PaperlayerView exact revision on arXiv

Source-linked AI summary

PrimSynth: An Agentic Approach to Discover, Validate, and Synthesize Exploit Primitives for Linux Kernel Vulnerabilities

Pengfei Wang, Anying Chen, Danjun Liu, Xu Zhou, Wei Xie

arXiv:2609.02647v1cs.CR

TL;DR

Automated Linux kernel exploitation still struggles to translate abstract strategies into concrete, composable operations and to validate which primitives are available. The paper formalizes exploit primitives and introduces PRIMSYNTH, a multi-agent system that discovers, validates, and synthesizes primitive chains through iterative feedback. Across 16 real-world CVEs, it reports 100% primitive match rate and 82.4% SSR with public PoC guidance versus 61.3% without it.

  • Problem

    Existing exploit-primitive research is often isolated by vulnerability type or exploitation phase and lacks a unified way to model capability, prerequisites, temporal constraints, composition, and validation evidence.

  • Method

    PRIMSYNTH combines systematic primitive characterization, an extended strategy representation, vulnerability-directed execution, coordinated agents, and rebootable validation to discover, validate, synthesize, and chain primitives.

  • Results

    100% PMR is maintained across 16 CVEs spanning 5 vulnerability types, while SSR reaches 82.4% with public PoC guidance and 61.3% without it.

  • Takeaways & Limitations

    The framework makes kernel-exploitation reasoning more systematic, comparable, and reproducible, supporting testable primitive assessments across vulnerability classes.

  • Takeaways & Limitations

    Evaluation assumes disabled or permissive SMEP/SMAP configurations and excludes full mitigation scenarios involving KPTI, CFI, or pointer authentication.

Abstract

from arXiv · show

Linux kernel vulnerabilities are critical to downstream systems. Despite extensive research on automated kernel exploitation, a fundamental challenge remains the conceptual gap between abstract exploit strategies and concrete technical operations. To fill this gap, this paper introduces a systematic characterization that formalizes six classes of exploit primitives from logical capability to validatable effect. Then, an extended exploit strategy representation is proposed, which couples primitive upgrading strategies with primitive path code synthesis rules governing object constraints, temporal sequencing, environment prerequisites, and validation constraints. Building upon this foundation, this paper presents \textsc{PrimSynth}, a multi-agent framework that encapsulates these representations through coordinated agents to discover, validate, and synthesize exploit primitives for memory corruption vulnerabilities in the Linux kernel. These agents operate in an iterative closed loop until valid primitives are found, leveraging validation signals as evidence of exploitable state transitions to ground primitive synthesis decisions. An automated method for extracting and validating primitives is also proposed based on vulnerability-directed execution and a rebootable validation environment. \textsc{PrimSynth} is evaluated on 16 real-world Linux kernel CVEs spanning 5 vulnerability types. Experimental results show that PrimSynth achieves reliable primitive extraction, maintaining a 100% primitive match rate. For primitive synthesis, PrimSynth successfully synthesizes multi-primitive exploitation chains with 82.4% strategy synthesis rate (SSR) when the public PoC is available and a 61.3% SSR without the guidance of primitive hypotheses.

I. INTRODUCTION

PRIMSYNTH addresses the gap between conceptual Linux kernel exploit strategies and concrete operations by formalizing exploit primitives and coordinating agents for their discovery, validation, and synthesis. Evaluated across real-world CVEs, it extracts primitives reliably and synthesizes multi-primitive chains under both guided and unguided conditions.

  • Linux kernel vulnerabilities propagate into cloud infrastructure, web services, and embedded devices, motivating systematic reproduction and automated exploitability assessment.
  • The central challenge is translating conceptual exploit strategies into procedurally technical operations, much of whose knowledge remains with human experts.
  • Prior primitive research often targets one vulnerability type or exploitation phase and lacks general validation for localizing, extracting, and composing reproducible primitives.
  • PRIMSYNTH combines systematic primitive characterization with a tool-augmented multi-agent framework that iteratively discovers, validates, synthesizes, and chains primitives.
  • The validation method uses vulnerability-directed execution and a rebootable environment to ground candidate objects and accumulate primitive reproduction through path exploration.
  • 82.4% SSR is achieved with public PoC guidance and 61.3% without it across 16 CVEs spanning 5 vulnerability types; average end-to-end synthesis takes 72.4s.

