A Netlink Race Condition Leading to Kernel UAF
Walkthrough of a 1-day Linux kernel UAF reachable from an unprivileged user namespace, with a deterministic exploit primitive.
· 18 min read
#kernel#linux#exploit#re
Summary
A double-free in the netlink subsystem becomes a use-after-free under contention, granting an arbitrary kernel write primitive.
Root cause
The reference count on nlk->groups is decremented before the socket lock is reacquired, allowing a concurrent bind() to observe and reuse the freed memory.
spin_unlock(&nlk->lock);
kfree(nlk->groups); // freed here
// race window
spin_lock(&nlk->lock);
nlk->groups[grp] = ...; // UAFExploitation
The freed slab is recycled with a sprayed msg_msg object. Overwriting m_ts yields an OOB read; pivoting through pipe_buffer gives RIP control.
Patch
Take the socket lock around the free and re-validate nlk->groups after reacquisition.