kungaocode/vulnerability-analysis-
Automated reproduction and analysis of CVE-2021-26708 — a use-after-free vulnerability in the Linux kernel's AF_VSOCK subsystem (v5.10.12). Includes PoC exploit code, KASAN runtime detection report, and the full kernel build configuration for environment replication. Built with KernJC.
This repository contains a complete reproduction and analysis of CVE-2021-26708 — a use-after-free vulnerability caused by a race condition in AF_VSOCK socket operations in the Linux kernel (v5.10.12). The entire experimental environment was generated and executed using KernJC, an automated vulnerable environment generation tool for Linux kernel vulnerabilities.
| Field | Value |
|---|
| CVE | CVE-2021-26708 |
| Type | Use-After-Free (UAF) |
| Root Cause | Race condition in virtio_transport_notify_buffer_size() via concurrent AF_VSOCK socket operations |
| Kernel Version | 5.10.12 |
| Detection | KASAN (Kernel Address Sanitizer) — full stack trace with allocation/free tracking |
| Severity | High (CVSS 7.0) — local privilege escalation to root |
| File | Description |
|---|---|
KernJC: Automated Vulnerable Environment Generation for Linux Kernel Vulnerabilities.pdf | KernJC paper (Ruan et al., RAID 2024) |
experiment_report.pdf | Full experiment report for this CVE reproduction (7 pages) |
poc.c | Proof-of-concept exploit triggering the race condition (source: jordan9001/vsock_poc) |
kasan_report.txt | KASAN use-after-free report captured during reproduction |
kernel_config.txt | Linux kernel .config used for the vulnerable build (5.10.12, x86_64) |
All experiments were conducted within the KernJC automated environment:
| Component | Version / Spec |
|---|---|
| Host OS | Ubuntu 22.04 |
| QEMU | 6.2.0 with KVM + vhost-vsock |
| Kernel | Linux 5.10.12 (x86_64) |
| Compiler | GCC 9.5.0 |
| Automation | KernJC v0.8.3 |
This project is licensed under the MIT License — see LICENSE for details.
