Sploitus

Exploit for Use After Free in Linux Linux Kernel

CVE-2026-43499

githubexploit · 2026-08-24

Exploit Code

README71 lines
## https://sploitus.com/exploit?id=E7C710B0-7BE6-5C09-AEB3-E40CA55C9291
# CVE-2026-43499 — GhostLock on Huawei Nova 9 (NAM-AL00)

Security research: on-device confirmation and exploitation analysis of CVE-2026-43499 (GhostLock)
on Huawei Nova 9 (NAM-AL00, Snapdragon 778G/SM7325, HarmonyOS 4.2.0.185, kernel 5.4.86-qgki).

## Summary

CVE-2026-43499 is a stack use-after-free in the Linux kernel's rt_mutex subsystem,
introduced in v2.6.39 (2011). This repository confirms the vulnerability fires
deterministically on NAM-AL00 running HMOS 4.2 with SPL 2025-07-01, documents the
complete exploitation methodology, and analyzes why full root was not achieved.

## Confirmed

- âś… EDEADLK rollback fires deterministically (bug trigger)
- âś… KASLR defeated per-boot via perf_event callchain leak
- âś… Full symbol recovery (224,986 symbols from raw Image)
- âś… Dual-planter delivery verified aligned (pselect6 + PR_SET_MM_MAP)
- âś… Walk consumes forged waiter fields (wedge = proof of dereference)

## Not achieved

- ❌ Arbitrary write proof (Huawei-modified walk semantics prevent clean termination)
- ❌ Temp root (blocked by post-exit cleanup + in-walk divergence)

## Key findings

| Finding | Detail |
|---|---|
| HKIP | NOT present on SM7325 (EL2 = Qualcomm Haven) |
| SLAB_FREELIST_HARDENED | NOT SET — freelist pointers unhardened |
| CONFIG_FUTEX_PI | y — vulnerable code path present |
| check_root module | Built-in anti-root detector at EL1 |
| PR_SET_MM_MAP planter | Copy-before-capable-check enables unprivileged stack planting |

## Files

```
poc/poc_trigger.c      — deterministic EDEADLK trigger (stage-1 PoC)
poc/perf_probe.c       — KASLR slide extraction via perf_event
exploit/stage3_main.c  — integrated pipeline (trigger→plant→punch→oracle)
exploit/escalate.c     — post-write escalation core (cred/sid/seccomp)
exploit/stage2_forge.h — forged rt_mutex_waiter composer
sim/sim_final.py       — Unicorn emulator oracle (offline walk trace)
offsets/offset.h       — all verified symbol addresses & struct layouts
analysis/kernel.config — extracted build configuration
analysis/symbols.txt   — 224,986 recovered kallsyms entries
```

## Build

```bash
# Trigger PoC
${NDK}/toolchains/llvm/prebuilt/linux-x86_64/bin/aarch64-linux-android33-clang \
    -O2 -static -pthread -o poc_trigger poc/poc_trigger.c

# Run on device
adb push poc_trigger /data/local/tmp/
adb shell /data/local/tmp/poc_trigger 10
```

## References

- [CVE-2026-43499](https://nvd.nist.gov/vuln/detail/CVE-2026-43499)
- [Nebula Security Analysis](https://nebusec.ai/research/ionstack-part-2/)
- [Root Without Unlock Bootloader List](https://github.com/lokey0905/rootWithoutUnlockBootloaderList)

## License

MIT