Add kernelCTF CVE-2024-1085_lts

[JordyZomer]

Hiya!

I've been reviewing your submission and have a few suggestions to improve it a bit!

Genmask States: Could we add a section explaining the different genmask states (nft_is_active vs. nft_is_active_next)? Providing context on why using the incorrect state is problematic would help other readers understand the source of the vulnerability.

Object Caches: It would be helpful to specify which caches the affected objects are stored in. This could further clarify the exploit's impact.

The purpose and type of this code snippet are not immediately clear:

*(uint64_t *)&pad[0x78] = kernel_off + 0xFFFFFFFF83967420;//last type

Could you please elaborate on where this is used within the exploit, why it's necessary, and what the expected data type is?

Thanks for participating in kernelCTF! :)

Cheers,

Jordy

[lonialcon2]

Hiya!

I've been reviewing your submission and have a few suggestions to improve it a bit!

Genmask States: Could we add a section explaining the different genmask states (nft_is_active vs. nft_is_active_next)? Providing context on why using the incorrect state is problematic would help other readers understand the source of the vulnerability.

Object Caches: It would be helpful to specify which caches the affected objects are stored in. This could further clarify the exploit's impact.

The purpose and type of this code snippet are not immediately clear:

*(uint64_t *)&pad[0x78] = kernel_off + 0xFFFFFFFF83967420;//last type

Could you please elaborate on where this is used within the exploit, why it's necessary, and what the expected data type is?

Thanks for participating in kernelCTF! :)

Cheers,

Jordy

Hi,

I've added more details of exploit.md and exploit.c. Please check it.

Thanks,

Lonial con