Messenger - LACTF 2025

Sun, 17 May 2026 00:00:00 +0000

TL;DR

A 3-byte heap OOB write in msgsnd() is leveraged into a page-level UAF and then into root via a struct cred overwrite (PageJack).

Description: i love sending messages, so i made it possible to add just a few more bytes to them

Vulnerability

A custom Linux 6.10.9 kernel ships with the following patch in ipc/msgutil.c:

@@ -93,7 +93,7 @@
        return ERR_PTR(-ENOMEM);

    alen = min(len, DATALEN_MSG);
-   if (copy_from_user(msg + 1, src, alen))
+   if (copy_from_user(msg + 1, src, alen + 3))
        goto out_err;

load_msg(), invoked by msgsnd(), copies alen + 3 bytes from userland into a freshly-allocated msg_msg slab object. Three bytes are written past the end of the slot, into the next object in the same slab. The allocation size (via msgsz) and the three overflow bytes (bytes [msgsz, msgsz+1, msgsz+2] of the user buffer) are both attacker-controlled.

Lactf 2025 on kiperZ

Messenger - LACTF 2025

TL;DR

Vulnerability