Skip to content

Files

Latest commit

85cc4d6 · Jul 10, 2022

History

History

0ctffinal2021-kernote

Here are some kernel config options in case you need it

CONFIG_SLAB=y
CONFIG_SLAB_FREELIST_RANDOM=y
CONFIG_SLAB_FREELIST_HARDENED=y
CONFIG_HARDENED_USERCOPY=y
CONFIG_STATIC_USERMODEHELPER=y
CONFIG_STATIC_USERMODEHELPER_PATH=""

^-- Given with challenge.

UAF in 0x20 chunk (1st 8 byte write primitve, no read). Use ldt_struct to get leaks, arb. read/write access. A bit of race too?? smap+smep active + Hardened slab

mount ./initramfs.cpio.gz ./fs/

To restrict the process to run on specific CPU

cpu_set_t cpu_set;
CPU_ZERO(&cpu_set);
CPU_SET(0,&cpu_set);
ret=sched_setaffinity(0,sizeof(cpu_set),&cpu_set);