https://kiperz.dev/tags/dirty-pipe/ Recent content in Dirty-Pipe on kiperZ Hugo -- 0.147.7 en-us Fri, 05 Jun 2026 00:00:00 +0000 https://kiperz.dev/writeups/qb---thjcc-ctf-2026/ Fri, 05 Jun 2026 00:00:00 +0000 https://kiperz.dev/writeups/qb---thjcc-ctf-2026/ <h2 id="tldr">TL;DR</h2> <p>A single-byte NULL off-by-one in a <code>kmalloc-1024</code> object is leveraged into a <code>pipe_buffer.page</code> LSB clear → page-level UAF → cross-cache reclaim into <code>filp_cachep</code> → <code>struct file-&gt;f_mode</code> overwrite → page-cache code injection into <code>/bin/busybox</code> (Dirty-Pipe style) → root code execution. <strong>Fully leakless</strong>: no kernel address is ever read.</p> <pre tabindex="0"><code>Description: Make a contract and become a magical girl! </code></pre><p>Target: Linux <strong>6.17.7</strong>, x86-64. Mitigations on: SMEP, SMAP, KPTI (<code>pti=on</code>), KASLR, <code>dmesg_restrict=1</code>, <code>kptr_restrict=1</code>. The interactive shell runs as <strong>uid 1000</strong>.</p>