Neura Market
Notselwyn/CVE-2024-1086 logo

Notselwyn/CVE-2024-1086

Free

Universal local privilege escalation Proof-of-Concept exploit for CVE-2024-1086, working on most Linux kernels between v5.14 and v6.6, including Debian, Ubuntu, and KernelCTF. The success rate is 99.4% in KernelCTF images.

FreeFree tier
Type
Open Source
Visit Website GitHub (38 stars)

About Notselwyn/CVE-2024-1086

Universal local privilege escalation Proof-of-Concept exploit for CVE-2024-1086, targeting a use-after-free vulnerability in the Linux kernel's netfilter subsystem (nf_tables). It works on most Linux kernels from v5.14 to v6.6, including Debian, Ubuntu, and KernelCTF, with a 99.4% success rate in KernelCTF images. The exploit is configurable via src/config.h, supports fileless execution using curl and Perl for pentesting scenarios, and includes a full write-up with diagrams. Caveats include requirements for user namespaces and nf_tables, deliberate kernel panic after execution to deter malicious use, and instability with network activity or WiFi. Only tested on x64/amd64.

Key Features

Universal local privilege escalation for Linux kernels v5.14 to v6.6
99.4% success rate in KernelCTF images
Fileless execution support via curl and Perl for pentesting
Configurable exploit parameters (physical memory, log redirect, etc.)
Deliberate kernel panic after execution to prevent malicious use
Includes full write-up with background information and diagrams

Pros & Cons

Pros
  • High success rate across a wide range of kernel versions
  • Well-documented with a detailed write-up and diagrams
  • Supports fileless execution for stealthy penetration testing
  • Configurable for different environments (memory, network activity)
  • Open-source and actively maintained
Cons
  • Causes kernel panic after exploit execution (deliberate side-effect)
  • Unstable with high network activity or WiFi surroundings
  • Only tested on x64/amd64 architecture
  • Requires specific kernel configurations (user namespaces, nf_tables)
  • Not suitable for production or sensitive systems

Best For

Security research and kernel vulnerability analysisPenetration testing and privilege escalation demonstrationEducational proof-of-concept for CVE-2024-1086Testing kernel hardening configurations

FAQ

Which Linux kernel versions are affected?
The exploit works on kernels from v5.14 to v6.6, excluding patched stable branches v5.15.149, v6.1.76, v6.6.15. The underlying vulnerability affects v3.15 to v6.8-rc1.
Why does the exploit cause a kernel panic?
The kernel panic is a deliberate side-effect to prevent malicious usage, making exploitation attempts more noticeable and impractical for real-world operations. The root shell remains functional for lab environments.
Can this exploit be used remotely?
The exploit requires a local shell and user namespaces. It can be run over SSH or via reverse shell, but network activity may cause instability. Fileless execution is supported for pentesting using curl and Perl.
What are the system requirements?
Requires Linux kernel between v5.14 and v6.6, x64/amd64 architecture, user namespaces enabled (kernel.unprivileged_userns_clone=1), nf_tables enabled (CONFIG_NF_TABLES=y). Not recommended on systems with heavy network activity or WiFi.