{"id":"https://openalex.org/W4313191964","doi":"https://doi.org/10.1109/tifs.2022.3226906","title":"From Release to Rebirth: Exploiting Thanos Objects in Linux Kernel","display_name":"From Release to Rebirth: Exploiting Thanos Objects in Linux Kernel","publication_year":2022,"publication_date":"2022-12-05","ids":{"openalex":"https://openalex.org/W4313191964","doi":"https://doi.org/10.1109/tifs.2022.3226906"},"language":"en","primary_location":{"id":"doi:10.1109/tifs.2022.3226906","is_oa":false,"landing_page_url":"https://doi.org/10.1109/tifs.2022.3226906","pdf_url":null,"source":{"id":"https://openalex.org/S61310614","display_name":"IEEE Transactions on Information Forensics and Security","issn_l":"1556-6013","issn":["1556-6013","1556-6021"],"is_oa":false,"is_in_doaj":false,"is_core":true,"host_organization":"https://openalex.org/P4310319808","host_organization_name":"Institute of Electrical and Electronics Engineers","host_organization_lineage":["https://openalex.org/P4310319808"],"host_organization_lineage_names":["Institute of Electrical and Electronics Engineers"],"type":"journal"},"license":null,"license_id":null,"version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"IEEE Transactions on Information Forensics and Security","raw_type":"journal-article"},"type":"article","indexed_in":["crossref"],"open_access":{"is_oa":false,"oa_status":"closed","oa_url":null,"any_repository_has_fulltext":false},"authorships":[{"author_position":"first","author":{"id":"https://openalex.org/A5073803603","display_name":"Danjun Liu","orcid":"https://orcid.org/0000-0002-5375-7598"},"institutions":[{"id":"https://openalex.org/I170215575","display_name":"National University of Defense Technology","ror":"https://ror.org/05d2yfz11","country_code":"CN","type":"education","lineage":["https://openalex.org/I170215575"]}],"countries":["CN"],"is_corresponding":false,"raw_author_name":"Danjun Liu","raw_affiliation_strings":["School of Computer Science, National University of Defense Technology, Changsha, China"],"raw_orcid":"https://orcid.org/0000-0002-5375-7598","affiliations":[{"raw_affiliation_string":"School of Computer Science, National University of Defense Technology, Changsha, China","institution_ids":["https://openalex.org/I170215575"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5100399594","display_name":"Pengfei Wang","orcid":"https://orcid.org/0000-0003-3408-4153"},"institutions":[{"id":"https://openalex.org/I170215575","display_name":"National University of Defense Technology","ror":"https://ror.org/05d2yfz11","country_code":"CN","type":"education","lineage":["https://openalex.org/I170215575"]}],"countries":["CN"],"is_corresponding":false,"raw_author_name":"Pengfei Wang","raw_affiliation_strings":["School of Computer Science, National University of Defense Technology, Changsha, China"],"raw_orcid":"https://orcid.org/0000-0003-3408-4153","affiliations":[{"raw_affiliation_string":"School of Computer Science, National University of Defense Technology, Changsha, China","institution_ids":["https://openalex.org/I170215575"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5055476418","display_name":"Xu Zhou","orcid":"https://orcid.org/0000-0002-0075-5003"},"institutions":[{"id":"https://openalex.org/I170215575","display_name":"National University of Defense Technology","ror":"https://ror.org/05d2yfz11","country_code":"CN","type":"education","lineage":["https://openalex.org/I170215575"]}],"countries":["CN"],"is_corresponding":false,"raw_author_name":"Xu Zhou","raw_affiliation_strings":["School of Computer Science, National University of Defense Technology, Changsha, China"],"raw_orcid":"https://orcid.org/0000-0002-0075-5003","affiliations":[{"raw_affiliation_string":"School of Computer Science, National University of Defense Technology, Changsha, China","institution_ids":["https://openalex.org/I170215575"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5100617974","display_name":"Wei Xie","orcid":"https://orcid.org/0009-0005-1667-4995"},"institutions":[{"id":"https://openalex.org/I170215575","display_name":"National University of Defense Technology","ror":"https://ror.org/05d2yfz11","country_code":"CN","type":"education","lineage":["https://openalex.org/I170215575"]}],"countries":["CN"],"is_corresponding":false,"raw_author_name":"Wei Xie","raw_affiliation_strings":["School of Computer Science, National University of Defense