$ cat writeup.md…
$ cat writeup.md…
d3c2026
Task: Linux 7.1.4 kernel pwn with an isolated SLAB_NO_MERGE cache exposing a deterministic same-object double-free (ref_count starts at 2) and no read/write primitive. Solution: cross-cache the freed slab into a cred spray, let INIT_ON_ALLOC zero the reclaimed cred (fsuid=0), then fchmodat2 the flag world-readable.
Permission denied (requires tier.pro)
Sign in with GitHub, Discord, or Google to continue. No email required.
$sign in$ grep --similar