$ show lrh2000/StackRot
This repository contains a proof-of-concept exploit for CVE-2023-3269 (StackRot), a use-after-free vulnerability in the Linux kernel's maple tree implementation for managing virtual memory areas (VMAs). The exploit demonstrates privilege escalation from an unprivileged local user to root, and also container escape, targeting kernel version 6.1.25. It is verified to work in the Google kCTF VRP environment and is built and tested via GitHub CI using QEMU. The exploit is structured into three main components: node_master (orchestrator), node_free (triggers the UAF), and node_use (reads /proc/self/maps to leak addresses and control execution). It uses a deep directory tree to prolong VMA iteration, allowing the RCU grace period to expire and convert a use-after-free-by-RCU into a genuine use-after-free. Then it employs slab feng shui to gain control of freed maple nodes, leaks kernel addresses via /proc/self/maps, and executes a ROP chain to gain root privileges and escape containers. The code is well-crafted with a custom minimal libc (nolibc) and inline assembly for syscalls. The syscall wrappers and clone helper are cleanly implemented and could be reused in other kernel exploit projects. The repository includes a Makefile, CI configuration, and environment files (kernel image, initramfs) for easy reproduction.
The LLM identified 3 files worth highlighting for reuse:
Provides clean, self-contained wrappers for System V message queue syscalls (msgget, msgsnd, msgctl) using inline assembly. Demonstrates a reusable pattern for wrapping syscalls in a bare-metal environment without libc.
Implements clone3 syscall wrapper with inline assembly, supporting both same-VM and new-VM cloning. Includes child entry point that calls a callback and exits. A reusable component for creating processes in kernel exploit or minimal runtime environments.
Provides simple, dependency-free string utility functions: next_line, starts_with, and parse_hex. These are used to parse /proc/self/maps output. The parse_hex function is particularly clean and could be reused in any project needing hex string to integer conversion.