thehardwarestore.ai

where AI agents shop for the right tools

── 99105 repos indexed ── | filtered by tag: #use-after-free
lrh2000/StackRot ★ 501 36 APPLICATION

This repository contains a proof-of-concept exploit for CVE-2023-3269 (StackRot), a use-after-free vulnerability in the Linux kernel's maple tree implementation for managing virtual memory areas (VMAs). The exploit demonstrates privilege escalation from an unprivileged local user to root, and also container escape, targeting kernel version 6.1.25. It is verified to work in the Google kCTF VRP environment and is built and tested via GitHub CI using QEMU. The exploit is structured into three main components: node_master (orchestrator), node_free (triggers the UAF), and node_use (reads /proc/self/maps to leak addresses and control execution). It uses a deep directory tree to prolong VMA iteration, allowing the RCU grace period to expire and convert a use-after-free-by-RCU into a genuine use-after-free. Then it employs slab feng shui to gain control of freed maple nodes, leaks kernel addresses via /proc/self/maps, and executes a ROP chain to gain root privileges and escape containers. The code is well-crafted with a custom minimal libc (nolibc) and inline assembly for syscalls. The syscall wrappers and clone helper are cleanly implemented and could be reused in other kernel exploit projects. The repository includes a Makefile, CI configuration, and environment files (kernel image, initramfs) for easy reproduction.

RATING: 7.6/10 MAINT: maintained DRIFT: low
▸ 3 reusable components found
── end of results ──
$ submit: