CSC 472 · Lab 7

Kernel Exploitation: Use-After-Free

glibc heap: a dangling pointer to a freed chunk becomes a read/write primitive.

The goals of this lab:

Understand the concepts of kernel exploitation and local privilege escalation.
Exploit a use-after-free (UAF) in a vulnerable kernel driver to gain root.

We use QEMU to boot a small Linux kernel image with a deliberately vulnerable char driver, /dev/babydev. Everything runs inside QEMU, so a mistake only crashes the emulated guest — never Badger itself.

Note

Safety. Kernel bugs crash the whole (emulated) machine. Work only inside the provided QEMU guest. Never load experimental kernel code on a machine you care about.

Target 1: Boot QEMU (2 points)

Create a working directory and copy the lab image: mkdir lab7 && cd lab7 cp /workdir/ss2026/lab7/lab7.tar . tar -xvf lab7.tar
This yields boot.sh, bzImage, and rootfs.cpio. Boot the kernel: ./boot.sh

Q1: How many folders are there inside the root (/) directory of the booted guest? (2 pts)

Target 2: Repack the initramfs (2 points)

To add your exploit to the guest, unpack and later repack rootfs.cpio. Exit QEMU (exit), then:

mkdir fs && cd fs cp ../rootfs.cpio . && mv rootfs.cpio rootfs.cpio.gz gunzip rootfs.cpio.gz cpio -idmv < rootfs.cpio

Q2: Take a screenshot of the output of cpio -idmv < rootfs.cpio. (2 pts)

Target 3: Compile and run your exploit (3 points)

Copy the exploit skeleton, add your name, build it static, and repack:

cp /workdir/ss2026/lab7/lab7_exp.c ./exp.c # edit exp.c: put your name in the "get root" message gcc exp.c -static -o exp find . | cpio -o —format=newc > ../rootfs.cpio cd .. && ./boot.sh

Inside the guest, run ./exp.

Q3: Take a screenshot of the output of ./exp (you should get a root shell; confirm with id). (3 pts)

Target 4: Understand the UAF (3 points)

Read exp.c and the driver's behavior, then answer:

Q4: Why do we open /dev/babydev twice? (1 pt)

Q5: What is the purpose of the ioctl that sets the object size to 0xa8? Why that value? (1 pt)

Q6: What does writing zeros through the dangling descriptor accomplish, and how does that give you root? (Relate it to the cred structure.) (1 pt)

Hint

Review Class 10: Kernel Exploitation. The idea: two descriptors share one heap object; freeing via one leaves the other dangling; fork() reallocates a cred into that freed slot, which you then overwrite to become uid 0.

Deliverables

A PDF report answering Q1—Q6 with screenshots and your exp.c.

Submission

The lab due date is available on our course website. Late submissions will not be accepted.
Submit your assignment to D2L directly.
No plagiarism or cheating is tolerated. If your work is based on others' or AI, please give clear attribution. Otherwise, you WILL FAIL this course.