analyticeth/chronomaly-webosCVE-2025-38352 kernel exploit for LG webOS Smart TVs (ARM64). Achieves persistent root on real consumer hardware with novel exploitation techniques. Responsibly disclosed to LG.
Kernel exploit for CVE-2025-38352 (POSIX CPU timer race condition / use-after-free) achieving persistent root on LG webOS Smart TVs running kernel 5.4.268 on ARM64. Verified on 4 TV models across multiple firmware versions. Responsibly disclosed to LG's Security Researcher Program (February 2026).
Built on Chronomaly by farazsth98. Stage 1 UAF race logic and cross-cache infrastructure ported and adapted for ARM64; Stages 2–5 redesigned with novel exploitation techniques and solutions to real-hardware constraints that do not exist in emulated environments. Developed with the assistance of Claude Opus 4.6.
See VULNERABILITY_REPORT.md for the full vulnerability analysis, exploit chain walkthrough, and recommended mitigations.
prisoner user (uid=5038)This exploit was developed as part of responsible security research and reported to LG's Security Researcher Program on February 7, 2026. It is published for educational purposes only. Use responsibly and only on devices you own. The authors are not responsible for any damage, bricking, data loss, or warranty voiding resulting from use of this software. This software is provided as-is with no warranty.
The original's arbitrary decrement is slow and noisy: it sprays 1,000 struct cred objects via forked processes, then decrements a target cred's EUID field N times. Each decrement is a separate operation. This is acceptable in QEMU where timing is forgiving, but unreliable on real hardware where interrupt-driven page reclamation can steal pipe buffer pages between operations.
This was replaced with a single arbitrary write via list_del_init(). The exploit overwrites the UAF'd sigqueue's list_head.next and list_head.prev pointers through the pipe buffer. When the kernel dequeues the pending signal (collect_signal() → list_del_init()), it performs prev->next = next (writes the fake cred address into task_struct->cred) and next->prev = prev (controlled side-effect write). One write replaces the process's cred pointer with a pointer to a fake cred structure containing all-zero uid/gid fields. No cred spray, no forked processes, deterministic.
peek_pipe() via tee() for Non-Destructive ReadsThe original uses destructive read() calls on pipe buffers throughout the exploit. In QEMU, this works fine because pages are not stolen between operations. On real hardware with 4 physical cores, the kernel's per-CPU page list (pcplist) aggressively reclaims freed pages. A destructive read releases the pipe buffer's backing page, which can be immediately stolen by a hardware interrupt before the exploit can reallocate it.
The solution is a non-destructive pipe read primitive using tee(). The tee() syscall duplicates pipe data between two pipes without consuming it, keeping the original pipe buffer's backing page pinned. This allows the exploit to read kernel data from the cross-cached pipe buffer repeatedly without risking page loss. This was critical for reliability on real hardware.
The original sprays cred objects and hopes to land one in a predictable location. This version constructs the fake cred structure at a known address by performing a second cross-cache: allocate a new sigqueue (via tkill(SIGRTMIN+1)), learn its address from the first pipe buffer's heap leak, then cross-cache that sigqueue's slab page into a second pipe buffer. The fake cred is written into the second pipe buffer at the exact page offset of the leaked sigqueue address. The result is a fake cred at a deterministic kernel virtual address with no guesswork.
The original dequeues SIGUSR2 early in Stage 2 to leak the UAF sigqueue's address. This consumes the signal, so the original needs a different mechanism for the final write. This version never needs the UAF sigqueue's own address (the heap leak comes from adjacent sigqueue pointers in the pipe buffer). SIGUSR2 is kept pending across all five stages and its dequeue is used as the final arbitrary write trigger. The signal that created the UAF is the same signal whose dequeue exploits it.
modprobe_path + socket(44) EscalationThe fake cred structure has NULL user_ns, user, and group_info pointers (since the pipe buffer is zero-initialized beyond the uid/gid fields). Calling setresuid(), fork(), or exec() would dereference these NULL pointers and kernel panic. The original avoids this because its cred spray uses real cred objects with valid pointers.
The solution: overwrite /proc/sys/kernel/modprobe to point to a payload script (/tmp/pwn), then trigger call_usermodehelper via socket(44, SOCK_STREAM, 0) (requesting a non-existent protocol family). The kernel executes the modprobe helper with init_cred (the kernel's own root credentials, fully valid), bypassing the corrupted cred entirely. The payload runs as full root and can perform arbitrary operations.
The critical window in Stage 4 (writing malicious pointers into the pipe buffer, then triggering signal dequeue) is vulnerable to hardware interrupts stealing the pipe buffer page from the per-CPU page list. This does not happen in QEMU. On real hardware, this window is protected with SCHED_FIFO priority (when available) and sched_yield() to let pending work complete on the CPU before entering the critical section, plus pre-prepared buffer contents to minimize the time between write and trigger. The exploit also falls back gracefully when SCHED_FIFO is unavailable (as on webOS where the prisoner user lacks CAP_SYS_NICE).
task_struct Offset Reverse EngineeringThe arbitrary write targets task_struct->cred, which requires knowing the byte offset from task_struct->pending (whose address is leaked from the pipe buffer) to task_struct->cred. This offset is kernel-config-dependent. The 0x80 (128 byte) offset was manually computed from the LG webOS kernel source, accounting for CONFIG_KEYS=y, CONFIG_SYSVIPC=y, and ARM64-specific struct layout and alignment. The x86_64 offset in the original is different due to different struct packing and config options.
On success, the exploit:
/proc/sys/kernel/modprobe to run a rooting payload as initaarch64-linux-gnu-gcc)# macOS (requires third-party tap)
brew tap messense/macos-cross-toolchains
brew install aarch64-unknown-linux-gnu
# Ubuntu/Debian
sudo apt-get install gcc-aarch64-linux-gnu