III. EXPLOIT PRIMITIVE CHARACTERIZATION

The paper characterizes six Linux kernel exploit primitive types and defines an execution-oriented strategy contract that binds primitive chains to synthesis rules, validation signals, and code-generation actions.

  • Primitive Abstraction: Exploit primitives serve as intermediate abstractions between vulnerability triggers and end-to-end exploits, enabling systematic primitive identification through shared objects or gadget patterns.The framework targets identical objects or gadget patterns that constitute general capabilities.
  • Primitive Classification: Six primitive types—OOB, UAF, Double-Free, Arbitrary-Write, CFH, and Info-Leak—are formalized as logical predicates over memory operations, control flow, and data dependencies.The predicates provide a capability view of established primitive classes.
  • Strategy Representation: The strategy representation S = ⟨P, B, K, V, G, A⟩ combines an ordered primitive chain, synthesis rules, discovery knowledge, validation oracles, synthesis constraints, and final artifacts.P contains the primitive chain; B contains rules between consecutive primitives; K, V, G, and A capture discovery, validation, synthesis, and artifact information.
  • Strategy Representation: Each transition rule Ψ_i constrains candidate objects, temporal ordering, environment prerequisites, and validation signals before code generation proceeds.The constraints cover required objects and offsets, allocation/free/reuse timing, kernel and runtime prerequisites, and minimum confirming signals.
  • Validation: Validation combines static object layouts and field offsets, memory-error semantics and offsets, debugger-tracked object lifecycles, and execution-path evidence.These signals support object selection, corruption confirmation, timing verification, and reachability analysis.

C. Representation Mappings for Agent Pipeline

The agent pipeline maps discovery knowledge, validated strategy constraints, and synthesis rules into executable exploit artifacts through coordinated Discovery, Validation, and Synthesis stages with feedback.

  • Representation Mappings: Three mappings connect the representation to the pipeline: discovery populates K, validation maps (P, B, K) to V, and synthesis maps validated inputs to (G, A).The mappings ground candidate objects, primitive hypotheses, validation signals, code patterns, and synthesized artifacts.
  • Representation Mappings: The reusable strategy components are separated from environment-specific constraints, allowing strategies to be adapted across Linux versions or subsystems after re-validation.Environmental rules Ψenv_i are isolated and re-checked for each case.
  • Agent Pipeline: PRIMSYNTH executes Discovery, Validation, and Synthesis in sequence and closes the loop through structured validation feedback.Discovery gathers facts, Validation confirms feasibility and evidence, and Synthesis composes validated primitives into exploit artifacts.
  • Agent Pipeline: The collaboration loop follows plan → tool selection → action → critique → fallback, with validation outcomes feeding revisions of paths or synthesis strategies.Discovery materializes vulnerability location marks, Validation derives candidate objects and primitive paths, and Synthesis consolidates validated primitives.

B. Factual Knowledge Discovery

The Discovery and Validation stages transform vulnerability reports into confidence-tagged case knowledge, then use vulnerability-directed execution and machine-observable signals to identify and assess primitive hypotheses.

  • Factual Knowledge Discovery: The Discovery Agent uses a structured two-phase procedure: fact retrieval followed by knowledge construction.The procedure transforms raw vulnerability reports into actionable structures for downstream analysis.
  • Factual Knowledge Discovery: Fact retrieval combines structured parsing with semantic web search across CVE, NVD, advisories, repositories, and patch archives.It extracts affected software and versions, CWE classifications, patches, commit diffs, and vendor bulletins.
  • Factual Knowledge Discovery: Knowledge construction normalizes entities and relations while mapping PoCs, crash reports, and procedural illustrations into structured reproducibility context.The resulting knowledge graph relates vulnerability locations to affected components and encodes triggering conditions and entry points.
  • Factual Knowledge Discovery: The normalized case profile contains vulnerability facts, candidate entry syscalls and locations, step-wise primitives, and environment-gating requirements with confidence tags.Confidence tags distinguish high-certainty anchors from speculative hypotheses, and contradictions can be reported downstream.
  • Primitive Identification: The Validation Agent directs fuzzing toward vulnerability location marks, identifies reached candidate objects, and ranks primitive hypotheses with expected side effects.It groups prerequisite allocation, free, use, and function-pointer operations along the vulnerability-triggering path.
  • Primitive Validation: Validation evaluates hypotheses using KASAN memory errors and traces, debugger observations, and static LLVM-based object, alias, and pointer analyses.The framework aggregates nine signals across KASAN, debugger, and static layers into confirmed or rejected outcomes.

