wzhdgithub

GitHub · Repository owner · Source ID 161194411
Source profile

Source-scoped identity with 1 associated PoC and 1 linked vulnerability.

Showing 1 PoC on this page

GitHub

wzhdgithub/GhostLock

Repository PoC0Created 2026-08-13ExploitCVE-2026-4349963 files

339.6 KiB

GitHubPoC details
Analysisdeepseek-v4-pro:cloud ·

Technical assessment

The GhostLock repository is a local privilege escalation exploit for CVE-2026-43499, a Linux kernel UAF vulnerability in the rtmutex PI futex path. It uses pselect() and futex operations to trigger a use-after-free on a kernel stack-allocated rt_mutex_waiter, then leverages pipe_buffer heap spraying and fd_set data to control the freed memory. The exploit achieves arbitrary kernel write via the rb_erase() red-black tree operation, modifies the current process's cred structure to gain root privileges, and disables SELinux by writing to selinux_state.enforcing.

Backdoor review

No backdoor observed in reviewed code

The reviewed evidence consists of a Makefile, README, and exploitation documentation for a local privilege escalation exploit targeting CVE-2026-43499. The content describes a standard kernel exploit chain (UAF, arbitrary write, credential modification, SELinux disable) and provides build/usage instructions. No concealed or materially misrepresented behavior harming the operator or an unrelated system was identified. The disclosed behavior is consistent with the stated purpose of a local privilege escalation proof-of-concept.

ClassificationExploit
Model confidence95%
AuthenticationNot required
LanguagesCMakefileMarkdown
Target softwareLinux kernelAndroid GKI
Attack typeslocal privilege escalationuse-after-freearbitrary kernel writeSELinux bypass
Evidence & reasoningClassification basis · observed behavior · safety review
Technical evidence

Classification basis and observed behavior

Classification basis

The artifact contains a complete, multi-stage exploit implementation that exercises the CVE-2026-43499 vulnerability to achieve local privilege escalation and SELinux disablement. The README and exploitation documentation describe the full exploit chain, including UAF triggering, heap spraying, arbitrary write via rb_erase, and credential/SELinux modification. The Makefile compiles the exploit source code into an executable binary. This is not a scanner or a writeup; it is functional exploit code.

README.md:1-8README.md:22-30docs/exploitation.md:6-15Makefile:1-27

Requirements

  • Local unprivileged user access to a vulnerable Linux/Android system with USB debugging enabled and ADB connection.README.md:121-125
  • Kernel version must match one of the supported targets (e.g., 6.6.118-android15 for OPPO Find X8).README.md:133-135

Observed behavior

  • Triggers a use-after-free on a kernel stack-allocated rt_mutex_waiter via pselect() and futex PI operations.README.md:14-20docs/exploitation.md:58-91
  • Sprays the kernel heap with pipe_buffer objects to control the memory layout and reoccupy the freed waiter memory.docs/exploitation.md:19-40
  • Constructs a fake rt_mutex_waiter via fd_set data to control the rb_erase() operation, achieving an arbitrary kernel write primitive.docs/exploitation.md:95-155
  • Modifies the current process's cred structure to set uid/gid to 0 and grant all capabilities, and disables SELinux by setting selinux_state.enforcing to 0.README.md:27-30docs/exploitation.md:171-226
  • Spawns a root shell and optionally starts a mini ADB server for continued access.README.md:147-160
Safety-review evidence

Behaviors behind the backdoor verdict

Observables

Exploit Target
Payload withheldThe artifact is a local privilege escalation exploit for a specific Linux kernel vulnerability.README.md:5-8
Exploit Behavior
Payload withheldThe exploit modifies the current process's credentials to root and disables SELinux, which is standard behavior for a local privilege escalation exploit.README.md:27-30
Network Behavior
Payload withheldThe README mentions a 'miniadb listening on USB' in the output example, which is a disclosed feature for post-exploitation interaction, not a concealed backdoor.README.md:159
Review boundaries

What the analysis did not establish

  • Only 3 of 63 files in the repository were provided as text evidence. The core exploit source code (e.g., src/core/main.c, src/core/pipe.c) is not included, so the analysis relies on the README and documentation descriptions of the exploit logic.
  • The compiled binary 'ghostlock' is present in the repository but was not analyzed; its behavior is inferred from the documentation.
  • The evidence packet reports complete_artifact_coverage as false, indicating that not all files were inspected.
  • Core exploit source code (src/core/*.c) was not included in the selected text evidence; only documentation and build files were reviewed.
  • The compiled binary 'ghostlock' was flagged as metadata-only and not analyzed.
Model interpretation

This review is limited to the supplied PoC code and context. It does not assert that the code works or is safe to execute.