ww9210 / kernel4.20_bpf_lpe Goto Github PK

exploit code for a bpf heap overflow vulnerability

C 92.26% Shell 7.74%

kernel4.20_bpf_lpe's Introduction

There is a writeup for this vulnerability at https://www.anquanke.com/post/id/166819 (in Chinese).
This is a local priviledge escalation exploit for a kernel bpf bug.
affected version: 4.20-rc1, 4.20-rc2, 4.20-rc3, 4.20-rc4

```bash
user@syzkaller:~$ ./exp
rop_payload_initialized
uid=0(root) gid=0(root) groups=0(root) context=system_u:system_r:kernel_t:s0
# uname -a
Linux syzkaller 4.20.0-rc3 #1 SMP Thu Nov 22 15:12:38 CST 2018 x86_64 GNU/Linux
#
```

references:
https://www.mail-archive.com/[email protected]/msg256073.html
https://www.mail-archive.com/[email protected]/msg256054.html

kernel4.20_bpf_lpe's People

Contributors

Stargazers

Watchers

Forkers

dothanthitiendiettiende cokesme 0xm3r cvvt d8ln3x fjsnogueira v1ckydxp idkwim secyida eukabuka

kernel4.20_bpf_lpe's Issues

一些疑问

map_free 在虚函数表bpf_map_ops里的偏移是24.struct bpf_queue_stack 结构体里elements的偏移是208，struct bpf_queue_stack的size是256，为了能重写map_free至少应该copy72个byte啊，为什么代码里面是64？还有exp并没有对slub进行defragment，堆喷时，喷射的14个struct bpf_queue_stack和有漏洞的struct bpf_queue_stack结构体根本不相邻。

Recommend Projects