Returning Cleanly to User Space

/* After privesc, get back to ring 3 without a crash: */
//  swapgs ; restore user CR3 (KPTI trampoline) ; iretq
//  iretq pops saved: RIP, CS, RFLAGS, RSP, SS  (user context)
if (getuid() == 0)
    execve("/bin/sh", ...);   /* now a root shell */

• After running in ring 0 you must restore user state exactly, or the CPU faults and the box panics.
• Save the user CS, SS, RFLAGS, RSP early; the exploit uses iretq to return to a chosen user function.
• With KPTI enabled, user and kernel use separate page tables, so you must go through the KPTI trampoline (swapgs_restore_regs_and_return_to_usermode) to swap CR3 and GS back.
• Land in a saved user function that checks getuid()==0 and launches /bin/sh.