Privilege Escalation in udev via NETLINK Message Forgery

This repository is a collection of 17 files covering five historical Linux-kernel local privilege-escalation CVEs: CVE-2009-1185, CVE-2009-1337, CVE-2009-2692, CVE-2009-2698, and CVE-2009-3547. It contains 10 executable source/script files (six C programs and four shell scripts), six Markdown README/reference files, and an MIT license. It is not a Metasploit, Nuclei, or other framework module collection. The CVE-2009-1185 shell script builds a malicious LD_PRELOAD library and forges a NETLINK_KOBJECT_UEVENT directed at a supplied udev netlink PID, causing privileged execution of the library constructor and creation of /tmp/suid. CVE-2009-1337 builds a clone/exit_notify exploit that abuses setuid chfn/gpasswd behavior to generate a core file in /etc/logrotate.d; the injected configuration later makes /tmp/.m setuid-root. CVE-2009-2692 includes two sendfile-related local root exploits: the larger wunderbar_emporium implementation resolves kernel symbols, triggers vulnerable socket families, obtains kernel execution, escalates credentials, and attempts to disable SELinux/AppArmor/LSM protections; its wrapper selects direct null-page, SELinux runcon, or setuid Pulseaudio shared-library routes. The smaller 9436 variant maps page zero, uses a PF_PPPOX socket and sendfile trigger, overwrites credentials, and starts a root shell. CVE-2009-2698 uses an ip_append_data()/UDP socket trigger after installing a null-page trampoline, then modifies task credentials and launches a shell. CVE-2009-3547 is a 32-bit fs/pipe.c race/structure-corruption exploit supporting several Linux 2.6 pipe-layout eras; it races pipe descriptors through /proc/<pid>/fd/4 and modifies task credentials before opening a root shell. No external command-and-control, download, or fixed remote target is present. Socket calls are local triggers for vulnerable kernel networking/protocol code, rather than connections to a remote host.

This repository contains a single Metasploit module: 'modules/exploits/linux/local/udev_netlink.rb'. The module exploits a local privilege escalation vulnerability in Linux udev versions prior to 1.4.1 (CVE-2009-1185). The vulnerability arises because udev does not verify that netlink messages are sent from the kernel, allowing a local attacker to send crafted netlink messages and execute arbitrary commands as root. The module is written in Ruby and integrates with Metasploit, but it also generates and compiles a C payload on the fly. The exploit works by: - Determining the netlink PID associated with the udev daemon (either automatically or via user input). - Writing a Metasploit payload (e.g., shell, meterpreter) as an executable to a writable directory (default: /tmp). - Generating and compiling a C program that crafts and sends a malicious netlink message to udev, instructing it to execute the payload as root. - Executing the C program, which triggers the vulnerability and runs the payload. Key fingerprintable endpoints include the use of /tmp for payload storage, /proc/net/netlink for PID discovery, and fake device paths under /dev. The exploit is operational and provides local privilege escalation on vulnerable systems.