exploit doesn´t work with ipv6.disable=1
v12-security/pocs
On Fedora44, with kernel cmdline: `BOOT_IMAGE=(hd0,gpt2)/vmlinuz-7.0.4-200.fc44.x86_64 root=UUID=331c8af0-5541-424c-9ec8-bda9e22cdadb ro rhgb quiet ipv6.disable=1`
```
user@f44:~/workspace/pocs/fragnesia$ ./exp
[*] uid=1000 euid=1000 gid=1000 egid=1000
[*] mode=xfrm_espintcp_pagecache_replace collateral=after
[*] target=/usr/bin/su size=57184
outer_write_open_denied=1 errno=13 (Permission denied)
userns_setup: outer_uid=1000 outer_gid=1000 ns_uid=0 ns_gid=0
netns_setup=1
loopback_up=1
namespace_gate_failed: XFRM_MSG_NEWSA ack errno=93 (Protocol not supported)
```
View on GitHub ↗
SaaS Metrics