sgkdev/ipv6_frag_escape

This repository is a proof of concept for escaping from a Linux container or jail, specifically targeting CentOS and RHEL 10 systems running kernel version 6.12.x. It demonstrates how an unprivileged process confined inside a network-isolated container can break out and obtain an interactive root shell on the host system. The exploit relies on a bug in the Linux kernel's IPv6 networking code that has already been fixed upstream, and it does not exploit an unpatched vulnerability. The bug involves a memory overflow in how the kernel assembles IPv6 network packets. The overflow writes into a specific byte that controls how packet fragments are tracked. By carefully manipulating kernel memory allocation, the exploit turns this overflow into a situation where a memory page is freed while the program still holds a reference to it. This creates a use-after-free condition, giving the attacker control over a piece of memory the kernel considers released. From there, the exploit chain builds up several layers of access. The freed memory page is reclaimed by the kernel as a page table, which maps virtual addresses to physical memory. Because the exploit still has a pipe reading and writing to that same page, it can forge page table entries, giving it the ability to read and write arbitrary physical memory. It then defeats kernel address space layout randomization by reading a fixed kernel memory location that is never relocated. This reveals where the kernel lives in memory. The final steps involve using this memory access to grant the running process full root privileges and all capabilities. It disables SELinux enforcement silently, so the system still reports it as active. To actually escape the container, the exploit overwrites a kernel setting that controls what program runs when a process crashes, points it at its own binary, and triggers a crash in a child process. The kernel then runs the attacker's program as root in the host's initial namespaces, bypassing the container entirely. The repository includes important limitations. It only works on systems where a specific kernel configuration option is left at its default off state, requires 5-level paging hardware support, and depends on a specific kernel debugging file being present. It is scoped to CentOS and RHEL 10 only.