HackSpeak/CVE-2026-64564

GitHubRepository PoCExploit

PoC files

3 files

File viewing is interactive and short-lived. Downloads are password-protected ZIP archives using password eip.

GitHub
Analysisdeepseek-v4-pro:cloud ·

Technical assessment

The artifact is a local privilege escalation (LPE) exploit for CVE-2026-64564 in the Linux kernel SCTP subsystem. It triggers a use-after-free (UAF) vulnerability via crafted ASCONF DEL-IP chunks, then uses heap spraying and a fake kernel object graph to achieve code execution, escalating to root privileges. The code includes a complete exploitation chain: UAF trigger, KASLR bypass, kernel read primitive, and credential overwrite.

Backdoor review

No backdoor observed in reviewed code

The supplied evidence consists of a README and a C source file implementing a Linux kernel SCTP ASCONF DEL-IP Use-After-Free local privilege escalation proof-of-concept for CVE-2026-64564. The code performs the described exploit steps: namespace setup, multihomed SCTP association creation, ASCONF DEL-IP injection to trigger UAF, heap spraying for reclaim, KASLR bypass, and credential overwrite to gain root. No concealed backdoor, unrelated remote access, persistence mechanism, or deceptive payload targeting the person running the PoC was observed. The artifact's behavior is consistent with the stated vulnerability exploitation and does not exhibit operator-directed harm beyond the intended privilege escalation.

ClassificationExploit
Model confidence98%
AuthenticationNot required
Languagesc
Target softwareLinux kernelSCTP
Attack typesuse-after-freelocal privilege escalation
Evidence & reasoningClassification basis · observed behavior · safety review
Technical evidence

Classification basis and observed behavior

Classification basis

The code actively triggers the vulnerability and uses it to escalate privileges to root, which is the definition of an exploit. It does not merely detect or report the vulnerability; it exercises it to achieve code execution and privilege escalation.

lpe_debian.6.12.95.c:1-842README.md:1-44

Requirements

  • Requires an unprivileged local user account to execute the exploit.lpe_debian.6.12.95.c:1-842
  • Target system must have the SCTP kernel module loaded and configurable via sysctl (addip_enable, addip_noauth_enable).README.md:19
  • Exploit is compiled and targeted for Debian 13 with kernel 6.12.95; other kernels require manual offset adaptation.README.md:18

Observed behavior

  • Creates isolated user and network namespaces to configure SCTP loopback without requiring root.lpe_debian.6.12.95.c:206-227
  • Establishes a multihomed SCTP association and sends a raw ASCONF chunk containing a DEL-IP for a non-source address followed by a wildcard DEL-IP to trigger a use-after-free of the transport structure.lpe_debian.6.12.95.c:237-250lpe_debian.6.12.95.c:318-366
  • Reclaims the freed transport memory with a PACKET_TX_RING spray to leak a direct-map page address, then uses a crafted fake transport to build an arbitrary 32-bit kernel read primitive.lpe_debian.6.12.95.c:598-617lpe_debian.6.12.95.c:479-504
  • Leaks the KASLR slide by reading the IDT handler address, then walks kernel data structures to locate the victim SCTP association.lpe_debian.6.12.95.c:575-584lpe_debian.6.12.95.c:541-571
  • Triggers a second UAF on the association's active_path, reclaims it with a forged SCTP transport/association/credential graph via SCTP auth key spray, and closes the socket to trigger commit_creds() with controlled credentials, achieving root.lpe_debian.6.12.95.c:685-714lpe_debian.6.12.95.c:812-823
  • Verifies root by reading /etc/shadow and writing a marker file to /root/SCTP_LPE_SUCCESS.lpe_debian.6.12.95.c:824-832
Safety-review evidence

Behaviors behind the backdoor verdict

Observables

Privilege Escalation Mechanism
Uses SCTP ASCONF DEL-IP UAF to overwrite kernel credentials and gain rootThe PoC exploits CVE-2026-64564 to escalate privileges from an unprivileged user to root, as described in the README and implemented in the C code.README.md:9lpe_debian.6.12.95.c:593-841
Kernel Memory Corruption
Triggers Use-After-Free in SCTP transport structure via crafted ASCONF chunksThe code sends raw IP packets containing ASCONF DEL-IP parameters to free a transport and then reclaims the freed memory with controlled data to hijack control flow.lpe_debian.6.12.95.c:236-250lpe_debian.6.12.95.c:357-365
Root Verification
Checks ability to read /etc/shadow and writes /root/SCTP_LPE_SUCCESS markerThe PoC verifies successful privilege escalation by reading a protected file and creating a marker file in /root, which is standard for LPE PoCs.lpe_debian.6.12.95.c:587-592lpe_debian.6.12.95.c:830-832
Review boundaries

What the analysis did not establish

  • The evidence includes only the README and the C source file; a third file (likely a Makefile or similar) is present in the repository but not included in the packet.
  • The exploit is explicitly stated to be untested on real hardware ('未经真机验证') and may cause kernel crashes.
  • The exploit is targeted at a specific Debian 13 kernel version (6.12.95) and requires manual offset adaptation for other kernels.
  • One unclassified file (1066 bytes) was present in the repository but not included in the text evidence; its content and potential behavior are unknown.
  • The review is limited to static analysis of the provided source code and README; no dynamic execution or binary analysis was performed.
Model interpretation

This review is limited to the supplied PoC code and context. It does not assert that the code works or is safe to execute.

Linked vulnerabilities

1