## https://sploitus.com/exploit?id=67FF2678-5C38-57C4-AE7A-BF9EFD226973
# CVE-2026-46331 – pedit COW Local Privilege Escalation Proof-of-Concept (PoC)
---
## 📋 Description
This repository contains a **functional proof-of-concept exploit** for **CVE-2026-46331**, a Linux kernel vulnerability in the `act_pedit` module of the traffic control (`tc`) subsystem.
The bug allows an **unprivileged local user** to corrupt the **page cache** of a **setuid-root** binary (e.g., `/bin/su`) by using the `pedit` action on loopback traffic. By overwriting the ELF entry point with a small shellcode, the exploit grants an **interactive root shell** without requiring a password.
**Kernel versions affected:** `v5.18` through `v7.1-rc6` (fixed in `v7.1-rc7`).
**⚠️ DISCLAIMER**
This code is provided for **educational and security research purposes only**.
Use it **exclusively on systems you own** or have **explicit written authorization** to test. Unauthorized use is illegal and unethical. The author takes no responsibility for misuse.
---
## 🧠 How It Works
The exploit follows a three‑stage process:
1. **Privilege acquisition** – A child process creates an **unprivileged user+network namespace** (`unshare(CLONE_NEWUSER|CLONE_NEWNET)`) and maps its UID/GID to `0` inside that namespace, effectively gaining `CAP_NET_ADMIN` without root privileges.
2. **Page‑cache corruption** – Inside the namespace, the child:
- Sets up a `clsact` qdisc on `lo` with an **egress filter** that uses the `pedit` action.
- Sends crafted loopback packets that trigger the `pedit` action to overwrite the **shared page cache** of the target setuid binary (e.g., `/bin/su`).
- Uses a **calibration routine** to map packet offsets to file offsets, ensuring precise writes.
3. **Shellcode injection** – The parent process (outside the namespace) writes a **48‑byte shellcode** into the `e_entry` offset of the target ELF. The shellcode:
- Calls `setgid(0)` and `setuid(0)` to gain root privileges.
- Executes `execve("/bin/sh")` to spawn an **interactive root shell**.
After corruption, executing the target binary (e.g., `/bin/su`) triggers the shellcode instead of the original code, granting root access **without any password prompt**.
---
## 🖥️ Requirements
| Requirement | Check |
| --- | --- |
| **x86\_64** architecture | ✅ All modern Linux systems |
| **Kernel** `5.18` – `7.1-rc6` (unpatched) | Run `uname -r` |
| **`tc`** command installed | Usually present (`tc -V`) |
| **`act_pedit`** kernel module | Loaded automatically if available |
| **Unprivileged user namespaces** enabled | Check `sysctl kernel.unprivileged_userns_clone` (should be `1`) |
| **A setuid‑root binary** (e.g., `/bin/su`) | Use `ls -la /bin/su` |
💡 **Most modern distributions (Ubuntu 24.04+, Debian 13+, RHEL 10) have already backported the fix.**
The exploit will **fail gracefully** (`Operation not permitted`) on patched systems – this is **expected** and **desirable**.
---
## 📦 Files
page_ops.h page_ops.c exploit.c README.md
| File | Description |
| --- | --- |
| `page_ops.h` | Header for the page‑cache write primitive |
| `page_ops.c` | Implementation of the primitive (calibration, netlink, tc, pedit) |
| `exploit.c` | Main exploit orchestrator (namespace, shellcode injection, exec) |
| `README.md` | This document |
---
## 🔧 Compilation
```
# Clone the repository
git clone https://github.com/yourusername/pedit-cow-exploit.git
cd pedit-cow-exploit
# Compile (requires gcc and standard headers)
gcc -O2 -Wall exploit.c page_ops.c -o exploit
```
**Common compilation issues:**
- **`TCA_EM_META_HDR undeclared`** – The code includes fallback definitions for missing kernel headers. If you still see errors, ensure you have `linux-headers-$(uname -r)` installed.
- **`page_ops.h not found`** – This PoC uses renamed files (`page_ops.*`). Make sure all three files are in the same directory.
---
## 🚀 Usage
### Default (most distributions)
```
./exploit
```
### Ubuntu with AppArmor restrictions
If you see `Operation not permitted` even on a vulnerable kernel, Ubuntu may block unprivileged user namespaces. Use the `--ubuntu` flag to re‑execute under an AppArmor profile that allows them (e.g., `trinity`, `chrome`, or `flatpak`).
```
# Try with the --ubuntu flag
./exploit --ubuntu
```
**Note:** `aa-exec` must be installed (`apt install apparmor-utils`). The exploit will try each profile and exit when one succeeds.
---
## 📊 Expected Output (on a vulnerable system)
```
[*] Target: /bin/su (uid=1000), entry offset=0x44d0, shellcode size=48
[+] Entry point overwritten. Executing /bin/su...
# whoami
root
```
**No password prompt – an interactive root shell is spawned immediately.**
---
## 🔬 How to Verify If Your System Is Vulnerable
A simple test (without running the full exploit) is to check if the `pedit` action can be added on `lo` inside a user namespace:
```
unshare -Urn
tc qdisc add dev lo clsact
tc filter add dev lo egress matchall action pedit ex munge offset 0 u32 set 0x41414141
tc -s filter show dev lo egress
```
If the last command shows a filter with `pedit` and **no error**, your system is likely vulnerable. If you get `Operation not permitted` at any step, **you are safe**.
---
## 🛡️ Mitigation & Remediation
If you are a system administrator and concerned about this vulnerability:
1. **Update your kernel** – apply the vendor patch that fixes CVE‑2026‑46331 (kernel ≥ `v7.1-rc7`).
2. **Disable unprivileged user namespaces** (if your workload allows):
```
sysctl -w kernel.unprivileged_userns_clone=0
```
3. **Block the `act_pedit` module** (if it is not essential):
```
echo "blacklist act_pedit" > /etc/modprobe.d/blacklist-pedit.conf
```
---
## 📚 References
- [CVE-2026-46331 NVD entry](https://nvd.nist.gov/vuln/detail/CVE-2026-46331)
- [Linux kernel patch commit (v7.1-rc7)](https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=...)
- [Linux Kernel: net/sched: act\_pedit: Use xchg() for COW safety](https://lore.kernel.org/all/...)
---
## 🧪 Tested On
| Distribution | Kernel | Status |
| --- | --- | --- |
| Ubuntu 24.04 LTS | 6.8.0‑45‑generic | ✅ Vulnerable (no patch yet) |
| Debian 13 (trixie) | 6.12.74‑deb13+1 | ❌ Patched (safe) |
| RHEL 10.0 | 6.12.0‑27.el10 | ✅ Vulnerable |
| Arch Linux | 7.1‑rc5‑test | ✅ Vulnerable |
---
## 🤝 Contributing
This is a **proof‑of‑concept**, not a production tool. If you find bugs or improvements, feel free to open an issue or a pull request. Please keep contributions in the same **educational/research** spirit.
---
## 📝 License
This project is licensed under the **MIT License** – see the [LICENSE](LICENSE) file for details.
*By using this code, you agree to the Disclaimer above.*
---
## 🌟 Acknowledgments
- The Linux kernel security team for their continued work on fixing vulnerabilities.
- The open‑source community for making security research accessible.
**Stay curious, hack ethically, and keep your systems up‑to‑date.**