D. Primitive Extraction and Synthesis

After validation, PRIMSYNTH extracts confirmed operation slices into reusable primitive-path snippets and composes them into multi-primitive exploit artifacts through an execution-grounded loop.

  • Primitive Extraction and Synthesis: The Synthesis Agent extracts primitive-path code snippets from validated candidate objects and composes them into multi-primitive exploit artifacts.Composition follows the primitive path code synthesis rules.
  • Primitive Extraction and Synthesis: Confirmed operation slices are consolidated into compact, strategy-ready snippets, while transitions unsupported by validation signals are removed.The rules Ψ_i govern executable code between consecutive primitive steps.
  • Execution-Grounded Synthesis: Signal acquisition combines KASAN corruption reports, execution traces for control-flow reachability, and debugger watchpoints for object lifecycle tracking.These signals provide evidence for confirming primitive-path synthesis rules.
  • Execution-Grounded Synthesis: Each primitive path must satisfy object-grounded synthesis rules, including an example OOB rule requiring trace evidence of corruption in candidate msg_msg headers.The example connects the rule to a specific candidate object and validation signal.
  • Execution-Grounded Synthesis: Code generation instantiates validated templates only after object, temporal, environment, and validation constraints are met.When candidate-object fields are underspecified, strategy-guided exploration generates alternative paths targeting objects such as sk_buff.
  • Execution-Grounded Synthesis: Generated artifacts are re-injected into the Validation Agent, forming an iterative execution-grounded synthesis loop.Validation feedback therefore remains part of artifact generation rather than only a final check.

3) Signal-driven Strategy Selection:

PrimSynth selects and upgrades primitive-generation strategies from validation signals, using persistent tool-augmented agents and clean replayable environments to ground synthesized paths in candidate-object behavior.

  • Signal-driven Strategy Selection:: S7–S9 object-grounded signals determine whether primitive upgrades, such as OOB → InfoLeak → Arbitrary-Write, are structurally feasible.The Synthesis Agent dynamically instantiates upgrading strategies according to observed object transitions.
  • Signal-driven Strategy Selection:: Validation signals select between template-based generation for confirmed candidate objects and strategy-guided generation when observations are incomplete or inconsistent.S1–S3 signals support template instantiation; missing lifecycle, offset, or reachability evidence triggers iterative discovery and strategy refinement.
  • Signal-driven Strategy Selection:: The implementation couples directed fuzzing, multi-agent orchestration, MCP-accessible tools, a knowledge base, and a rebootable QEMU validation environment.Persistent case-level states connect static vulnerability facts with runtime observations and synthesis outcomes.
  • Signal-driven Strategy Selection:: Each iteration starts from a clean snapshot, records execution artifacts, and can be reset and replayed with adjusted strategy parameters while preserving iteration history.Intermediate synthesized PoCs are repeatedly replayed to verify that validation signals satisfy path constraints before later-step transfer.

VI. EVALUATION

The evaluation tests primitive extraction, synthesis utility, end-to-end reproduction, and efficiency across a benchmark of Linux kernel vulnerabilities under varying information conditions.

  • VI. EVALUATION: The evaluation asks four questions covering primitive extraction accuracy, executable synthesis, end-to-end reproduction against baselines, and runtime or LLM performance.These questions correspond to RQ1–RQ4.
  • VI. EVALUATION: The benchmark contains 16 Linux kernel vulnerabilities across five types, with 25% lacking public exploitation descriptions or executable PoCs.The types are OOB, UAF, Double-free, Race, and Integer Overflow.
  • VI. EVALUATION: The study compares PRIMSYNTH with prior tools at their closest supported capabilities because no existing baseline covers the full workflow.The supplied setup also records EPSS scores from the FIRST.org API.
  • VI. EVALUATION: PMR measures validated primitive and candidate-object matches, while OFLA measures object-field localization under static-dynamic alignment constraints.Together, the metrics assess semantic correctness and operational grounding; OFLA above 0.8 indicates accurate localization.

