Linux Kernel proc_readdir_de() 6.18-rc5 - Local Privilege Escalation

ExploitDBExploitDB exploitExploitEDB-52550

PoC files

1 file

File viewing is interactive and short-lived. Downloads are password-protected ZIP archives using password eip.

ExploitDB
Analysisdeepseek-v4-pro:cloud ·

Technical assessment

This is a local privilege escalation exploit for CVE-2025-40271, a use-after-free vulnerability in the Linux kernel's proc_readdir_de() function. The code creates a user/network namespace, sets up veth pairs to populate /proc entries, and races getdents64() calls against veth deletion to trigger the UAF. It uses msg_msg heap spraying to reclaim freed memory and leaks a kernel heap pointer via anomalous d_ino values. The exploit then attempts to achieve root by overwriting modprobe_path, though the full chain requires target-specific offsets.

Backdoor review

No backdoor observed in reviewed code

The supplied PoC is a standard local privilege escalation exploit for CVE-2025-40271. It uses documented techniques (namespace creation, veth pair manipulation, msg_msg heap spray, race condition triggering, and modprobe_path overwrite) to gain root. No concealed executable behavior, unrelated payload, credential theft, persistence, or operator-directed harm was observed. The code is fully readable and its actions align with the stated exploit goal.

ClassificationExploit
Model confidence95%
AuthenticationNot required
Languagesc
Target softwareLinux kernel
Attack typesuse-after-freerace conditionheap sprayinginformation disclosureprivilege escalation
Evidence & reasoningClassification basis · observed behavior · safety review
Technical evidence

Classification basis and observed behavior

Classification basis

The code actively exercises the vulnerability by racing getdents64() against veth deletion to trigger a use-after-free, sprays heap memory to reclaim the freed object, leaks a kernel pointer, and attempts to escalate privileges via modprobe_path overwrite. This constitutes an exploit, not merely a scanner or writeup.

exploits/linux/local/52550.c:1exploits/linux/local/52550.c:37-43exploits/linux/local/52550.c:603-661exploits/linux/local/52550.c:663-700

Requirements

  • Vulnerable Linux kernel version (3.14+ through 6.18-rc5, unpatched)exploits/linux/local/52550.c:6
  • User namespace support enabled (unprivileged_userns_clone)exploits/linux/local/52550.c:237-238
  • Ability to create veth pairs (requires CAP_NET_ADMIN in namespace)exploits/linux/local/52550.c:38
  • System V message queue support for heap sprayexploits/linux/local/52550.c:409

Observed behavior

  • Checks kernel version to determine if vulnerableexploits/linux/local/52550.c:187-230
  • Creates user and network namespace via unshare()exploits/linux/local/52550.c:234-262
  • Creates veth pairs using netlink RTM_NEWLINK messages to populate /proc/self/net/dev_snmp6/exploits/linux/local/52550.c:283-362
  • Spawns a thread that continuously calls getdents64() on /proc/self/net/dev_snmp6/ to detect anomalous d_ino valuesexploits/linux/local/52550.c:480-520
  • Races veth deletion (RTM_DELLINK) with the getdents64() thread to trigger use-after-freeexploits/linux/local/52550.c:603-661
  • Sprays msg_msg objects via msgsnd() to reclaim freed proc_dir_entry slab memoryexploits/linux/local/52550.c:415-434
  • Detects UAF by checking if d_ino looks like a kernel heap pointer (0xffff...)exploits/linux/local/52550.c:508-514
  • Attempts privilege escalation via modprobe_path overwrite technique (sets up /tmp/pwn and /tmp/trigger, then executes trigger)exploits/linux/local/52550.c:524-552
Safety-review evidence

Behaviors behind the backdoor verdict

Observables

Exploit Technique
modprobe_path overwrite via heap spray and UAFThe exploit writes a shell script to /tmp/pwn and a trigger file to /tmp/trigger, then attempts to overwrite modprobe_path to execute /tmp/pwn as root. This is a well-known LPE technique.exploits/linux/local/52550.c:524-552
File Creation
/tmp/pwn, /tmp/trigger, /tmp/rootshThe exploit creates temporary files in /tmp as part of the modprobe_path overwrite technique. These are standard for this type of exploit and are cleaned up in step_cleanup().exploits/linux/local/52550.c:526-537exploits/linux/local/52550.c:708-709
Privilege Escalation Goal
root shell via /tmp/rootshThe ultimate goal is to spawn a root shell using a setuid copy of /bin/sh. This is the expected behavior of a local privilege escalation exploit.exploits/linux/local/52550.c:528exploits/linux/local/52550.c:750-753
Review boundaries

What the analysis did not establish

  • The modprobe_path overwrite step is incomplete; the code acknowledges it requires target-specific KASLR offsets and only demonstrates the UAF and heap leak.
  • The exploit is described as having ~40-60% UAF hit rate and ~10% kernel panic risk, indicating it is not fully reliable.
  • Only the single C source file was analyzed; no external dependencies or build artifacts were inspected.
  • Only the single C source file (52550.c) was reviewed; no external libraries or build artifacts were inspected.
  • The review does not verify that the exploit actually works or is safe to run; it only assesses the presence of backdoor or deceptive behavior in the provided text.
Model interpretation

This review is limited to the supplied PoC code and context. It does not assert that the code works or is safe to execute.

Linked vulnerabilities

1