CVE-2024-0582

Introduction

This exploit implements a Dirty Cred attack method to gain unauthorized write access to /etc/passwd. Unlike many similar exploits that create numerous pages or aggressively spray file descriptors, this approach takes a more targeted route to corrupt the necessary kernel structures.

Exploit Flow (High-Level)

• Set CPU Affinity & Increase FD Limit
  Ensures stable performance and enough file descriptors for the spray.

• Initialize io_uring
  Creates an io_uring instance and registers a buffer ring for kernel memory usage.

• Unregister the Buffer Ring
  Triggers the vulnerability, leaving the kernel data structures in an exploitable state.

• File Descriptor Spray
  Opens numerous FDs to /etc/passwd, hoping to corrupt the desired kernel object.

• Modify File Mode
  Corrupts the f_mode flags so /etc/passwd becomes writable.

• Write Backdoor Entry
  Inserts evil::0:0:root:/root:/bin/bash into /etc/passwd.

Requirements

• Linux Kernel with a vulnerable io_uring implementation (tested on a kernel with the CVE-2024-0582 bug).
• Rust Toolchain (if compiling the .rs source files).
• EXT4_FOPS_OFFSET:
  You may need to adjust the EXT4_FOPS_OFFSET value in main.rs (default is set to 0x122b3c0) depending on your Linux version. Mismatch can cause the exploit to fail or behave incorrectly.

Determining the Correct Offset Values

If your kernel exports symbol information and you have the right permissions (often this is restricted on production systems), you can read from /proc/kallsyms:

1. Get the address of _text:

   root@kitploit:~

   grep " _text" /proc/kallsyms
   

   Let’s call the resulting address TEXT_ADDR.

2. Get the address of ext4_file_operations:

   root@kitploit:~

   grep ext4_file_operations /proc/kallsyms
   

   Let’s call the resulting address EXT4_FOPS_ADDR.

3. Subtract:

   root@kitploit:~

   EXT4_FOPS_OFFSET = EXT4_FOPS_ADDR – TEXT_ADDR