Technology, Changsha, China"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"School of Computer Science, National University of Defense Technology, Changsha, China","institution_ids":["https://openalex.org/I170215575"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5100671334","display_name":"Gen Zhang","orcid":"https://orcid.org/0000-0001-7709-0751"},"institutions":[{"id":"https://openalex.org/I170215575","display_name":"National University of Defense Technology","ror":"https://ror.org/05d2yfz11","country_code":"CN","type":"education","lineage":["https://openalex.org/I170215575"]}],"countries":["CN"],"is_corresponding":false,"raw_author_name":"Gen Zhang","raw_affiliation_strings":["School of Computer Science, National University of Defense Technology, Changsha, China"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"School of Computer Science, National University of Defense Technology, Changsha, China","institution_ids":["https://openalex.org/I170215575"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5077730693","display_name":"Zhenhao Luo","orcid":"https://orcid.org/0000-0001-7818-4987"},"institutions":[{"id":"https://openalex.org/I170215575","display_name":"National University of Defense Technology","ror":"https://ror.org/05d2yfz11","country_code":"CN","type":"education","lineage":["https://openalex.org/I170215575"]}],"countries":["CN"],"is_corresponding":false,"raw_author_name":"Zhenhao Luo","raw_affiliation_strings":["School of Computer Science, National University of Defense Technology, Changsha, China"],"raw_orcid":"https://orcid.org/0000-0001-7818-4987","affiliations":[{"raw_affiliation_string":"School of Computer Science, National University of Defense Technology, Changsha, China","institution_ids":["https://openalex.org/I170215575"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5075919641","display_name":"Tai Yue","orcid":"https://orcid.org/0000-0002-7276-8735"},"institutions":[{"id":"https://openalex.org/I170215575","display_name":"National University of Defense Technology","ror":"https://ror.org/05d2yfz11","country_code":"CN","type":"education","lineage":["https://openalex.org/I170215575"]}],"countries":["CN"],"is_corresponding":false,"raw_author_name":"Tai Yue","raw_affiliation_strings":["School of Computer Science, National University of Defense Technology, Changsha, China"],"raw_orcid":"https://orcid.org/0000-0002-7276-8735","affiliations":[{"raw_affiliation_string":"School of Computer Science, National University of Defense Technology, Changsha, China","institution_ids":["https://openalex.org/I170215575"]}]},{"author_position":"last","author":{"id":"https://openalex.org/A5032324905","display_name":"Baosheng Wang","orcid":"https://orcid.org/0009-0008-7039-5614"},"institutions":[{"id":"https://openalex.org/I170215575","display_name":"National University of Defense Technology","ror":"https://ror.org/05d2yfz11","country_code":"CN","type":"education","lineage":["https://openalex.org/I170215575"]}],"countries":["CN"],"is_corresponding":false,"raw_author_name":"Baosheng Wang","raw_affiliation_strings":["School of Computer Science, National University of Defense Technology, Changsha, China"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"School of Computer Science, National University of Defense Technology, Changsha, China","institution_ids":["https://openalex.org/I170215575"]}]}],"institutions":[],"countries_distinct_count":1,"institutions_distinct_count":1,"corresponding_author_ids":[],"corresponding_institution_ids":["https://openalex.org/I170215575"],"apc_list":{"value":2645,"currency":"USD","value_usd":2645},"apc_paid":null,"fwci":1.3678,"has_fulltext":false,"cited_by_count":11,"citation_normalized_percentile":{"value":0.83990639,"is_in_top_1_percent":false,"is_in_top_10_percent":false},"cited_by_percentile_year":{"min":94,"max":98},"biblio":{"volume":"18","issue":null,"first_page":"533","last_page":"548"},"is_retracted":false,"is_paratext":false,"is_xpac":false,"primary_topic":{"id":"https://openalex.org/T11424","display_name":"Security and Verification in Computing","score":0.9998000264167786,"subfield":{"id":"https://openalex.org/subfields/1702","display_name":"Artificial Intelligence"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},"topics":[{"id":"https://openalex.org/T11424","display_name":"Security and Verification in