2) Results:

PrimSynth achieves reliable primitive extraction by combining systematic characterization with directed execution and static analysis, substantially narrowing candidate objects while preserving validated matches.

  • 2) Results:: 100% PMR is achieved across all 16 CVE cases, while OFLA ranges from 65% to 92% across differing localization challenges.OFLA varies by vulnerability type, reflecting structure-field, lifecycle, and race-related localization complexity.
  • 2) Results:: PrimSynth identifies valid primitive paths for vulnerabilities without public PoC documentation, including a USB Audio OOB chain and a Race-to-UAF IPv6 MLD case.These cases use object-layout analysis, trace validation, lifecycle tracking, directed mutation, and static analysis.
  • 2) Results:: 96% average candidate recall with 4.2 iterations is achieved by the full SyzDirect-plus-PODE combination, versus 45% recall and 18.5 iterations for the Discovery Agent alone.Adding SyzDirect alone raises recall to 70% through concrete execution traces.
  • 2) Results:: 98.5% candidate-space reduction, from 340 to 5.2 average candidates, accompanies a 100% primitive match rate and OFLA of 0.65–0.92.The integrated approach also identifies alternative paths beyond documented PoC techniques.
  • 2) Results:: SSR measures how completely synthesized code implements primitive-path transitions, while SYR and SMR measure compilation and signal-validated semantic completion.SSR uses per-constraint fulfillment across object, temporal, environment, and signal requirements.
  • 2) Results:: Four information conditions range from full PoC and mitigation details to CVE metadata only, exposing which missing information and tools affect synthesis.The conditions are L4-Complete, L3-Partial-PoC, L2-Partial-Patch, and L1-Minimal.

2) Results:

Synthesis performance declines as exploit guidance and validation constraints are removed, but signal-coupled tools extend coverage to difficult and previously unsupported primitive chains.

  • 2) Results:: 70–88% SSR is achieved for standard OOB/UAF cases under L4-Complete information, while race-conditioned cases reach 42–45% SSR because of timing instability.L1-Minimal synthesis yields only 12–32% SSR across cases.
  • 2) Results:: 61.3% SSR without public PoC guidance versus 82.4% with public PoCs represents a 21.1% SSR degradation and doubles average iterations from 4.8 to 9.6.End-to-end success also drops from 72% to 38% without PoC guidance.
  • 2) Results:: SyzDirect provides 84% candidate recall, PODE reaches 81% field-localization accuracy under L2 constraints, and dbg-tool achieves 35–55% race reproducibility.These tools compensate for absent object identity, structural, and lifecycle information.
  • 2) Results:: Signal-coupled compensation narrows candidates with S2/S3, validates loops with S4–S6, and recovers structural constraints through PODE-assisted S7–S9 inference.The observed breakdowns concentrate on object identity, primitive upgrades, timing control, and step sequence.
  • 2) Results:: 82.4% SSR with public PoCs and 61.3% without demonstrates multi-primitive chain synthesis under both guided and primitive-hypothesis-free conditions.Across six overlapping baseline cases, PRIMSYNTH reaches 70–75% SSR where KOOBE and AlphaExp both fail on Double-Free and IntOverflow→OOB chains.

2) Ablation Study: Agent Collaboration:

The ablation shows that validation-grounded multi-agent collaboration substantially improves synthesis success and reduces iteration cost, while stage-specific model selection and tool integration shape efficiency and coverage.

