Linux kernel Netfilter nf_tables batch-request use-after-free

This repository is a compact exploit repo containing one real exploit source file (exploit.c) plus two Markdown documents: ORIGIN.md with the original technical write-up and README.md with reproduction notes and root-cause analysis. It is not part of a larger exploit framework. The exploit targets CVE-2023-32233, a use-after-free in the Linux kernel nf_tables subsystem. The bug is triggered by sending a crafted nftables batch where a rule deletion implicitly frees an anonymous set and a subsequent set-element deletion in the same batch still references that freed set. The PoC races the kernel destroy worker, reuses the freed nft_set with a different object type, and turns the stale dereference into a controlled type-confusion/corruption primitive. From the documentation and visible code, the exploit chain is: win the race in nf_tables_trans_destroy_work(); corrupt nft_set_ext interpretation; spray and reclaim heap objects using nft_log and nft_object->udata; use nft_dynset-created nft_counter objects to leak nf_tables.ko addresses; use nft_quota objects for arbitrary kernel memory read/write; derive kernel base; overwrite modprobe_path from /sbin/modprobe to //tmp/modprobe; then obtain root code execution. The main function supports either exploitation mode or a post-exploitation mode that verifies privileges, calls setuid(0)/setgid(0), and execves a target program, defaulting to /bin/sh. The code is operational rather than a mere PoC description: it contains hardcoded timing knobs, kernel offsets for Ubuntu 23.04's 6.2.0-20-generic kernel, profile-loading support for retargeting, CPU-affinity/race orchestration, and explicit root-shell execution logic. The README also notes required build dependencies (libmnl, libnftnl) and explains how to generate a profile from /proc/kallsyms for other kernels. Overall, this is a genuine local privilege-escalation exploit for vulnerable Linux kernels with nf_tables access, not a detector or fake sample.

This repository contains a working local privilege escalation exploit for CVE-2023-32233, a use-after-free vulnerability in the Linux kernel's Netfilter nf_tables component. The exploit is implemented in C (exploit.c) and is accompanied by detailed documentation (README.md, ORIGIN.md) describing the vulnerability, exploitation strategy, and build instructions. The exploit works by racing the kernel's background worker thread to manipulate freed memory, allowing arbitrary kernel memory read/write. It leaks kernel addresses, overwrites the modprobe_path to point to a user-controlled binary (e.g., /tmp/modprobe), and then triggers execution of this binary as root, effectively granting full root privileges. The exploit is operational and requires a vulnerable kernel (e.g., Ubuntu 23.04 with kernel 6.2.0-20-generic) and sufficient privileges to interact with nf_tables. The code is not part of a framework and is a standalone PoC with a weaponized payload. Notable fingerprintable endpoints include the original and overwritten modprobe_path and /etc/shadow, which is accessed to demonstrate privilege escalation.

This repository contains a working local privilege escalation exploit for CVE-2023-32233, a use-after-free vulnerability in the Linux kernel's Netfilter nf_tables subsystem. The exploit is implemented in C (exploit.c) and is accompanied by a detailed README.md explaining the vulnerability, exploitation strategy, and technical background. The exploit works by racing the kernel's background worker thread to achieve a use-after-free, leaking kernel addresses, and obtaining arbitrary read/write primitives. It then overwrites the kernel's modprobe_path to point to a user-controlled binary (e.g., /tmp/modprobe), which is executed as root, granting full root privileges to the attacker. The exploit is tailored for Ubuntu 23.04 with kernel 6.2.0-20-generic but can be adapted to other kernels by adjusting configuration parameters. The repository also includes build and usage instructions (exploit.md). The main attack vector is local, requiring the attacker to execute code on the target system. The exploit demonstrates advanced kernel exploitation techniques and is operational, providing a reliable privilege escalation path on vulnerable systems.