CVE-2022-34918 PoC — Linux kernel 安全漏洞

Source

https://github.com/veritas501/CVE-2022-34918

Associated Vulnerability

Title:Linux kernel 安全漏洞 (CVE-2022-34918)
Description:An issue was discovered in the Linux kernel through 5.18.9. A type confusion bug in nft_set_elem_init (leading to a buffer overflow) could be used by a local attacker to escalate privileges, a different vulnerability than CVE-2022-32250. (The attacker can obtain root access, but must start with an unprivileged user namespace to obtain CAP_NET_ADMIN access.) This can be fixed in nft_setelem_parse_data in net/netfilter/nf_tables_api.c.

Description

CVE-2022-34918 netfilter nf_tables 本地提权 POC

Readme

# CVE-2022-34918 LPE POC

尝试结合了一下360提出的[USMA](https://vul.360.net/archives/391)利用思路，还不错。

Chinese writeup: 
- [CVE-2022-34918 netfilter 分析笔记](https://veritas501.github.io/2022_08_02-CVE-2022-34918%20netfilter%20%E5%88%86%E6%9E%90%E7%AC%94%E8%AE%B0/)
- [基于USMA的内核通用EXP编写思路在 CVE-2022-34918 上的实践](https://veritas501.github.io/2022_08_11_%E5%9F%BA%E4%BA%8EUSMA%E7%9A%84%E5%86%85%E6%A0%B8%E9%80%9A%E7%94%A8EXP%E7%BC%96%E5%86%99%E6%80%9D%E8%B7%AF%E5%9C%A8%20CVE-2022-34918%20%E4%B8%8A%E7%9A%84%E5%AE%9E%E8%B7%B5/)

!! **For educational / research purposes only. Use at your own risk.** !!

(poc below in under poc_keyring_normal folder)
![](assets/lpe.png)

## 参考

- https://github.com/randorisec/CVE-2022-34918-LPE-PoC

- https://randorisec.fr/crack-linux-firewall/

- https://starlabs.sg/blog/2022/06-io_uring-new-code-new-bugs-and-a-new-exploit-technique/

- https://vul.360.net/archives/391

File Snapshot


 [4.0K]  /data/pocs/1f46b45d209c98ee0e53fd04129a561c2e889bc8
├── [4.0K]  assets
│   └── [ 44K]  lpe.png
├── [4.0K]  generate_shellcode
│   ├── [ 455]  gen_shellcode.sh
│   └── [5.3K]  shellcode.c
├── [4.0K]  poc_fs_context_common
│   ├── [4.0K]  include
│   │   ├── [ 271]  common.h
│   │   ├── [ 611]  fsopen_spray.h
│   │   ├── [1.3K]  keyring.h
│   │   ├── [ 866]  log.h
│   │   ├── [ 107]  modprobe.h
│   │   ├── [ 967]  netlink.h
│   │   ├── [ 571]  nf_tables.h
│   │   └── [  54]  raw_packet.h
│   ├── [ 539]  Makefile
│   └── [4.0K]  src
│       ├── [2.0K]  common.c
│       ├── [ 497]  fsopen_spray.c
│       ├── [2.7K]  keyring.c
│       ├── [ 11K]  main.c
│       ├── [2.6K]  modprobe.c
│       ├── [3.5K]  netlink.c
│       ├── [ 12K]  nf_tables.c
│       └── [2.0K]  raw_packet.c
├── [4.0K]  poc_fs_context_cred_common
│   ├── [4.0K]  include
│   │   ├── [ 271]  common.h
│   │   ├── [ 611]  fsopen_spray.h
│   │   ├── [1.2K]  keyring.h
│   │   ├── [ 866]  log.h
│   │   ├── [ 107]  modprobe.h
│   │   ├── [ 967]  netlink.h
│   │   ├── [ 571]  nf_tables.h
│   │   └── [  54]  raw_packet.h
│   ├── [ 469]  Makefile
│   └── [4.0K]  src
│       ├── [2.0K]  common.c
│       ├── [ 497]  fsopen_spray.c
│       ├── [2.6K]  keyring.c
│       ├── [7.9K]  main.c
│       ├── [2.6K]  modprobe.c
│       ├── [3.5K]  netlink.c
│       ├── [ 12K]  nf_tables.c
│       └── [2.0K]  raw_packet.c
├── [4.0K]  poc_keyring_common
│   ├── [4.0K]  include
│   │   ├── [ 204]  common.h
│   │   ├── [1.1K]  keyring.h
│   │   ├── [ 866]  log.h
│   │   ├── [ 967]  netlink.h
│   │   ├── [ 540]  nf_tables.h
│   │   └── [ 204]  raw_packet.h
│   ├── [ 539]  Makefile
│   └── [4.0K]  src
│       ├── [2.0K]  common.c
│       ├── [2.8K]  keyring.c
│       ├── [ 11K]  main.c
│       ├── [2.5K]  netlink.c
│       ├── [ 10K]  nf_tables.c
│       └── [2.0K]  raw_packet.c
├── [4.0K]  poc_keyring_normal
│   ├── [4.0K]  include
│   │   ├── [ 204]  common.h
│   │   ├── [ 133]  kernel_offset.h
│   │   ├── [1.1K]  keyring.h
│   │   ├── [ 866]  log.h
│   │   ├── [ 967]  netlink.h
│   │   ├── [ 540]  nf_tables.h
│   │   └── [ 204]  raw_packet.h
│   ├── [ 469]  Makefile
│   └── [4.0K]  src
│       ├── [2.0K]  common.c
│       ├── [2.7K]  keyring.c
│       ├── [6.4K]  main.c
│       ├── [2.5K]  netlink.c
│       ├── [ 10K]  nf_tables.c
│       └── [2.0K]  raw_packet.c
├── [ 971]  README.md
└── [254K]  sample_config

14 directories, 66 files

Shenlong Bot has cached this for you

Remarks

1. It is advised to access via the original source first.

2. Local POC snapshots are reserved for subscribers — if the original source is unavailable, the local mirror is part of the paid plan.

View subscription plans →

Goal Reached Thanks to every supporter — we hit 100%!