ruia-ruia / cve-2022-29582-exploit

Exploit for CVE-2022-29582 targeting Google's Kernel CTF

CVE-2022-29582

This repository contains exploit code for CVE-2022-29582, a Local Privilege Escalation in io_uring (of the Linux kernel).

Default configurations are affected and no special privileges should be needed.

You can find the writeup at https://ruia-ruia.github.io/2022/08/05/CVE-2022-29582-io-uring/

Building

Running

make

should result in a shiny new executable - or just use the pre-commited one :)

Testing

First, check the writeup for the (micro)arch specs. Then run the given kernel: vmlinuz-5.10.90. The exploit (particularly now the ROP chain) should work fine with the kCTF setup.

cve-2022-29582-exploit's Issues

Error using make (cross_compile)

aarch64-linux-gnu-gcc -g -o bin/exp
./liburing/test/helpers.c
-I./liburing/src/include/
-w -O2 ./liburing/src/liburing.a
cross_cache.c msg.c manager.c tls.c main.c
-static -lrt -lpthread -luring
-Wl,--whole-archive -Wl,--no-whole-archive
/tmp/cc8C82ns.s: Assembler messages:
/tmp/cc8C82ns.s:17: Error: unknown mnemonic movq' -- movq $new_stack,%rbx'
/tmp/cc8C82ns.s:18: Error: unknown mnemonic movq' -- movq (%rbx),%rsp'
/tmp/cc8C82ns.s:19: Error: operand 1 must be an integer or stack pointer register -- sub $8,%rsp' /tmp/cc8C82ns.s:20: Error: unknown mnemonic jmp' -- jmp after_rop' /tmp/cc8C82ns.s:21: Error: unknown mnemonic ud2' -- `ud2'
make: *** [Makefile:4: all] Error 1

Error allocating socket: Too many open files

Listening on 127.0.0.1:9999 (tcp)
[+] Creating TCP socks to upgrade later.
Error allocating socket: Too many open files
start_server: accept: Too many open files
Exiting now