Exploit for Use After Free in Linux Linux_Kernel CVE-2026-43499

Name: Exploit for Use After Free in Linux Linux_Kernel CVE-2026-43499
Rating: 5 (9 reviews)
2026-07-31 | CVSS 7.8
## https://sploitus.com/exploit?id=000B0D99-BDC0-5979-88BB-9B366D8541F6
# CVE-2026-43499 vivo PD2425 Exploit Adaptation Project

A porting project for local kernel privilege escalation on the vivo PD2425 (SM8650 / Android 14 / Kernel 6.1.145) based on the GhostLock vulnerability (CVE-2026-43499).

## Project Status

> **Current Phase: P0 (KASLR Bypass) —— Under Development**

| Phase | Status | Description |
|------|------|------|
| NDK Compilation | Complete | preload.so compiled successfully |
| KernelSnitch mm_struct Leak | Complete | Stable retrieval of leaked_mm |
| Page spray + SKB reclamation | Completed | reclaim send ret=65536 |
| Futex CMP_REQUEUE_PI | Completed | owner chain skipped (errno=35) — expected behavior |
| sched_setattr preemption | Complete | sched_ok=1 |
| **boot_id overwrite (KASLR bypass)** | **Blocked** | Always reads the original UUID; kernel write misses the target |
| P2 File Operation Hijack | Pending | Depends on kaslr_slide |
| P3 SELinux + Root | Pending | Depends on P2 |

## Exploit Chain

```
P0: SLIDE primitive leaks kernel pointer → KASLR bypass
P1: SLIDE primitive writes to kernel memory
P2: Modify kernel file operation table → Arbitrary read/write
P3: Disable SELinux → Escalate to root
```

### Current Run Log

```
[+] preload starting pid=9835
[+] startup context pid=9835 uid=2000 euid=2000 gid=2000 egid=2000
[+] build config pid=9835 label=pd2425_up1a_231005_007
[+] p0 profile phys_offset=0000000080000000 kernel_phys_load=0000000080000000
[-] perf text-base perf_event_open errno=13
[*] prepare_kernel_page leaked_mm=ffffff8954ddb800
[*] slide attempt 1/20
[*] slide owner chain skipped (errno=35); held target
[*] slide tcp seq=16 ret=0 errno=0 len=64 calls=1 sched_ok=1
[-] slide bad leaked pointer=67406f9190b78536    ← Original boot_id UUID value
[-] slide attempt 1 failed n=0 status=256
```

## Device Information

| Attribute | Value |
|---- --|-----|
| Device Model | vivo PD2425 |
| Platform | Qualcomm SM8650 (Snapdragon 8 Gen 3) |
| Android Version | 14 (UP1A.231005.007) |
| Kernel Version | 6.1.145-android14-11-g |
| Kernel Image Offset | text_offset = 0x00000000 |
| Physical Memory Base Address | P0_PHYS_OFFSET = 0x80000000 |
| Kernel Physical Load Address | P0_KERNEL_PHYS_LOAD = 0x80080000 |
| Kernel Image Base Address | KIMAGE_TEXT_BASE = 0xffffffc008000000 |
| rt_mutex_waiter Size | 0x58 (compact mode) |

## Current Issues

### 1. Failure to overwrite `boot_id` (kernel blocking issue)

**Symptoms**: After executing the SLIDE primitive, reading `/proc/sys/kernel/random/boot_id` always returns the original UUID value `67406f91-906f-4067-...`, rather than the kernel pointer that was written.

**Confirmed Facts**:
- A successful pselect return + sched_ok=1 only proves that the scheduler preempted successfully; it **does not prove that the kernel write has occurred**
- The `FIX_REPORT.md` file in the rmx3888 benchmark repository also documents the same issue
- The physical address constants have been independently verified through ABL reverse engineering (`P0_PHYS_OFFSET=0x80000000`, `P0_KERNEL_PHYS_LOAD=0x80080000`), ruling out constant errors

