Exploitation on Debian 10 cloud image about cve-2021-3156

[worawit]

I expect at least 2 cores when writing an exploit but forgot adding it in requirement.
With only 1 CPU, it is almost impossible that an exploit preempt an sudo at the right time.

[worawit]

You were running an exploit from user that can sudo without password.
My exploit does not cover this case because you can become root without an exploit.

[MattyAgain]

@worawit My apologies, silly mistake of mine. Thank you for the quick reply. However, running the timestamp race on a user without sudo privileges now results in "out of dir name" after many attempts (full log attached if it matters).

log.txt

[worawit]

From your log, a race is almost success ("Failed to create 2nd symbolic" message).

Do you assign only 1 CPU to VM?
If yes, try assign at least 2 CPUs to VM and run the exploit again.

Note: to rerun the exploit after "out of dir name", you have to remove tmp directories with "rf -rf /tmp/gogogo*" with root user

[MattyAgain]

Adding another core worked! Is it fair to say this exploit requires more than one CPU for success, or is it possible to make it work with only one?