$ cat writeup.md…
$ cat writeup.md…
compfest2026
Task: aarch64 kernel module menfess ioctl; CREATE with size=72 overflows send_func -> arbitrary kernel call with controlled x0. Solution: _printk via the module PLT is a format-string oracle leaking the KASLR base; a fake cred in two adjacent kmalloc-96 chunks passed to commit_creds gives uid 0.
Permission denied (requires tier.pro)
Sign in with GitHub, Discord, or Google to continue. No email required.
$sign in$ grep --similar