Heap Out-of-Bounds Write in Linux Kernel Netfilter nft_fwd_dup_netdev_offload

This repository contains a local privilege escalation exploit for CVE-2022-25636, a vulnerability in the Linux kernel's nftables subsystem. The main exploit logic is implemented in 'exploit.c', which is a large C file that orchestrates the attack. The exploit leverages a 'pipe-primitive' technique to avoid the need for KASLR, SMAP, SMEP, or KPTI bypasses. The attack involves heap spraying, message queue manipulation, and use-after-free (UAF) primitives to gain arbitrary write capabilities in kernel memory. The exploit's end goal is to overwrite '/usr/bin/mount' with a statically embedded SUID shell binary, which is then executed to obtain root privileges. The repository also includes a set of header files under 'include/libmnl/' and 'include/libnftnl/' that provide userland interfaces to netlink and nftables, which are used by the exploit. The Makefile provides a static compilation recipe for the exploit. The exploit is operational and weaponized for local privilege escalation on vulnerable Linux systems. No network endpoints are involved; the attack is purely local and targets the file '/usr/bin/mount'.

This repository contains a local privilege escalation exploit for CVE-2022-25636, a vulnerability in the Linux kernel's nftables subsystem. The exploit is implemented in C and consists of several files: 'exploit.c' (main exploit logic), 'fakefuse.c' and 'fakefuse.h' (implementing a fake FUSE filesystem for heap spraying and synchronization), and 'util.c'/'util.h' (helper functions for message queues). The Makefile builds the exploit binary from these sources. The exploit works by creating and manipulating nftables tables and chains, performing heap spraying using FUSE and setxattr, leaking kernel addresses to bypass KASLR, and finally constructing a ROP chain to escalate privileges to root. The exploit targets the loopback device ('lo') and uses the mount point '/tmp/foo' for the FUSE filesystem. The README notes that the exploit is unstable (about 40% success rate) and may cause kernel panics or heap corruption on failure. The exploit is operational and provides a root shell if successful.