c3r34lk1ll3r/cve-2017-11176Proof-of-concept exploit for CVE-2017-11176, a use-after-free in Linux kernel's mq_notify function, enabling local privilege escalation via Netlink socket manipulation.
Proof of concept for CVE-2017-11176 for code execution.
The mq_notify function in the Linux kernel through 4.11.9 does not set the sock pointer to NULL upon entry into the retry logic. During a user-space close of a Netlink socket, it allows attackers to cause a denial of service (use-after-free) or possibly have unspecified other impact.
Check out these posts, I learned a lot from that.
SMAP is disabledKASLR is disabledSLAB allocator is exploitedheap.c: this is used to discovery the target cache*.stp: these files are used for System Tap to debug. Also offset.stap print out the structure offsetgdb.script: gdb script for debugging. This will trigger the breakpoint if RAX is in userspace. Note that we will insert the second breakpoint after we hit the first one in order to avoid performance issue (wake_up is called a lot of times).