the patch. If the patch fails (e.g., the code to be deleted is missing), it indicates the version is likely already patched. The tool moves down the version list until it finds a version where the patch applies cleanly, identifying the true target for reproduction. In their large-scale scan, the team found 128 vulnerabilities in the NVD with incorrect version claims.

Solving the Kconfig Puzzle

To ensure the vulnerable code is actually active, KernJC identifies necessary configs through three levels:

1. Description Level: Searching the CVE text for keywords (e.g., 'eBPF').
2. Path Level: Analyzing Makefiles to see which configs include the vulnerable .c files.
3. Code Level: Searching for #ifdef preprocessor directives within the source code.

Once these 'seed' configs are found, KernJC uses a Kconfig Graph. Because configurations in Linux have complex 'depends on' and 'select' relationships, simply enabling one flag isn't enough. The graph-based approach performs reachability analysis to find every parent dependency required to make the target configuration active in the final build.

Practical Implementation: The Docker-Like Experience

One of the most impressive features of KernJC is its user interface. It mimics the Docker CLI to make kernel management intuitive. For example:

• kgc build CVE-2021-22555: Automatically clones the kernel, checks out the right version, resolves configs, and compiles it.
• kgc start [id]: Launches the kernel in a QEMU virtual machine with appropriate settings (e.g., KVM enabled).
• kgc logs: Provides a real-time stream of the kernel ring buffer (dmesg), allowing researchers to see KASAN (Kernel Address Sanitizer) reports the moment a PoC triggers a crash.
• kgc cp [poc] [id]: Easily moves an exploit binary from the host machine into the vulnerable guest environment.

Mitigation and Defense Applications

While KernJC is a boon for red teamers and bug bounty hunters, its primary value lies in defense. By automating the creation of vulnerable environments, blue teams can evaluate the efficacy of their detection mechanisms and security patches. If a company develops a new kernel-level mitigation, they can use KernJC to rapidly test that mitigation against a battery of 66+ real-world vulnerabilities to ensure it actually prevents exploitation across different subsystems.

Conclusion

The automation of kernel environment generation marks a significant step forward in system security. KernJC effectively proves that we cannot rely solely on manual databases like the NVD for technical ground truth. By turning the 'dirty work' of kernel compilation into a single-command process, KernJC allows researchers to focus on what matters: finding bugs and fixing them. For those interested in testing the tool, the code has been released on GitHub by the Curiosity Security Team. As kernel complexity continues to grow, tools that map its internal dependencies will become essential components of every security professional's toolkit.