Computing","score":0.9998000264167786,"subfield":{"id":"https://openalex.org/subfields/1702","display_name":"Artificial Intelligence"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T11241","display_name":"Advanced Malware Detection Techniques","score":0.9987000226974487,"subfield":{"id":"https://openalex.org/subfields/1711","display_name":"Signal Processing"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T12034","display_name":"Digital and Cyber Forensics","score":0.9933000206947327,"subfield":{"id":"https://openalex.org/subfields/1710","display_name":"Information Systems"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}}],"keywords":[{"id":"https://openalex.org/keywords/computer-science","display_name":"Computer science","score":0.8158466815948486},{"id":"https://openalex.org/keywords/kernel","display_name":"Kernel (algebra)","score":0.6597411036491394},{"id":"https://openalex.org/keywords/operating-system","display_name":"Operating system","score":0.4094451665878296}],"concepts":[{"id":"https://openalex.org/C41008148","wikidata":"https://www.wikidata.org/wiki/Q21198","display_name":"Computer science","level":0,"score":0.8158466815948486},{"id":"https://openalex.org/C74193536","wikidata":"https://www.wikidata.org/wiki/Q574844","display_name":"Kernel (algebra)","level":2,"score":0.6597411036491394},{"id":"https://openalex.org/C111919701","wikidata":"https://www.wikidata.org/wiki/Q9135","display_name":"Operating system","level":1,"score":0.4094451665878296},{"id":"https://openalex.org/C114614502","wikidata":"https://www.wikidata.org/wiki/Q76592","display_name":"Combinatorics","level":1,"score":0.0},{"id":"https://openalex.org/C33923547","wikidata":"https://www.wikidata.org/wiki/Q395","display_name":"Mathematics","level":0,"score":0.0}],"mesh":[],"locations_count":1,"locations":[{"id":"doi:10.1109/tifs.2022.3226906","is_oa":false,"landing_page_url":"https://doi.org/10.1109/tifs.2022.3226906","pdf_url":null,"source":{"id":"https://openalex.org/S61310614","display_name":"IEEE Transactions on Information Forensics and Security","issn_l":"1556-6013","issn":["1556-6013","1556-6021"],"is_oa":false,"is_in_doaj":false,"is_core":true,"host_organization":"https://openalex.org/P4310319808","host_organization_name":"Institute of Electrical and Electronics Engineers","host_organization_lineage":["https://openalex.org/P4310319808"],"host_organization_lineage_names":["Institute of Electrical and Electronics Engineers"],"type":"journal"},"license":null,"license_id":null,"version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"IEEE Transactions on Information Forensics and Security","raw_type":"journal-article"}],"best_oa_location":null,"sustainable_development_goals":[{"id":"https://metadata.un.org/sdg/16","score":0.4399999976158142,"display_name":"Peace, Justice and strong institutions"}],"awards":[{"id":"https://openalex.org/G3270930778","display_name":null,"funder_award_id":"ZK20-09","funder_id":"https://openalex.org/F4320324150","funder_display_name":"National University of Defense Technology"},{"id":"https://openalex.org/G3746587034","display_name":null,"funder_award_id":"62272472","funder_id":"https://openalex.org/F4320321001","funder_display_name":"National Natural Science Foundation of China"},{"id":"https://openalex.org/G5268210912","display_name":null,"funder_award_id":"2021JJ40692","funder_id":"https://openalex.org/F4320322843","funder_display_name":"Natural Science Foundation of\u00a0Hunan Province"},{"id":"https://openalex.org/G7595799902","display_name":null,"funder_award_id":"ZK20-17","funder_id":"https://openalex.org/F4320324150","funder_display_name":"National University of Defense Technology"},{"id":"https://openalex.org/G8346263138","display_name":null,"funder_award_id":"61902412","funder_id":"https://openalex.org/F4320321001","funder_display_name":"National Natural Science Foundation of China"}],"funders":[{"id":"https://openalex.org/F4320321001","display_name":"National Natural Science Foundation of China","ror":"https://ror.org/01h0zpd94"},{"id":"https://openalex.org/F4320322843","display_name":"Natural Science Foundation of\u00a0Hunan Province","ror":null},{"id":"https://openalex.org/F4320324150","display_name":"National University of Defense