  • Agent Collaboration: 2.1× SSR improvement separates Full Collaboration from Synthesis-Only, confirming the importance of validation-grounded feedback.Full Collaboration reaches 45%–88% SSR in 3–9 iterations, versus 15%–42% SSR in 12–23 iterations for Synthesis-Only.
  • Overall Effectiveness: 77.13% average SSR extends synthesis beyond baseline tools restricted to particular vulnerability classes or isolated object identification.PRIMSYNTH handles complex steps where those baselines fail completely.
  • Efficiency: 72.4s average end-to-end synthesis time is dominated by Validation, which consumes 45.4s or 63% of the pipeline.Discovery takes 9.8s and Synthesis 17.2s on average.
  • LLM Selection: Agent-specific model assignment contributes an 8–15% SSR gain over uniform deployment, with different models specializing in Discovery, Validation, and Synthesis.GPT-5.3 leads Synthesis, Qwen3 leads race-case Validation, and GPT-4 leads Discovery.
  • Implications and Validity: PRIMSYNTH supports evidence-backed exploitability reasoning but does not replace expert judgment under full mitigation constraints.The evaluation assumes disabled or permissive SMEP/SMAP, while KPTI, CFI, and pointer authentication remain outside the validation scope.
  • Information Availability: 61.3% SSR without public PoC guidance demonstrates synthesis in information-scarce scenarios, although absent guidance increases computational overhead and completeness limitations.The framework combines static analysis and directed execution to compensate for missing reference guidance.
  • Synthesis Patterns: Object identity hints and strategy-step sequences are the most information-critical synthesis inputs, with their absence causing 30–35% and 18–22% SSR degradation, respectively.The effects arise from larger candidate spaces and the need to infer operation ordering.

VIII. RELATED WORKS

The related work spans kernel vulnerability reproduction, automated exploit generation, and LLM-driven security analysis; PRIMSYNTH combines these directions with formal primitive representations and multi-agent tooling.

  • Kernel Vulnerability Reproduction and Assessment: Kernel vulnerability assessment research includes capability analysis, configuration-gap bridging, cross-version assessment, reverse fuzzing, and agentic N-day reproduction.These efforts connect bug discovery with exploitability and reproduction across environments or versions.
  • Automated Kernel Exploit Generation: Automated kernel exploit generation has addressed use-after-free exploitation, control-flow hijacking primitives, and out-of-bounds write capability analysis.Prior systems include FUZE, KEPLER, and KOOBE.
  • LLM-Driven Vulnerability Analysis and Exploit Generation: LLM-based security research has explored autonomous one-day exploitation, large-scale kernel bug discovery, multi-agent network attacks, and complex code generation.These studies establish LLMs and multi-agent systems as tools for automated security tasks.
  • PRIMSYNTH: PRIMSYNTH addresses the identified gaps by combining formal notations with static analysis, directed fuzzing, and LLM-based reasoning.Its framework targets automated discovery, validation, and synthesis of Linux kernel exploit primitives.

APPENDIX

The appendix examines how tool combinations, lifecycle information, object identity, temporal constraints, and environmental details affect primitive synthesis across representative CVEs.

  • Tool Combination: 96% average recall with 4.2 iterations results from combining static structural analysis with dynamic validation signals.For CVE-2022-0995, SyzDirect raises recall from 43% to 79%; PODE achieves 93% recall for CVE-2022-2588 Double-Free cases.
  • Alternative Primitive Paths: Tool-assisted analysis discovers alternative primitive paths beyond public PoC strategies, including route4_filter-to-skbuff UAF and pipe_buffer arbitrary file write paths.These alternatives avoid documented intermediate steps such as kcmp detection or information leakage.
  • Double-Free: Double-Free synthesis depends on object lifecycle synchronization, with reduced SSR when credential reallocation timing details are removed.CVE-2021-22600 falls from 70% to 58% under the reduced constraint setting.
  • Integer Overflow: Integer-overflow cases identify wraparound mechanisms through S1–S2 signals, but primitive upgrading still depends on object identity and layout information.The required targets include msg_msg placement and nft_payload structure layout.
  • Use-After-Free: CVE-2022-1043 falls from 82% to 68% SSR when CPU-affinity timing and lifecycle tracking are unavailable for its io_uring personality UAF chain.The missing information prevents validation of the iteration wraparound mechanism.
  • Environmental Constraints: CVE-2022-27666 falls from 72% to 58% when FUSE page-fault coordination is removed, leaving address disclosure successful but arbitrary-write construction incomplete.Metadata-only synthesis yields 12–32% SSR overall, with race-conditioned cases performing worst at 12–18%.
  • No-PoC Cases: A no-public-PoC USB Audio case reaches 68% SSR by combining static structure analysis with directed syscall mutation.The approach identifies both the configuration-parsing path and relevant object layout.
  • Information Availability: The no-public-PoC performance gap varies by vulnerability class: canonical OOB cases retain stronger grounding, whereas temporal or cross-cache chains suffer more.For CVE-2024-53197, the reported comparison is 68% versus 85% for PoC-guided OOB cases.
Loading 2609.02647v1…