Blog

Introduction

In the previous post of this series, we exploited the vulnerability and managed to escalate privileges by executing a shell as the root user. We also addressed an issue during the execution of the exploit, ensuring system stability throughout the process.

However, the entire exploitation was performed with mitigations disabled. When setting up the environment—as shown in the first part of this series—we configured it with mitigations disabled to facilitate our analysis and testing. This is a widespread practice when conducting vulnerability research and exploit development.

Now that we have exploited the vulnerability successfully, we will enable the mitigations individually. Next, we will bypass them to ensure our exploit functions even in environments where these protections are active. The mitigations we will bypass are Supervisor Mode Execution Protection (SMEP) and Kernel Address Space Layout Randomization (KASLR). Others, such as Supervisor Mode Access Prevention (SMAP) and Kernel Page Table Isolation (KPTI), will remain disabled, and we will explain the reasoning behind this at the end of the post.

Introduction

In the first post of this series, we configured the environment required to work on a Linux kernel vulnerability. In the second post, we successfully triggered the vulnerability using C code. Now, we will dive deeper into the kernel’s internal state to better understand it and expand our code into a functional exploit for privilege escalation.

Our goal in this post is to exploit it using the ret2usr (return-to-user) technique. While modern hardware and software mitigations have made this technique less viable, it remains a good introductory technique for learning Linux kernel exploitation. By mastering this classic technique, you will build the conceptual foundation necessary for our final post, where we will bypass SMEP mitigation using Return-Oriented Programming (ROP).

Beyond successfully gaining a root shell, our objective is to ensure the system remains stable and continues to function correctly after the exploit. Post-exploitation instability is a common challenge; because the kernel is the system’s core, any orphaned pointers or corrupted counters can lead to a crash. It is our responsibility to investigate these unstable states, understand their root causes, and restore the system’s equilibrium.

Introduction

In the previous post of this series, we presented an introduction to exploiting vulnerabilities in the Linux kernel. We set up the environment that allows us to work on the vulnerability chosen for this series. In this post, we will trigger the vulnerability through our proof of concept written in C. By doing this, we take an essential step towards successfully exploiting the vulnerability to achieve our end goal: a Local Privilege Escalation (LPE) bypassing most of the modern mitigations.

Fortunately, the commit (36eec020fab66 net: sched: fix NULL pointer dereference in mq_attach) that fixes the vulnerability also includes shell commands that trigger the vulnerability in its description. So, we already have a great starting point.

1) ip link add bond0 type bond
2) ip link set bond0 up
3) tc qdisc add dev bond0 root handle ffff: mq
4) tc qdisc replace dev bond0 parent ffff:fff1 handle ffff: mq

We will start by using shell commands to trigger the vulnerability, and at the end, we will have a C program that accomplishes that same goal and goes a bit further, preparing the scene for a proper exploit. By writing it in C code, we can understand the pieces better, trigger the vulnerability with greater precision, create payloads to be executed, and so on.

Introduction

We conducted an online training course titled “Introduction to Linux Kernel Exploitation” between September and October 2024. The course was delivered in Portuguese. A few months before the start date, we published a series of blog posts exploiting a vulnerability in the Linux kernel to give attendees a preview of the curriculum. We believe many introductory materials for Linux kernel exploitation available online are not well-suited for newcomers. They often jump directly into complex heap manipulation strategies that are difficult for beginners to grasp. Our course, however, serves as a foundational introduction to the topic even for those who do not intend to work as security researchers.