Kernel on bitfriends' blog

Reviving modprobe_path technique (again)

Fri, 03 Jul 2026 23:22:28 +0700

Overview Link to heading

The modprobe_path technique is a widely known Linux kernel exploitation primitive that can be used to turn an arbitrary write primitive into LPE.

TL;DR Link to heading

modprobe_path is a string that specifies the name of the modprobe executable in the Linux kernel. This program is responsible for adding and removing loadable kernel modules.

When CONFIG_STATIC_USERMODEHELPER is disabled modprobe_pathis R/W, this means that if we have an arbitrary write primitive and a KASLR leak, we can change it to a controlled executable file path. If we now find a way to make the kernel run modprobe for us, it will run our executable with root privileges, thus achieving LPE.

heap_master - n1ctf 2024

Thu, 09 Jan 2025 15:59:10 +0100

Heap_master was a kernel pwn challenge from n1ctf. I didn’t play the ctf, allthough the challenge seemed nice to upsolve. Let’s get started

For the environment, we were given a Linux 6.1.110 image as well as a config file. Before looking at the config file, the fact that we have an nsjail environment. In our case, this means a bunch of disabled syscalls, no setuid binaries, and only few useful files in /dev and /proc directories. The goal is hereby not only to get root, but also escape the nsjail to read flag.txt. We need to take this into account when creating our exploit.

physler - BRICS CTF 2024

Sun, 20 Oct 2024 12:18:45 +0200

Physler was another challenge from BRICS CTF that I solved. We basically got a kernel module that has two ioctl requests defined:

case IOCTL_MAP_PHYS_ADDR: {
 if (copy_from_user(&_map, (void*)arg, sizeof(_map))) {
 return -EFAULT;
 }

 if (mem)
 iounmap(mem);

 mem = ioremap(_map.phys_addr, _map.size);

 if (!mem) {
 return -EFAULT;
 }
 break;
}
case IOCTL_WRITE_PHYS_MEM: {
 if (!mem)
 return -EFAULT;

 if (copy_from_user(&_write, (void*)arg, sizeof(_write))) {
 return -EFAULT;
 }

 size = _write.size;

 if (size > sizeof(kernel_buffer))
 size = sizeof(kernel_buffer);

 if (copy_from_user(kernel_buffer, (char *)_write.in_data, size))
 return -EFAULT;

 memcpy_toio(mem, kernel_buffer, size);
 break;
}

This essentially lets us map any physical address and write arbitrary data to it - all as normal user since this also bypasses all virtual access protections for pages/memory regions, we can overwrite kernel code. To get the physical kernel base, we can read /proc/iomem:

My own kernel fuzzer - lxfuzz

Sat, 07 Sep 2024 18:11:00 +0200

My long-term project is writing a kernel fuzzer named lxfuzz. It is a coverage-guided fuzzer for the linux kernel. I chose that project for some reasons:

To learn about fuzzing, its mechanisms etc. in general
To learn more about the linux kernel, especially
To improve my C++ skills :) (the language used for lxfuzz)
Profit (finding CVEs)

Under the hood it’s using qemu to run the kernel and KCOV for coverage collection. The project is still work-in-progress and developed gradually. Current features are:

Exploiting the kernel - CVE-2022-24122

Sun, 12 Mar 2023 17:47:13 +0200

For the first time I exploited the kernel in real life. I used the bug CVE-2022-24122, which allowed a use-after-free due to bad use of refcount.

The exploit itself requires a KASLR leak to prevent an oops during the process, as well as access to user namespaces. It is not really reliable, needs many tries :D

To get root I corrupted the SLUB freelist and wrote to modprobe_path.

The exploit code can be found on GitHub or in the following: