Hasty Briefsbeta

Bilingual

I Found a $113,337 Af_alg Linux Local Privilege Escalation Before Copy Fail

10 hours ago
  • CVE-2025-39964 is an AF_ALG vulnerability in the Linux kernel that allows unprivileged users to escalate privileges to root.
  • The bug is a race condition between concurrent sendmsg() calls on the same AF_ALG socket, leading to an out-of-bounds access.
  • The vulnerable code existed since Linux 2.6.38 (2011) and was fixed in 2025 by disallowing concurrent writes in af_alg_sendmsg.
  • Exploitation leverages a controlled heap spray to influence sg[-1] fields, converting the OOB read into an arbitrary kernel write via memcpy_from_msg.
  • The write target is core_pattern, causing the kernel to execute a user-provided program as root when a core dump occurs.
  • The exploit works in kernelCTF environment and was rewarded with $113,337.00 USD, also enabling Docker container escape.
  • Key insight: the usercopy path in memcpy_from_msg() acts as an oracle, allowing safe probing of computed destinations without crashing the kernel.