CVE-2022-34918 PoC — Linux kernel 安全漏洞

Source

https://github.com/veritas501/CVE-2022-34918

Associated Vulnerability

Title:Linux kernel 安全漏洞 (CVE-2022-34918)
Description:Linux kernel是美国Linux基金会的开源操作系统Linux所使用的内核。netfilter是一款使用在Linux系统中的数据包过滤框架。 Linux kernel 5.18.9版本及之前版本存在安全漏洞，该漏洞源于。本地攻击者利用该漏洞使用 nft_set_elem_init 中的类型混淆错误（导致缓冲区溢出）来提升权限。

Description

CVE-2022-34918 netfilter nf_tables 本地提权 POC

Readme

# CVE-2022-34918 LPE POC

尝试结合了一下360提出的[USMA](https://vul.360.net/archives/391)利用思路，还不错。

Chinese writeup: 
- [CVE-2022-34918 netfilter 分析笔记](https://veritas501.github.io/2022_08_02-CVE-2022-34918%20netfilter%20%E5%88%86%E6%9E%90%E7%AC%94%E8%AE%B0/)
- [基于USMA的内核通用EXP编写思路在 CVE-2022-34918 上的实践](https://veritas501.github.io/2022_08_11_%E5%9F%BA%E4%BA%8EUSMA%E7%9A%84%E5%86%85%E6%A0%B8%E9%80%9A%E7%94%A8EXP%E7%BC%96%E5%86%99%E6%80%9D%E8%B7%AF%E5%9C%A8%20CVE-2022-34918%20%E4%B8%8A%E7%9A%84%E5%AE%9E%E8%B7%B5/)

!! **For educational / research purposes only. Use at your own risk.** !!

(poc below in under poc_keyring_normal folder)
![](assets/lpe.png)

## 参考

- https://github.com/randorisec/CVE-2022-34918-LPE-PoC

- https://randorisec.fr/crack-linux-firewall/

- https://starlabs.sg/blog/2022/06-io_uring-new-code-new-bugs-and-a-new-exploit-technique/

- https://vul.360.net/archives/391

File Snapshot


 [4.0K]  /data/pocs/1f46b45d209c98ee0e53fd04129a561c2e889bc8
├── [4.0K]  assets
│   └── [ 44K]  lpe.png
├── [4.0K]  generate_shellcode
│   ├── [ 455]  gen_shellcode.sh
│   └── [5.3K]  shellcode.c
├── [4.0K]  poc_fs_context_common
│   ├── [4.0K]  include
│   │   ├── [ 271]  common.h
│   │   ├── [ 611]  fsopen_spray.h
│   │   ├── [1.3K]  keyring.h
│   │   ├── [ 866]  log.h
│   │   ├── [ 107]  modprobe.h
│   │   ├── [ 967]  netlink.h
│   │   ├── [ 571]  nf_tables.h
│   │   └── [  54]  raw_packet.h
│   ├── [ 539]  Makefile
│   └── [4.0K]  src
│       ├── [2.0K]  common.c
│       ├── [ 497]  fsopen_spray.c
│       ├── [2.7K]  keyring.c
│       ├── [ 11K]  main.c
│       ├── [2.6K]  modprobe.c
│       ├── [3.5K]  netlink.c
│       ├── [ 12K]  nf_tables.c
│       └── [2.0K]  raw_packet.c
├── [4.0K]  poc_fs_context_cred_common
│   ├── [4.0K]  include
│   │   ├── [ 271]  common.h
│   │   ├── [ 611]  fsopen_spray.h
│   │   ├── [1.2K]  keyring.h
│   │   ├── [ 866]  log.h
│   │   ├── [ 107]  modprobe.h
│   │   ├── [ 967]  netlink.h
│   │   ├── [ 571]  nf_tables.h
│   │   └── [  54]  raw_packet.h
│   ├── [ 469]  Makefile
│   └── [4.0K]  src
│       ├── [2.0K]  common.c
│       ├── [ 497]  fsopen_spray.c
│       ├── [2.6K]  keyring.c
│       ├── [7.9K]  main.c
│       ├── [2.6K]  modprobe.c
│       ├── [3.5K]  netlink.c
│       ├── [ 12K]  nf_tables.c
│       └── [2.0K]  raw_packet.c
├── [4.0K]  poc_keyring_common
│   ├── [4.0K]  include
│   │   ├── [ 204]  common.h
│   │   ├── [1.1K]  keyring.h
│   │   ├── [ 866]  log.h
│   │   ├── [ 967]  netlink.h
│   │   ├── [ 540]  nf_tables.h
│   │   └── [ 204]  raw_packet.h
│   ├── [ 539]  Makefile
│   └── [4.0K]  src
│       ├── [2.0K]  common.c
│       ├── [2.8K]  keyring.c
│       ├── [ 11K]  main.c
│       ├── [2.5K]  netlink.c
│       ├── [ 10K]  nf_tables.c
│       └── [2.0K]  raw_packet.c
├── [4.0K]  poc_keyring_normal
│   ├── [4.0K]  include
│   │   ├── [ 204]  common.h
│   │   ├── [ 133]  kernel_offset.h
│   │   ├── [1.1K]  keyring.h
│   │   ├── [ 866]  log.h
│   │   ├── [ 967]  netlink.h
│   │   ├── [ 540]  nf_tables.h
│   │   └── [ 204]  raw_packet.h
│   ├── [ 469]  Makefile
│   └── [4.0K]  src
│       ├── [2.0K]  common.c
│       ├── [2.7K]  keyring.c
│       ├── [6.4K]  main.c
│       ├── [2.5K]  netlink.c
│       ├── [ 10K]  nf_tables.c
│       └── [2.0K]  raw_packet.c
├── [ 971]  README.md
└── [254K]  sample_config

14 directories, 66 files

Shenlong Bot has cached this for you

Remarks

1. It is advised to access via the original source first.

2. If the original source is unavailable, please email f.jinxu#gmail.com for a local snapshot (replace # with @).

3. Shenlong has snapshotted the POC code for you. To support long-term maintenance, please consider donating. Thank you for your support.

Goal Reached Thanks to every supporter — we hit 100%!