**Possible Causes**:
1. The alias relationship between the reclaimed fake page and the kernel’s `sysctl_bootid` object was not established — the write operation could not hit the target address
2. The layout of the `rt_mutex_waiter` structure does not match the actual kernel, causing pointer offset errors during PI tree traversal
3. The `sysctl_bootid` for the PD2425 is located in a different memory region than that for the rmx3888, and the slab reclamation strategies differ
4. SLIDE writes occur on the wrong cache line or page

**Possible Solutions**:
1. Use `SLIDE_WRITE_SCRATCH=1` to diagnose whether writes reach the fake page
2. Verify whether slab reclamation actually assigns phantom pages to the target `sysctl_bootid` object
3. Investigate establishing alternative KASLR leak paths through other kernel objects (such as `nfulnl_logger`)
4. Try the `SLIDE_WONLY_BOOTID` mode (simplifies the waiter layout by writing only to the `boot_id` field)
5. Lower the `perf_event_paranoid` level to enable the `perf_event_open` KASLR bypass (requires root privileges to set initially)
6. Directly calculate the kernel base address using the P0 physical address Oracle (if the physical memory layout is known)

### 2. perf_event_paranoid Restrictions

**Symptom**: `perf_event_open` returns `errno=13` (EACCES). The current device’s `perf_event_paranoid` is `>= 2`, preventing non-privileged processes from accessing perf events.

**Possible Solutions**:
- You must first obtain a certain privilege level to modify `/proc/sys/kernel/perf_event_paranoid`
- Find other KASLR bypass methods that do not rely on perf

## Attempted but Failed Solutions

| Solution | Principle | Reason for Failure |
|------|------|---------|
| tracefs sched_blocked_reason | Read the worker caller address from a blocked event via the trace pipe | The caller address is located in the vmalloc module region; it is not a kernel image address |
| tracefs sched_blocked_reason | Read the caller address from the worker in a blocked event via the trace pipe | The caller address is an ASCII string (e.g., "arch_tim"), not a pointer value |
| tracefs hrtimer_start | Reading the handler pointer from a high-precision timer event | All caller addresses are in module space (0xffffffd0...) |
| perf_event_open | Samples kernel IP addresses via perf events | perf_event_paranoid level is too high (errno=13 EACCES) |
| pselect multiple shift values | Attempt different PSELECT_WAITER_WORD_SHIFT values (0–7) | All shift values return the same error |

## Data Sources and Functions

### Kernel Symbols and Offsets

| Data Source | Path/File | Purpose |
|----------|----------|------|
| boot.img (A2.zip) | Original device firmware | Extract kernel image (kernel.img) |
| init_boot.img (A2.zip) | Device original firmware | Extract ramdisk and device information |
| symbols_pd2425.json | Output from the `vmlinux-to-elf` tool | Complete kernel symbol table; all offsets are precisely verified based on this |
| abl.img | Device ABL partition | Reverse-engineered to verify P0 physical memory constants |

### Key Symbol Offsets (Verified)

| Symbol | Kernel Offset | Data Source | Purpose |
|------|---------|---------|------|
| `loggers[]` | 0x021d2ee0 | symbols_pd2425.json | Base address of the `nf_logger` array |
| `nfulnl_logger` | 0x021d2f98 | symbols_pd2425.json | netfilter log object |
| `sysctl_bootid` | 0x0257a548 | symbols_pd2425.json | boot_id UUID buffer |
| `init_task` | 0x021dfc00 | symbols_pd2425.json | Initial task structure |
| `root_task_group` | 0x02422740 | symbols_pd2425.json | Root task group |
| `selinux_enforcing_boot` | 0x0217a9d8 | symbols_pd2425.json | SELinux enforcement state |
| `ashmem_fops` | 0x013434b0 | symbols_pd2425.json | ashmem file operation table |
| `generic_file_splice_read` | 0x0045d078 | symbols_pd2425.json | splice read function |
| `noop_llseek` | 0x0040f5e4 | symbols_pd2425. json | No-op seek |
| `misc_fops` | 0x012e3ba0 | symbols_pd2425.json | Miscellaneous file operations table |

