Linux kernel HFSC reentrant enqueue use-after-free

Repository contains a local Linux kernel privilege-escalation PoC for CVE-2025-38001 (HFSC scheduler eltree/RB-tree use-after-free). Structure: (1) exploit.c is the main exploit implementing namespace sandboxing, heap grooming, vulnerability trigger, and privilege escalation; (2) netlink_utils.h provides minimal static-link-friendly Netlink/RTNETLINK helpers to craft and send traffic-control (qdisc/class) messages; (3) Makefile builds a static binary; (4) README.md (Indonesian) documents that it is for research/learning and shows a successful root escalation on kernel 6.1.0-30-amd64. Exploit capabilities and flow (high level): - Sets up a sandbox with unshare(CLONE_NEWNS|CLONE_NEWUSER|CLONE_NEWNET), writes /proc/self/setgroups, /proc/self/uid_map, /proc/self/gid_map, and raises RLIMIT_NOFILE to allow many FDs. - Uses RTNETLINK (NETLINK_ROUTE) to create many dummy network interfaces and configure traffic control objects (qdisc/classes). The code includes handlers for qdisc/class types: tbf, hfsc, and netem, indicating it programs HFSC structures to reach the vulnerable code path. - Performs heap shaping/spraying using AF_PACKET PACKET_TX_RING allocations (page-vector allocations) and heavy FD spraying with pipes and signalfd objects. - After triggering the HFSC UAF, it searches sprayed memory (via pipe reads) for a marker pattern and then performs repeated partial overwrites by manipulating file->private_data to point into cred fields, using signalfd allocations to drive writes that zero out credential fields (the snippet indicates writing task credentials to zero via signalfd4()). - On success, it opens /proc/sys/kernel/modprobe (likely as a privilege/primitive check) and spawns an interactive root shell via system("/bin/sh"). No external network C2 endpoints are present; all interactions are local kernel interfaces (netlink, packet sockets, procfs).

This repository contains a full exploit chain for CVE-2025-38001, a use-after-free (UAF) vulnerability in the Linux kernel's HFSC (Hierarchical Fair Service Curve) qdisc implementation. The exploit targets Linux kernels 5.15, 6.1, and 6.6 (LTS) and is designed for local privilege escalation. The structure includes: - Multiple C source files implementing the exploit logic (notably `solution/exploit.c` and `exploit/lts-6.6.90/exploit.c`). - Netlink utility headers for low-level kernel communication. - Bash scripts (`shared/trigger.sh`, `shared/i.sh`) to set up the vulnerable traffic control environment on the loopback interface using `tc` and `ip` commands. - A minimal kernel module (`hevd/pagedev.c`) for heap manipulation. - Build scripts for compiling the exploit and setting up the environment, including Docker support for static builds. The exploit works by: 1. Setting up a specific qdisc/class/filter configuration on the loopback interface to trigger the UAF in the HFSC qdisc's eligible tree. 2. Manipulating kernel heap allocations to control the freed object. 3. Using signalfd and file structure manipulation to overwrite process credentials in kernel memory. 4. Gaining root privileges and spawning a root shell. The exploit is operational and provides a working local privilege escalation payload. It requires the ability to create user and network namespaces and access to the traffic control subsystem. The repository is well-structured, with clear separation between exploit logic, environment setup, and build tooling.

This repository contains a local privilege escalation exploit for CVE-2025-38001, a use-after-free vulnerability in the Linux kernel's HFSC eltree code. The exploit is implemented in C (exploit.c) and is supported by a header file (netlink_utils.h) that provides utilities for communicating with the kernel via Netlink sockets. The Makefile compiles the exploit statically. The README.md provides background, usage notes, and references to the vulnerability analysis and upstream kernel fix. The exploit works by manipulating network interfaces and traffic control (tc) subsystems via Netlink, creating a use-after-free condition in kernel memory. It leverages user namespaces and sandboxing to set up the environment, then performs heap spraying and object manipulation to overwrite task credentials, ultimately spawning a root shell. The exploit is designed for Debian 12 and kernelCTF instances but may be adapted to other Linux distributions with minor changes. Fingerprintable endpoints include several /proc files used for namespace and privilege manipulation, and /proc/sys/kernel/modprobe, which is often targeted in Linux privilege escalation exploits. The attack vector is local, requiring the attacker to execute code on the target system. The exploit is a proof-of-concept (POC) and demonstrates successful privilege escalation to root.