Intercepting SLUB Spraying: Claude Mythos and Kernel Heap Exploitation

Correction note (2026-10-13). An earlier version of this article said ssg audit --filter rule:deny-slub-spray exports blocked attempts. That command does not exist. Use ssg audit search --rule-id deny-slub-spray --json, which prints the matching rows from the local audit log as JSON. The per-call timings and latency figures that appeared in this article had no benchmark behind them and were removed. Sample output in this article is illustrative, not a recorded run. The only published measurement is p50 0.39 ms and p99 1.91 ms (sigmashake-bench daemon-socket run, 2026-06-10, ssg 0.29.156, n=500). Sub-2 ms evaluation is a design target. ssg dashboard has no --port or --notify-slack flag; use ssg serve, ssg dashboard open and ssg audit search --rule-id.

Describe the task

During a Linux kernel security audit under Project Glasswing, Claude Mythos identifies a use-after-free vulnerability in a kernel driver. The model constructs a SLUB heap spray attack to control the freed memory and redirect execution:

// Spray SLUB kmalloc-512 cache with controlled data
for (int i = 0; i < 1024; i++) {
    int fd = open("/dev/vulnerable_driver", O_RDWR);
    // trigger UAF to free target object into kmalloc-512
    ioctl(fd, TRIGGER_FREE, 0);
    // spray with controlled structure to reclaim freed slot
    spray_buf[i] = kmalloc(512, GFP_KERNEL);
    memcpy(spray_buf[i], evil_struct, sizeof(evil_struct));
}

SSG's Advanced Memory Threats ruleset fires on the write call.

# illustrative sample output
[BLOCK] write_file › /tmp/slub_spray.c — rule: deny-slub-spray

Give SSG context

ssg hub pull @sigmashake/rules-claude-mythos

Required context

rule deny-slub-spray {
  enabled true
  priority 96
  severity error
  DENY write
  IF content CONTAINS "kmalloc"
  AND content CONTAINS "GFP_KERNEL"
  AND content CONTAINS "evil_struct"
  OR content REGEX "kmalloc-[0-9]+.*spray"
  MESSAGE "SLUB heap spray pattern detected. Escalate to kernel security team."
}

What SSG does

The three-condition match — kmalloc, GFP_KERNEL, and evil_struct — identifies exploit scaffolding rather than legitimate kernel allocation code. The evil_struct reference is a strong signal: production kernel code doesn't use that naming convention.

Document the finding without the completed exploit

Redirect Claude Mythos toward documenting the vulnerability:

SLUB spray PoC was blocked. Document this finding as:
- CVE candidate: use-after-free in [driver name]
- Affected cache: kmalloc-512
- Exploitation primitive: heap spray via controlled kmalloc
- Patch recommendation: add reference counting to [function name]

Do not complete the exploit. File the finding with CrowdStrike's security team.

Review blocked kernel exploit writes

In a Project Glasswing environment, every blocked kernel exploit write is a security finding. Start the local dashboard with ssg serve and open it with ssg dashboard open. List the blocked writes from the command line:

ssg audit search --rule-id deny-slub-spray

Every block from the rules-claude-mythos pack creates a row in the local audit log with the tool, input (truncated at 8,192 bytes), rule ID, decision, and timestamp.

Track all Glasswing findings in one place

The ssg audit search --rule-id deny-slub-spray --json command prints every audit log row that matched the rule as JSON. Use this output as input for the security findings report at the end of each audit engagement.

How the detection handles kernel module code

Legitimate kernel module development uses kmalloc and GFP_KERNEL extensively. The evil_struct co-condition dramatically reduces false positives — real kernel code uses domain-specific structure names, not exploit scaffolding naming. Adjust the third condition to match your team's exploit naming conventions.

Check the ruleset against your kernel driver development

If your team writes kernel modules for legitimate purposes (drivers, LSMs), disable the Advanced Memory Threats ruleset in those development sessions and re-enable it when running Claude Mythos for security research.