🔒 CVE-2024-1086 Exploit Project

🛡️ Polished educational Linux kernel exploit for security research

This project provides a robust, non-functional template for studying CVE-2024-1086, a use-after-free vulnerability in the Linux kernel's netfilter: nf_tables component, enabling local privilege escalation. Designed for security researchers and students, it combines a C exploit template with an enhanced Java wrapper for reliable diagnostics, configuration, and execution, intended for use in a controlled lab environment only (e.g., a VM with a vulnerable kernel).

⚠️ Warning: The C code is non-functional, using placeholder values, and requires significant modification to work. Unauthorized use on production systems or without permission is illegal and unethical. Use responsibly to advance kernel security knowledge.

• 🧠 Robust System Diagnostics: Comprehensive checks for kernel version, user namespaces, and nf_tables module
• 📜 Flexible Configuration: JSON-based settings for exploit parameters, log levels, and timeouts
• 📝 Enhanced Logging: Timestamped, verbose logs to file and console for detailed analysis
• 💻 Intuitive CLI: Supports --check, --run, --dry-run, --payload, and --config options
• 🔐 Safe Exploit Template: Non-functional C code for secure educational study of nf_tables exploits
• 🔗 Reliable Integration: Seamless Java-C interaction with timeout handling and error recovery
• 🧪 Test Suite: Includes Java and C tests for validation in lab environments
• 🛡️ Ethical Design: Strict lab-only restrictions and ethical guidelines

┌─────────────────────┐    ┌─────────────────────┐    ┌─────────────────────┐
│ 🔍 Java Diagnostics │───▶│ 💻 Exploit Runner   │───▶│ 🔐 C Exploit Template│
└─────────────────────┘    └─────────────────────┘    └─────────────────────┘
         │                           │                           │
         ▼                           ▼                           ▼
┌─────────────────────┐    ┌─────────────────────┐    ┌─────────────────────┐
│ 🔒 System Validation│───▶│ 📝 Logging Engine   │───▶│ 🛡️ Kernel Netlink   │
└─────────────────────┘    └─────────────────────┘    └─────────────────────┘
         │                           │
         ▼                           ▼
┌─────────────────────┐    ┌─────────────────────┐
│ 🧪 Test Suite       │    │ 📜 Config Management│
└─────────────────────┘    └─────────────────────┘

The project integrates a Java wrapper for secure diagnostics, logging, and configuration with a C exploit template simulating kernel interaction via Netlink sockets, supported by a test suite for validation.

Ensure you have the following tools installed:

• 🔧 GCC (version 9.0+, sudo apt install build-essential)
• ☕ Java Development Kit (JDK) (version 11+, sudo apt install openjdk-11-jdk)
• 🛠️ Make (for building C code)
• 📜 JSON Library: org.json:json:20230227 (via Maven or JAR)
• 📦 Apache Commons CLI: commons-cli:commons-cli:1.5.0 (via Maven or JAR)
• 🧪 JUnit (version 5.8+, for testing)
• 🌐 Git (for version control)

Operating System:

• Linux (e.g., Ubuntu 22.04) or Android with a vulnerable kernel (5.14 to 6.6, unpatched, < 5.15.148, 6.1.76, 6.6.15)
• Unprivileged user namespaces enabled (CONFIG_USER_NS=y)
• nf_tables module enabled (CONFIG_NF_TABLES=y)

Lab Environment:

• VirtualBox/VMware VM with Ubuntu 22.04 (kernel 5.15.x < 5.15.148)
• Android emulator with a vulnerable kernel

1. Clone the Repository

   git clone https://github.com/karim4353/CVE-2024-1086-Exploit.git
   cd CVE-2024-1086-Exploit

2. Install Dependencies

   sudo apt update
   sudo apt install build-essential openjdk-11-jdk
   # Download libraries or add to Maven
   wget https://repo1.maven.org/maven2/org/json/json/20230227/json-20230227.jar
   wget https://repo1.maven.org/maven2/commons-cli/commons-cli/1.5.0/commons-cli-1.5.0.jar

3. Build the C Exploit

   make

4. Run the Java Wrapper

   javac -cp ".:json-20230227.jar:commons-cli-1.5.0.jar" -d . src/main/java/com/example/cve20241086/ExploitRunner.java
   java -cp ".:json-20230227.jar:commons-cli-1.5.0.jar" com.example.cve20241086.ExploitRunner --run

   Options: --check, --run, --dry-run, --payload <path>, --config <file>, --help

5. Run Tests

   ./tests/run_tests.sh

For detailed setup, see Setup Guide.

