What the Experiments Show—and What They Do Not
This chapter evaluates the evidence behind Fence2Pwn rather than treating its attack diagram as a result. The specific question is how far the claimed allocation-path gap survives changes in measurement setting: controlled virtual machines, different victim objects and kernel versions, consumer devices, system stress, and a real vulnerability. Reading the experiments this way produces a useful judgment. The paper demonstrates a repeatable, conditional reuse capability in several tested environments, but it does not establish a universal success probability or an end-to-end privilege escalation.
The distinction matters because the study combines several kinds of evidence. Some experiments isolate one mechanism, such as timing or pointer tags. Others measure the success of a multi-stage overlap attempt. Still others show that the relevant allocation behavior appears on devices or under workloads closer to production. These results strengthen different parts of the argument. None should be used as a substitute for the others.
What the Controlled Tests Establish
The paper’s primary Fence2Pwn evaluation uses 100 independent virtual machines for each experiment. The researchers model a vulnerable use-after-free with a synthetic kernel module that can allocate and free objects while retaining a dangling reference. That setup gives them control over the lifecycle that the technique requires: the vulnerable object can be routed through KFENCE, freed, and later tested against a candidate victim object. The controlled model is not a weakness in itself. It answers whether the proposed mechanism works when its preconditions are deliberately supplied. It does, however, define what the resulting success rates mean.
The main victim in the controlled experiments is a cred object, which carries a process’s privilege information. The researchers treat an overlap as successful when the experiment can alter a relevant effective-UID field and observe the expected change. This outcome is stronger than merely observing two allocations in the same broad pool, because it tests whether the replacement’s layout and the stale access line up usefully. It is still narrower than a complete exploit chain: the experiment supplies the UAF and measures a chosen effect under controlled conditions.
The baseline results show that the technique is not a one-in-a-million accident in the authors’ test environment. With four victim credential objects, the table reports success rates as high as 90 percent in one configuration. When the experiment uses one vulnerable object and one victim object, success remains possible, with the listed runs in the low-to-high 30 percent range. The difference is informative. More victim allocations provide more opportunities for a reclaimed slot and therefore raise the observed chance of a useful overlap; a single-victim result shows that the technique does not depend entirely on a large target set.
Other entries vary the kernel version and victim object. The listed experiments on several kernel versions report success rates ranging from 52 to 75 percent for the credential target. The paper also reports 54 percent for a msg_msg victim and 34 percent for a pipe_buffer victim in its multiple-object experiments. These numbers are not a ranking of victim types or kernels. They show that the mechanism is sensitive to allocator behavior, object lifecycle, timing, and layout while remaining feasible beyond one exact version and one exact target.
The denominator is essential.