PPhying中文
Curated security research, vulnerabilities, advisories and tools for practitioners.

Kernel-hack-drill and a new approach to exploiting CVE-2024-50264 in the Linux kernel

swarm.ptsecurity.com | vulnerability | High | CVE-2024-50264 | #privilege-escalation | #use-after-free | #linux-kernel | #exploit-development | #cve-2024-50264 | #kernel-hack-drill
📄 Raw .md⬇️ Download .md🔗 Original ↗

Summary

Alexander Popov presents kernel-hack-drill, the tooling that helped him exploit CVE-2024-50264, a race-condition use-after-free in the Linux kernel's AF_VSOCK (Pwnie 2025, Best Privilege Escalation).
CVE
CVE-2024-50264
CVSS
7.8
Published
Collected

Related coverage

High · vulnerability · nebusec.ai
IonStack part III: Rooting Android 17 with GhostLock
GhostLock (CVE-2026-43499) is a Linux kernel vulnerability found by Nebula Security that exists in every major distribution since 2011. After turning it into a stable privilege escalation and container escape, we took one step further and used GhostLock to develop the world's first public Android 17 root. This writeup covers the additional exploit techniques used to migrate the exploit for Android.
research · starlabs.sg
[CVE-2025-39964] How I Found a $113,337 AF_ALG Linux Local Privilege Escalation Before Copy Fail
A retrospective on CVE-2025-39964, an AF_ALG race condition causing out-of-bounds scatterlist access in the Linux kernel. Exploitation yields root and a Docker container escape.
research · starlabs.sg
When AI Makes 0-Days Feel Like N-Days
The author used AI to find a UAF bug in Linux net/sched and built an LPE exploit for CentOS 9 at TyphoonPwn 2026. AI sped things up, but deep subsystem knowledge still mattered.
vulnerability · theori.io
Deep Dive into RCU Race Condition: Analysis of TCP-AO UAF (CVE-2024–27394)
A deep dive into CVE-2024-27394, a TCP-AO use-after-free caused by incorrect RCU API usage in the Linux kernel, covering RCU internals, the patch, and the ExpRace technique for reliable triggering.
vulnerability · theori.io
Linux Kernel Exploit (CVE-2022–32250) with mqueue
Exploiting CVE-2022-32250, a Netfilter nftables use-after-free write, to root Ubuntu 22.04: heap and KASLR leaks with mqueue, a modprobe_path overwrite, plus root-cause analysis and patch.
High · vulnerability · github.com
CVE-2026-68398 PoC: Ubuntu PPPoL2TP kernel UAF local privilege escalation
The PoC turns a kernel UAF into local privilege escalation from an ordinary user to root, making it relevant for authorized Linux kernel research and patch validation. The race can panic or corrupt a system, so it should only run in an isolated, recoverable lab VM and affected kernels should be updated.
Back