notselwyn / cve-2024-1086 Goto Github PK

I received a this error on several hosts when running the compiled exploit, can you advise what’s wrong?

I downloaded a binary from the release, and when trying to run, it gives me this error message:

Running on a Debian 12 VM with 6.1 kernel (which is supported by the exploit, as far as I understood):

What might be the issue?

Trying to replicate the exploit in kernel 6.2.0, the terminal prints this and the pc freezes.
Any feedback on what may be wrong?

[-] failed to detect overwritten pte: is more PTE spray needed? pmd: 00000000cafebabe

is failed? So Not vuln?

Kernel panic after running on Ubuntu 22.04 LTS.
nftables and namespaces are setup correctly.
SSH console:
t@localhost:~$ uname -sr

Linux 5.15.0-94-generic

t@localhost:~$ ./exploit [*] creating user namespace (CLONE_NEWUSER)... [*] creating network namespace (CLONE_NEWNET)... [*] setting up UID namespace... [*] configuring localhost in namespace... [*] setting up nftables... [+] running normal privesc [*] waiting for the calm before the storm... [*] sending double free buffer packet... [*] spraying 16000 pte's...

Screen:

I wasn't sure how or if you'd like to add this to the README, but I noticed it on my own installation and figured it might be important for others.

PS C:\Windows\system32> wsl --version
...
Kernel version: 5.15.146.1-2

The Ubuntu 22.04 WSL installation on Windows is currently affected by this, and standard Windows update methods don't patch it either.

PS C:\Windows\system32> wsl --update
Checking for updates.
The most recent version of Windows Subsystem for Linux is already installed.

It appears that the only way to patch this is to install the pre-release version of WSL (which itself may have bugs, but it's probably better than having a known root exploit)

PS C:\Windows\system32> wsl --update --pre-release

My kernel now reads this after the pre-release install:

Kernel version: 5.15.150.1-2

Hello,
We have noticed that in your POC video that the user in question is in the sudo group. If this is a pre-requisite then can it be documented please?

Thank you.

Is it possible for this to run with Android's default kernel configuration? I'm wondering if it could help with rooting

Even if running in a container or master, because you share the namespace of the host, this will still cause your rights session to be affected by the netfiler, which will cause the ssh or bounce shell session to be started and stopped
无论在在容器或者宿主机中运行，由于你共享了宿主机的namespace，这仍然会导致你的提权会话会受到netfiler的影响，这将导致ssh或者反弹shell中的会话会不断启停

kernel version: 5.4.0-164-generic #181-Ubuntu

(remote) ahope@nix01:/home/ahope$ ./exploit.1 
[*] creating user namespace (CLONE_NEWUSER)...
[*] creating network namespace (CLONE_NEWNET)...
[*] setting up UID namespace...
[*] configuring localhost in namespace...
[*] setting up nftables...
[+] running normal privesc
[*] waiting for the calm before the storm...
[*] sending double free buffer packet...
[*] spraying 16000 pte's...

[04:50:42] connection reset  
<box was down>

In the blog post, there is this paragraph: "This allows users to program complex firewall rules, because nftables has many atomic expressions which can be chained together in rules to filter packets. Additionally, it allows chains to be ran at different times in the packet processing code (i.e. before routing and after routing) which can be selected when creating a chain using flags like NF_INET_LOCAL_IN and NF_INET_POST_ROUTING. Due to this extremely customizable nature, nftables is known to be incredibly insecure. Hence, many vulnerabilities have been reported and have been fixed already."

Wait, nftables is insecure? I did some research on the internet and I do see more positive views of nftables than not. I'm using Linux and should I basically do a purge on that package?

The include directory contains third-party code without the required license notice.

• libftnl is GPLv2+.
• libmnl is LGPLv2.1+.
• Linux has a few different licenses.

You should put the required license notices at the root of each copy's directory.