nanabingies
Source-scoped identity with 5 associated PoCs and 4 linked vulnerabilities.
Exploit catalog results
Showing 5 PoCs on this page
GitHubnanabingies/CVE-2024-0582
Repository PoCStars: 0Created 2026-05-12ExploitCVE-2024-05822 files
Analysis
Technical assessment
A local privilege escalation exploit for CVE-2024-0582, a use-after-free vulnerability in the Linux kernel's io_uring subsystem. The code triggers the vulnerability by registering and unregistering a buffer ring, reclaims the freed memory with pipe_buffer objects, leaks kernel addresses, overwrites the modprobe_path kernel variable via a corrupted pipe, and triggers modprobe to execute a root shell.
Backdoor review
No backdoor observed in reviewed code
The PoC exploit for CVE-2024-0582 performs a standard local privilege escalation via io_uring use-after-free, overwriting modprobe_path to execute a root shell. No concealed backdoor, unrelated payload, or deceptive behavior was observed in the supplied source code.
Classification basis and observed behavior
Classification basis
The code actively exploits a use-after-free vulnerability to achieve local privilege escalation. It triggers the vulnerability, corrupts kernel memory, overwrites a critical kernel variable (modprobe_path), and executes a root shell. This goes beyond detection or scanning; it is a full exploit.
exp.c:151-280README.md:2Requirements
- Local user access to a vulnerable Linux kernel (version 6.6.1 targeted).
README.md:2 - Ability to execute compiled C code on the target system.
exp.c:1-280
Observed behavior
- Registers an io_uring buffer ring with IORING_REGISTER_PBUF_RING and maps it into userspace.
exp.c:177-181 - Unregisters the buffer ring, freeing the kernel memory while the userspace mapping remains.
exp.c:183-184 - Sprays pipe_buffer objects to reclaim the freed memory and confirms successful reclamation by checking heap and kernel text pointer patterns.
exp.c:186-204 - Leaks kernel addresses (anon_pipe_buf_ops, kernel base) from the corrupted pipe_buffer and calculates the address of modprobe_path.
exp.c:207-226 - Overwrites the pipe_buffer's page pointer to point to the physical page containing modprobe_path and sets the PIPE_BUF_FLAG_CAN_MERGE flag.
exp.c:237-242 - Reads from the corrupted pipe to obtain the page containing modprobe_path, overwrites modprobe_path with a path to a privilege escalation script, and writes the modified page back.
exp.c:244-265 - Triggers modprobe by creating an AF_ALG socket with an unknown type, causing the kernel to execute the privilege escalation script as root.
exp.c:135-142exp.c:274
Behaviors behind the backdoor verdict
Observables
- Privilege Escalation Technique
- Payload withheldThe exploit overwrites /proc/sys/kernel/modprobe with a path to a memfd script that restores the original path and spawns a root shell, a known LPE technique.
exp.c:98-102exp.c:120-133exp.c:135-148 - Exploit Behavior
- Payload withheldThe code registers and unregisters a provided buffer ring, then sprays pipe_buffer objects to reclaim the freed memory, consistent with the described CVE-2024-0582 vulnerability.
exp.c:174-191
What the analysis did not establish
- The exploit targets a specific kernel version (6.6.1) and relies on hardcoded offsets (e.g., anon_pipe_buf_ops offset 0x121f580, modprobe_path offset 0x1b3f580) that are not portable across different kernel builds.
- The code was not executed; analysis is based solely on static review of the provided source files.
- Only the two text files in the repository were reviewed; no binary or other file types were present.
- The review does not assess whether the exploit works as intended or is safe to execute.
This review is limited to the supplied PoC code and context. It does not assert that the code works or is safe to execute.