Technology","ror":"https://ror.org/05d2yfz11"}],"has_content":{"grobid_xml":false,"pdf":false},"content_urls":null,"referenced_works_count":27,"referenced_works":["https://openalex.org/W1447175589","https://openalex.org/W1535810264","https://openalex.org/W2094619820","https://openalex.org/W2529582363","https://openalex.org/W2532499458","https://openalex.org/W2613274303","https://openalex.org/W2766898821","https://openalex.org/W2889280832","https://openalex.org/W2964358525","https://openalex.org/W2964938167","https://openalex.org/W2985831349","https://openalex.org/W2987375469","https://openalex.org/W3048059227","https://openalex.org/W3049058030","https://openalex.org/W3108020564","https://openalex.org/W3157604780","https://openalex.org/W3211835121","https://openalex.org/W4288057707","https://openalex.org/W6628569256","https://openalex.org/W6632249059","https://openalex.org/W6754597693","https://openalex.org/W6766193004","https://openalex.org/W6766922533","https://openalex.org/W6781362174","https://openalex.org/W6781997156","https://openalex.org/W6794723050","https://openalex.org/W6803490195"],"related_works":["https://openalex.org/W4391375266","https://openalex.org/W2899084033","https://openalex.org/W2748952813","https://openalex.org/W2390279801","https://openalex.org/W4391913857","https://openalex.org/W2358668433","https://openalex.org/W4396701345","https://openalex.org/W2376932109","https://openalex.org/W2001405890","https://openalex.org/W4396696052"],"abstract_inverted_index":{"Vulnerability":[0],"fixing":[1,20],"is":[2],"time-consuming,":[3],"hence,":[4],"not":[5,110],"all":[6],"of":[7,26,141,168,176,210,218],"the":[8,45,49,58,65,96,130,139,142,161,166,169,174,177,202,208,226,242,250],"discovered":[9],"vulnerabilities":[10,27,182],"can":[11,81,103,239],"be":[12],"fixed":[13],"timely.":[14],"In":[15,60],"reality,":[16],"developers":[17],"prioritize":[18],"vulnerability":[19,107,119,261],"based":[21],"on":[22,91,138],"exploitability.":[23],"Large":[24],"numbers":[25],"are":[28,37],"delayed":[29],"to":[30,44,63,72,223,233],"patch":[31],"or":[32,41],"even":[33,257],"ignored":[34],"as":[35,39],"they":[36],"regarded":[38],"\u201cunexploitable\u201d":[40],"underestimated":[42],"owing":[43],"difficulty":[46],"in":[47,57,95,231],"exploiting":[48,234],"weak":[50,66,83,235],"primitives.":[51,89],"However,":[52],"exploits":[53],"may":[54],"have":[55,111,188],"been":[56],"wild.":[59],"this":[61],"paper,":[62],"exploit":[64,84,88,104],"primitives":[67,85],"that":[68,80,108,120,132,230],"traditional":[69,133,220],"approaches":[70],"fail":[71],"exploit,":[73],"we":[74,149,206,228],"propose":[75],"a":[76,92,105,151],"versatile":[77],"exploitation":[78,134],"strategy":[79],"transform":[82],"into":[86],"strong":[87],"Based":[90],"special":[93],"object":[94],"kernel":[97,243],"named":[98],"Thanos":[99,147,158,171,185,197,204],"object,":[100],"our":[101,190,211,237],"approach":[102,128,191,212,238],"UAF":[106],"does":[109],"function":[112],"pointer":[113,253],"dereference":[114],"and":[115,125,256],"an":[116],"OOB":[117],"write":[118,123],"has":[121],"limited":[122],"length":[124],"value.":[126],"Our":[127],"overcomes":[129],"shortage":[131],"strategies":[135],"heavily":[136],"rely":[137],"capability":[140],"vulnerability.":[143],"To":[144],"facilitate":[145],"using":[146],"objects,":[148,205],"devise":[150],"tool":[152],"namedTAODEto":[153],"automatically":[154],"search":[155],"for":[156],"eligible":[157,184],"objects":[159,172,198],"from":[160,199],"kernel.":[162],"Then,":[163],"it":[164,180],"evaluates":[165],"usability":[167],"identified":[170,195,203],"by":[173],"complexity":[175],"constraints.":[178],"Finally,":[179],"pairs":[181],"with":[183,192,213],"objects.":[186],"We":[187],"evaluated":[189],"real-world":[193,215],"kernels.TAODEsuccessfully":[194],"numerous":[196],"Linux.":[200],"Using":[201],"proved":[207],"feasibility":[209],"20":[214],"vulnerabilities,":[216],"most":[217],"which":[219],"techniques":[221],"failed":[222],"exploit.":[224],"Through":[225],"experiments,":[227],"find":[229],"addition":[232],"primitives,":[236],"sometimes":[240],"bypass":[241],"SMAP":[244],"mechanism":[245],"(CVE-2016-10150,":[246],"CVE-2016-0728),":[247],"better":[248],"utilize":[249],"leaked":[251],"heap":[252],"address":[254],"(CVE-2022-25636),":[255],"theoretically":[258],"break":[259],"certain":[260],"patches":[262],"(e.g.,":[263],"double-free).":[264]},"counts_by_year":[{"year":2025,"cited_by_count":5},{"year":2024,"cited_by_count":4},{"year":2023,"cited_by_count":2}],"updated_date":"2026-08-21T09:56:20.448147","created_date":"2025-10-10T00:00:00"}