Add kernelCTF CVE-2025-39964_lts_cos_mitigation

[st424204]

No description provided.

[koczkatamas]

I verified the exploit, the writeup was good enough, but mapping the steps to the exploit code was not trivial to me, to see where the different steps happening:

1. the loop with 0x7b + the sendmsg and send calls are executing 125 times which matches with MAX_SGL_ENTS - 1 as MAX_SGL_ENTS is ((4096 - sizeof(struct af_alg_tsgl)) / sizeof(struct scatterlist) - 1) so (4096-24)/32-1 = 126.

2. send(opfd, buf, 0x200, MSG_MORE); is probably

Let say we send len below the PAGE_SIZE, so ctx->merge will set to 1, then this thread will finish.

3. send(opfd, (void *)0xfff000, 0x400, MSG_MORE); is probably

Now sgl->cur is MAX_SGL_ENTS, it will alloc another sgl at af_alg_alloc_tsgl [3], so we have last sgl that have sgl->cur = 0. In this state, we passed invalid user space addr. So code will fail in this line

Next time try to include in the exploit which call does which steps, otherwise we may stop verification and ask you for changes first which will make the payout process slower.

[koczkatamas]

Some comments along the line, please explain the exploit in more detail, I stopped reviewing because it was hard to follow what's going on exactly.

Make sure you follow the style guide: https://google.github.io/security-research/kernelctf/style_guide

[koczkatamas]

Explain this part (everything from here until the end of the writeup) in more depth, it's hard to follow that's going on exactly.

[koczkatamas]

Explain the whole logic better behind the binary search, what's going on exactly, how the oracle works, etc.

[koczkatamas]

What's at offset 0xff8? (-8)

[koczkatamas]

Remove unnecessary lines.

[koczkatamas]

Explain more about this allocation (why chose the size 0x80000000ULL, etc).

[koczkatamas]

Do we need these RUN files? It seems core_pattern is also specified in the source code as well.

[koczkatamas]

We've asked our friendly AI to review your exploits based on our style guide and here are its recommendations to guide your fixing.

We manually checked the findings, but it can still contain mistakes, please double-check it and feel free to push back if you think it's wrong.

Please take a look below.

[koczkatamas]

Unused array tid2 clutters the global scope.

Recommendation: Remove the unused array declaration.

AI-suggested fix (do not apply blindly, but can be helpful for inspiration): remove the line.

Read more about this violation in the 'Unused code' section of the style guide.

This comment is AI-generated. Although it was manually checked, it can still contain mistakes, please double-check it and feel free to push back if you think it's wrong.

[koczkatamas]

Using a global variable for a generic temporary buffer instead of localized buffers.

Recommendation: Move the buffer to the local scope of the functions that require it.

AI-suggested fix (do not apply blindly, but can be helpful for inspiration):

char buf[0x10000]; // moved inside main2 or job function

Read more about this violation in the 'Usage of global variables instead of local ones' section of the style guide.

This comment is AI-generated. Although it was manually checked, it can still contain mistakes, please double-check it and feel free to push back if you think it's wrong.

[koczkatamas]

Mismatch between the allocated array size (0x200) and actual usage (0x100).

Recommendation: Change the allocation size to match the exact number of threads used.

AI-suggested fix (do not apply blindly, but can be helpful for inspiration):

int sfd[THREAD_NUM][2];

Read more about this violation in the 'Match iteration count for allocation, creation and usage' section of the style guide.

This comment is AI-generated. Although it was manually checked, it can still contain mistakes, please double-check it and feel free to push back if you think it's wrong.

[koczkatamas]

Unused array sfd2 is present in the code.

Recommendation: Remove the unused array declaration.

AI-suggested fix (do not apply blindly, but can be helpful for inspiration): remove the line.

Read more about this violation in the 'Unused code' section of the style guide.

This comment is AI-generated. Although it was manually checked, it can still contain mistakes, please double-check it and feel free to push back if you think it's wrong.

[koczkatamas]

Generic macro name used for a length constant.

Recommendation: Rename it to something more descriptive like MMAP_REGION_LEN.

AI-suggested fix (do not apply blindly, but can be helpful for inspiration):

#define MMAP_REGION_LEN (0x1000 / 8 * 0x1000)

Read more about this violation in the 'Naming conventions' section of the style guide.

This comment is AI-generated. Although it was manually checked, it can still contain mistakes, please double-check it and feel free to push back if you think it's wrong.

[koczkatamas]

Repeating lines of modification or execution requires explanation to prove it is not a typo and to document its purpose.

Recommendation: Either wrap the code in a loop or leave a comment explicitly stating the reason for executing it six times.

AI-suggested fix (do not apply blindly, but can be helpful for inspiration):

// Repeatedly execute cat /flag to ensure success before panic for (int i = 0; i < 6; i++) { system("cat /flag"); }

Read more about this violation in the 'Explain duplicated lines' section of the style guide.

This comment is AI-generated. Although it was manually checked, it can still contain mistakes, please double-check it and feel free to push back if you think it's wrong.

[koczkatamas]

Exploit staging functions must be named descriptively to inform the reader about the steps taking place.

Recommendation: Rename the function to something descriptive like execute_cross_cache_exploit.

AI-suggested fix (do not apply blindly, but can be helpful for inspiration):

int execute_cross_cache_exploit()

Read more about this violation in the 'Naming conventions' section of the style guide.

This comment is AI-generated. Although it was manually checked, it can still contain mistakes, please double-check it and feel free to push back if you think it's wrong.

[koczkatamas]

Numeric constants determining counts and iteration constraints must be named and/or commented.

Recommendation: Define a macro or provide a comment explaining what the limit 0x7b achieves.

Read more about this violation in the 'Name and/or comment numeric constants' section of the style guide.

This comment is AI-generated. Although it was manually checked, it can still contain mistakes, please double-check it and feel free to push back if you think it's wrong.

[koczkatamas]

Every sleep() call must feature a comment explaining what background kernel task it waits for.

Recommendation: Add a descriptive sleep comment explaining the delay trigger.

AI-suggested fix (do not apply blindly, but can be helpful for inspiration):

// @sleep(desc="Wait for network operation to complete handling before advancing") sleep(1);

Read more about this violation in the 'Sleeping & waiting' section of the style guide.

This comment is AI-generated. Although it was manually checked, it can still contain mistakes, please double-check it and feel free to push back if you think it's wrong.

[koczkatamas]

Applying complex arithmetic using hardcoded sizes and magic offsets into raw buffers is strictly discouraged.

Recommendation: Use a struct layout or defined macros for offsets and size constants.

AI-suggested fix (do not apply blindly, but can be helpful for inspiration):

#define MAGIC_GUESS_ADJUST 0x500000000000ULL #define PAYLOAD_OVERLAP_OFFS 0xff8 *(size_t *)&payload[PAYLOAD_OVERLAP_OFFS] -= (MAGIC_GUESS_ADJUST >> 6);

Read more about this violation in the 'Sprayed and leaked structures' section of the style guide.

This comment is AI-generated. Although it was manually checked, it can still contain mistakes, please double-check it and feel free to push back if you think it's wrong.