CyberMeowfia — GhostLock (CVE-2026-43499) Research

GhostLock: Linux Kernel futex PI Use-After-Free vulnerability, CVE-2026-43499. Attackers exploit PI-futex dependency loops to trigger a race condition, achieving local privilege escalation on kernels with CONFIG_FUTEX_PI=y.

Target: OPPO PLS120 (OP5E1C) — Android 17, kernel 5.15.180-android13-8-o-g7b9cfca06464

Analysis Environment: Ubuntu 24.04 x86_64 + Android NDK r29 (clang 21.0.0, API 35)

Source Repo: NebuSec/CyberMeowfia — IonStack/CVE-2026-43499

📋 Table of Contents

• 中文版 / Chinese Version
• English Version
• Project Assets

🇨🇳 中文版

项目概述

本项目研究在 OPPO PLS120 (OP5E1C) 设备上利用 GhostLock (CVE-2026-43499) 获取 root 权限的可行性。通过系统性地验证所有已知的 KASLR 泄露路径，确认该设备的安全加固组合构成了不可绕过的防护链。

执行流程

安全加固分析

OPPO PLS120 的安全加固全面封锁了 exploit 链条：

KASLR 泄露路径状态

最新进展 (2026-07-30)

• FOPS 路径首次到达：通过 SLIDE_MAX_ATTEMPTS=1 跳过 SLIDE 死循环
• pselect 重试修复：移除 !route_signal 立即 break，允许 24 次重试
• wchan KASLR 泄露尝试：确认 OPPO 内核已 backport v5.16 修复
• PR_SET_MM_MAP 路径评估：CONFIG_CHECKPOINT_RESTORE=n 阻塞

🇬🇧 English Version

Project Overview

This project researches the feasibility of exploiting GhostLock (CVE-2026-43499) for root privilege escalation on an OPPO PLS120 (OP5E1C) device. After systematically testing all known KASLR leak paths, the device's security hardening configuration forms an unbypassable defense chain against this exploit.

Execution Phases

Security Hardening Analysis

OPPO PLS120 blocks the exploit chain at multiple layers:

KASLR Leak Path Status

Latest Progress (2026-07-30)

• FOPS path reached for the first time: Skipped SLIDE deadlock via SLIDE_MAX_ATTEMPTS=1
• pselect retry fix: Removed !route_signal early break, allows 24 retries
• wchan KASLR leak attempt: Confirmed OPPO kernel backported v5.16 fix
• PR_SET_MM_MAP evaluation: Blocked by CONFIG_CHECKPOINT_RESTORE=n

📁 Project Assets

Key Directories

/home/ubuntu/CyberMeowfia/
├── devices/                           # Target device artifacts (OTA zip, config.gz, etc.)
├── work_bootimg/                      # boot.img analysis output
│   └── oppo/                          # OPPO-specific kernel data
│       ├── kernel.dec                 # Decompressed ARM64 Image (47MB)
│       ├── vmlinux_extracted.elf       # Reconstructed vmlinux with symbols (159,668)
│       ├── kallsyms_oppo.txt          # Full symbol table
│       └── kernel_config_oppo          # Kernel .config (189KB)
├── IonStack/CVE-2026-43499/exploit/  # Exploit source code
│   ├── src/                           # Source files (slide.c, fops.c, main.c, etc.)
│   │   ├── kernelsnitch/              # KernelSnitch futex hash timing module
│   │   └── targets/
│   │       └── oppo-pls120-BP2A.250605.015/  # OPPO-specific target configuration
│   └── build/                         # Compiled binaries
├── unpack_bootimg.py                 # Python boot.img unpacker (v3/v4)
├── report.md                          # Phase 1 analysis report (Chinese)
├── GhostLock_CVE202643499_OPPO_PLS120_研究报告.md  # Full research report (Chinese, 620 lines)
└── CVE202643499.txt                   # Research plan document

Key Reports

OPPO PLS120 Target Configuration

Located at IonStack/CVE-2026-43499/exploit/src/targets/oppo-pls120-BP2A.250605.015/target.h:

Toolchain Setup

# Cross-compilation for ARM64 Android
# Requires Android NDK r29 installed at /home/ubuntu/android-ndk-cache/android-ndk-r29/

# Build preload.so for OPPO PLS120
cd IonStack/CVE-2026-43499/exploit
export ANDROID_NDK_HOME=/home/ubuntu/android-ndk-cache/android-ndk-r29
make PROJECT=oppo-pls120-BP2A.250605.015 preload

# Build for default Pixel target
make PROJECT=blazer-CP2A.260605.012 preload

References

Status: ❌ OPPO PLS120 cannot be exploited via GhostLock (CVE-2026-43499) due to multi-layer security hardening. Research artifacts are preserved for use on less-hardened devices.