### Firmware Analysis Data

| Data Source | Path | Purpose |
|----------|------|------|
| ABL Outer Container | ELF32 ARM (2.4 MB) | Android Bootloader |
| ABL Compression Layer | LZMA-compressed UEFI FV | Contains LinuxLoader |
| LinuxLoader | PE32+ AArch64 EFI Application | Kernel loader; verifies P0 constant |
| xbl_config.img | XBL configuration partition | Verifies starting address of DDR memory region |

### Key ABL Constants (Verified)

| Offset | Value | Meaning |
|------|-----|------|
| 0x8caa0 | 0x00080000 | ARM64 kernel load offset |
| 0x8caa4 | 0x05600000 | ARM64 kernel region size (86 MB) |
| xbl_config | memory@80000000 | First DDR memory region |

## Compilation and Deployment

### Environment Requirements

- Android NDK r29 (or later)
- Target API Level: 35

### Compilation

```bash
make PROJECT=PD2425-UP1A.231005.007
```

Output: `build/PD2425-UP1A.231005.007/bin/preload.so`

### Deployment

```bash
adb push preload.so /data/local/tmp/preload.so
adb shell chmod 755 /data/local/tmp/preload.so
adb shell LD_PRELOAD=/data/local/tmp/preload.so id
```

### Diagnostic Options

```bash
# Detailed logging
adb shell SLIDE_QUIET_CONSUMER=0 LD_PRELOAD=/data/local/tmp/preload.so id

# View complete futex logs
adb shell SLIDE_QUIET_FUTEX=0 LD_PRELOAD=/data/local/tmp/preload.so id

# Specify the shift value
adb shell SLIDE_SHIFT=3 LD_PRELOAD=/data/local/tmp/preload.so id

# Enable scratch diagnostics
adb shell SLIDE_WRITE_SCRATCH=1 LD_PRELOAD=/data/local/tmp/preload.so id
```

## Project Structure

```
.
├── Makefile # Build system
├── README.md # This document
├── assets/
│   └── wallpaper.webp # Wallpaper resources
└── src/
├── common.h # Common header file
├── offset.h # Target configuration routing
├── realtime_log.h # Real-time logging
├── main.c # Main entry point
├── fops.c # File operation hijacking (P2)
├── pipe.c # Physical pipe read/write (P2)
├── root.c # SELinux + Root (P3)
├── preload.c # LD_PRELOAD entry point + su installation
├── slide.c # Generic SLIDE implementation (fallback)
├── su_blob.S # su binary embedding
├── su_daemon.c # su daemon
├── wallpaper_blob.S # Wallpaper binary embedding
├── kernelsnitch/
│   ├── futex_hash.h # futex hash
│   ├── kernelsnitch.h # KernelSnitch core
│   ├── timeutils.h # Time utilities
│   └── utils.h # General utilities
└── targets/
└── PD2425-UP1A.231005.007/
├── target.h # PD2425-specific configuration and offsets
├── slide.c # PD2425-specific SLIDE implementation
└── util.c # PD2425-specific utility functions
```

## Reference Documentation

- [CVE-2026-43499 (GhostLock) Original Vulnerability](https://github.com/Bailan766/rmx3888-cve-2026-43499-config) — Baseline Repository (rmx3888)
- [Root-My-Galaxy-Payloads](https://github.com/BuSung-dev/Root-My-Galaxy-Payloads) — Samsung S928U1 adaptation reference (tracefs KASLR bypass method)
- [duchamp-root](https://github.com/Colorful-glassblock/duchamp-root) — Redmi K70 Ultra adaptation reference (perf_event_open KASLR bypass method)
- [S928U1 ABL Analysis Documentation](https://github.com/BuSung-dev/Root-My-Galaxy-Payloads/blob/main/docs/SM-S928U1-S928U1UES6DZF2.md) — ABL Analysis Methodology
- [NebuSec/CyberMeowfia commit c87b866](https://github.com/NebuSec/CyberMeowfia/commit/c87b866) — Key reference commit during the adaptation process
- [Android NDK r29](https://developer.android.com/ndk/downloads) — Compilation toolchain
- [vmlinux-to-elf](https://github.com/marin-m/vmlinux-to-elf) — Kernel symbol recovery tool