CVE-2024-1086-Exploit/
├── src/
│   ├── main/
│   │   ├── c/
│   │   │   └── exploit.c           # 🔐 C exploit template
│   │   ├── java/
│   │   │   └── com/example/cve20241086/
│   │   │       └── ExploitRunner.java  # 🔍 Java wrapper
│   │   └── resources/
│   │       └── config.json         # 📜 Exploit configuration
│   └── test/
│       ├── c/
│       │   └── test_exploit.c     # 🧪 C test cases
│       └── java/
│           └── com/example/cve20241086/
│               └── ExploitRunnerTest.java  # 🧪 Java test cases
├── Makefile                        # 🛠️ Build script
├── README.md                       # 📝 This file
├── CONTRIBUTING.md                 # 🤝 Contribution guidelines
├── LICENSE                         # 📄 MIT license
└── tests/
    └── run_tests.sh                # 🧪 Test runner script

Test the project in a secure lab environment:

# Check system vulnerability
java -cp ".:json-20230227.jar:commons-cli-1.5.0.jar" com.example.cve20241086.ExploitRunner --check

# Run exploit (non-functional)
java -cp ".:json-20230227.jar:commons-cli-1.5.0.jar" com.example.cve20241086.ExploitRunner --run

# Run tests
./tests/run_tests.sh

# Clean build artifacts
make clean

We welcome contributions to enhance this educational project! See Contributing Guidelines for details on:

• Code style and standards
• Testing requirements
• Pull request process
• Ethical guidelines

• Architecture Overview - System design
• Setup Guide - Installation and configuration
• Contributing Guide - How to contribute
• FAQ - Common issues and solutions

• 🔍 Kernel Exploit Research: Study use-after-free vulnerabilities in nf_tables
• 🧑‍🎓 Security Education: Teach Linux kernel security and exploit development
• 🛡️ Penetration Testing Labs: Simulate privilege escalation in controlled environments
• 🔐 System Hardening: Test mitigations like KASLR, SELinux, and namespace restrictions

• 🔍 System Check Latency: <300ms for kernel and module checks
• 💻 Exploit Execution: <1s for non-functional template (real PoC ~3-5s)
• 📊 Memory Footprint: <10MB RAM for Java wrapper, <1MB for C exploit
• 📝 Log Output: <50ms write time to exploit_log.txt

Configure via src/main/resources/config.json:

{
  "exploitBinary": "./exploit",
  "targetKernel": "5.15",
  "payloadPath": "/tmp/payload.sh",
  "logLevel": "DEBUG",
  "timeoutSeconds": "30"
}

See Configuration Guide.

Common Issues:

• 🔧 Build Failures: Verify GCC/JDK versions; run make clean && make.
• ⚠️ Exploit Fails: Ensure sysctl -w kernel.unprivileged_userns_clone=1 and lsmod | grep nf_tables.
• ☕ Java Errors: Check json-20230227.jar and commons-cli-1.5.0.jar in classpath.
• 🔐 Permission Issues: Run as non-root with namespace access.

See FAQ or open an issue.

Licensed under the MIT License - see LICENSE.

• Notselwyn for the original CVE-2024-1086 PoC
• CrowdStrike and NSFOCUS for vulnerability analysis
• Linux Kernel Community for patch development
• Open-Source Security Community for educational resources

• 📚 Documentation: Project Wiki
• 🐞 Issues: GitHub Issues
• 💬 Discussions: GitHub Discussions

🛡️ Built with ❤️ for the security research community