Out-of-Bounds Write in Linux Kernel netfilter (nf_tables_api.c)

This repository contains a proof-of-concept (PoC) local privilege escalation exploit for CVE-2022-1015, an out-of-bounds read/write vulnerability in the Linux kernel's nf_tables subsystem. The repository consists of three files: a detailed write-up (writeup.md), a README with build and usage instructions, and the main exploit code (exploit.c). The exploit is written in C and leverages the nf_tables API via libmnl and libnftnl to create custom tables and chains, then injects crafted rules to leak kernel addresses and execute a ROP chain for privilege escalation. The exploit operates in two stages: first, it leaks the kernel base address using UDP packets sent to 127.0.0.1 on port 50005; second, it triggers the ROP chain using TCP packets on port 50006, ultimately granting root privileges to the attacker. The exploit is a PoC and requires adaptation for different kernel builds due to varying offsets and ROP gadgets. No remote or network attack vector is present; the exploit must be run locally on a vulnerable system.

This repository is a proof-of-concept (PoC) exploit for CVE-2022-1015, a local privilege escalation vulnerability in the Linux kernel's nf_tables component. The exploit is implemented in C and consists of three main code files: 'pwn.c' (main exploit logic), 'helpers.c', and 'helpers.h' (utility functions for interacting with nftables and networking). The Makefile is provided for building the exploit, which requires libmnl, libnftnl, and appropriate Linux kernel headers. The exploit works by creating and manipulating nftables tables, chains, and rules to leak kernel addresses via UDP packets and then installing a kernel ROP chain to escalate privileges. The exploit is highly unstable and may cause kernel panics; it is intended for research and demonstration purposes. The README provides detailed build instructions, affected kernel versions, and caveats regarding exploit reliability. No remote or network attack vector is present; the exploit must be run locally on a vulnerable system.

This repository contains a local privilege escalation exploit for CVE-2022-1015, a vulnerability in the Linux kernel's nftables subsystem. The exploit is implemented in C (main file: ex.c) and leverages out-of-bounds (OOB) read/write in the kernel stack via crafted nftables rules. The exploit works in two stages: first, it leaks the kernel base address by installing specific nftables rules and sending/receiving UDP packets on localhost (127.0.0.1, port 31337). Then, it installs a second set of rules and sends a ROP chain payload to escalate privileges by calling commit_creds(init_cred), ultimately spawning a root shell. The exploit requires the ability to create new user and network namespaces and interacts with several /proc files to set up the required environment. The repository includes a Makefile for building the exploit, a README.md with technical details and kernel code references, ex.c (the main exploit logic), and utils.h (helper functions for namespace and nftables manipulation).