PPhying中文
Curated security research, vulnerabilities, advisories and tools for practitioners.

Reviving the modprobe_path Technique: Overcoming search_binary_handler() Patch

theori.io | research | #privilege-escalation | #linux-kernel | #modprobe-path | #exploit-technique | #af-alg
📄 Raw .md⬇️ Download .md🔗 Original ↗

Summary

A new spin on the classic modprobe_path privilege-escalation technique after the kernel removed the dummy-file trigger: Frontier Squad reaches call_modprobe via AF_ALG sockets and fileless chaining.
Published
Collected

Related coverage

research · starlabs.sg
[CVE-2025-39964] How I Found a $113,337 AF_ALG Linux Local Privilege Escalation Before Copy Fail
A retrospective on CVE-2025-39964, an AF_ALG race condition causing out-of-bounds scatterlist access in the Linux kernel. Exploitation yields root and a Docker container escape.
research · github.com
Infinity Core: Linux Kernel Core Subsystems LPE and Container Escape Research
Unlike most modern Linux kernel exploits that depend on networking, eBPF, or unprivileged user namespaces, these vulnerabilities reside in fundamental kernel core subsystems, rendering standard container sandboxes and Android application domain restrictions ineffective against local privilege escalation.
vulnerability · idnsec.com
[CVE-2025-39964] How I Found a $113,337 AF_ALG Linux Local Privilege Escalation Before Copy Fail
Write-up of CVE-2025-39964, an AF_ALG race condition in the Linux kernel enabling an out-of-bounds scatterlist write. The exploit overwrites core_pattern for root and a Docker container escape.
research · mccaulay.co.uk
go2shell: Rooting Home Assistant through SSDP
# go2shell: Rooting Home Assistant through SSDP 7 October 20267 October 2026 McCaulayVulnerability Research ## Introduction Home Assistant is one of the most widely deployed open-source home...
research · nebusec.ai
Route of Root: Bring a "DoS only" bug to LPE and bypass the existing patch to win $10,500 in kernelCTF
CVE-2023-2156 ("Route of Death") is a Linux kernel vulnerability that was believed to only lead to a DoS attack, and was considered patched in April 2023. However, NebuSec discovered a bypass of the patch and found that it is actually exploitable and can lead to LPE on any Linux distribution that has IPv6 and namespaces enabled. This writeup covers the technical details of the exploit.
research · starlabs.sg
When AI Makes 0-Days Feel Like N-Days
The author used AI to find a UAF bug in Linux net/sched and built an LPE exploit for CentOS 9 at TyphoonPwn 2026. AI sped things up, but deep subsystem knowledge still mattered.
Back