a13xp0p0v / kernel-hack-drill Goto Github PK

The UAF exploit is successfully launched on my Qemu VM and I see the uid changes to 0.

But for the second exploit, after applying the trick at [1], the NULL memory area is still not writable and then Segmentation fault occurs.

drill@syzkaller:~$ ./drill_exploit_nullderef 
begin as: uid=1000, euid=1000
payload address: 0x55b911775349
[+] /proc/$PPID/maps:
00010000-00011000 rw-p 00000000 00:00 0 
Segmentation fault

My configuration

Kernel version: 5.8.9
Command line: pti=off oops=panic ftrace_dump_on_oops nokaslr
Normal user: uid=1000, euid=1000

If you need any more information, please let me know.

My fork repository prepares QEMU VM as the environment for those Linux kernel exploitation experiments. All the detailed processes are shown in the README.md. And I could reproduce those crashes in my own QEMU VM.

I create this issue to kindly request comments for my fork repository.