oppofindN2-ghostlock

GhostLock CVE-2026-43499 — OPPO Find N2 Linux Kernel Privilege Escalation Research

Project Overview

GhostLock (CVE-2026-43499) is a kernel stack UAF vulnerability affecting Linux 2.6.39 through 7.1-rc1, triggered via a FUTEX_CMP_REQUEUE_PI race condition. This project adapts the NebuSec/CyberMeowfia x86_64 exploit to the OPPO Find N2 (ARM64, kernel 5.10.236).

Project Status

In Progress — Multiple exploitation stages have been verified, but the core blockers (CFI bypass / kernel write primitive) have not yet been overcome.

Core Features

• Firefox CVE-2026-10702 exploit — SpiderMonkey type confusion → AAW
• KernelSnitch mm_struct leak — futex hash timing leaks kernel addresses
• GhostLock FUTEX trigger — FUTEX_CMP_REQUEUE_PI ret=0
• sk_buff heap spray — 4/4 sends successful
• PR #13 KASLR bypass — directly computes kaslr_base
• IDA Pro full offset verification — 70+ kernel offsets verified

Quick Start

Requirements

• macOS / Linux (Android NDK required)
• Android NDK r29
• OPPO Find N2 device

Build and Deploy

1. Clone the repository

git clone https://github.com/pubglite55/oppofindN2-ghostlock.git
cd oppofindN2-ghostlock

2. Set the NDK path

export NDK=/usr/local/Caskroom/android-ndk/29/AndroidNDK14206865.app/Contents/NDK

3. Build the exploit

cd exploit/
make clean && make NDK=$NDK

4. Push to the device

adb push preload.so /data/local/tmp/

5. Run

adb shell 'LD_PRELOAD=/data/local/tmp/preload.so /system/bin/ls /dev/null' 2>&1

Repository Structure

oppofindN2-ghostlock/
├── exploit/
│   ├── src/
│   │   ├── main.c              # Main entry, GhostLock trigger
│   │   ├── fops.c              # pselect fake lock + kernel base leak
│   │   ├── pipe.c              # pipe physical read/write
│   │   ├── root.c              # root privilege escalation
│   │   ├── util.c              # Utility functions
│   │   └── kernelsnitch/       # mm_struct leak
│   ├── targets/                # Device offset definitions
│   └── Makefile
└── README.md

Device Information

• Phone: OPPO Find N2, serial=84cb96e2
• Kernel: 5.10.236-android12-9-o-g74d132f4467a
• Build: OPPO/CPH2413/CPH2413:16/UP1A.231005.007/V16.0.12.0.UNFCNXM:user/release-keys
• CONFIG_FUTEX_PI=y
• CONFIG_UNMAP_KERNEL_AT_EL0=y (KPTI enabled)
• kptr_restrict enforced

Core Blockers

1. pselect cannot manipulate the waiter structure — when NFDS > 336, fd_set is on the heap
2. configfs/ashmem not supported — ashmem SET_NAME is truncated
3. All other kernel write paths are blocked — /proc/self/mem, /dev/mem, binder

License

This project is licensed under the MIT License.

Acknowledgements

• NebuSec/CyberMeowfia — Original GhostLock exploit implementation
• NebuSec IonStack Writeup — GhostLock technical analysis
• Dere3046/ElevateMe — rb_erase cred overwrite mechanism