$ cat writeup.md…
$ cat writeup.md…
hackviser
Task: Linux kernel LPE via CVE-2026-46331 — act_pedit partial copy-on-write bug in net/sched allows page cache corruption. Solution: exploit pedit COW to overwrite /bin/su ELF entry point in page cache with setuid shellcode, then exec su for root shell.
$ cat /etc/rate-limit
Rate limit reached (20 reads/hour per IP). Showing preview only — full content returns at the next hour roll-over.
This laboratory demonstrates pedit COW (CVE-2026-46331), a Linux kernel local privilege escalation vulnerability in the traffic-control subsystem. The flaw exists in the act_pedit packet-editing action, where the kernel may calculate the copy-on-write writable range incorrectly before all runtime packet offsets are fully known. Under the right local conditions, this can allow writes into shared page cache memory.
Using the low-privilege credentials (guest/guest), connect to the machine over SSH and escalate to root. Read /root/secret.txt.
Target: 172.20.45.103
English summary: Given SSH access as an unprivileged user (guest/guest) to a Debian 11 box running a vulnerable kernel (6.1.174). The goal is to exploit CVE-2026-46331 in the kernel's act_pedit traffic control module to escalate privileges to root and read /root/secret.txt.
act_pedit, cls_matchall, cls_basic, sch_ingress — the entire tc (traffic control) stack is presentunprivileged_userns_clone = 1 — unprivileged users can create user namespaces/bin/su is setuid-root (-rwsr-xr-x 1 root root 71912)The vulnerability resides in net/sched/act_pedit.c — the packet-editing tc action. When a pedit action has multiple keys with different header types (e.g., NETWORK + TCP), the kernel calculates the copy-on-write (COW) writable range based on the first key's offset before all runtime packet offsets are resolved.
The critical sequence:
...
$ grep --similar