Skip to content
attack.paths
Connexion
← RegistryDossier · 6 steps · 5 edges

io_uring UAF → modprobe_path overwrite → root

Use an io_uring UAF to land arbitrary kernel write, repoint /proc/sys/kernel/modprobe to an attacker binary, then trigger a kernel auto-modprobe — runs the binary as root.

Filed by AD Knowledge Base
§ Kill-chainDrag · zoom · scroll

§ Context

Assumed environment: foothold as a regular user on Linux. Kernel unpatched for an io_uring SQE UAF (multiple 2022-2024 CVEs). modprobe lookup not statically restricted.

§ Steps

  1. 01
    Attacker binary runs as rootInitial Access
    T1078— Valid Accounts
  2. 02
    User shellInitial Access
    T1078— Valid Accounts
  3. 03
    Run any binary type → kernel auto-loadsExecution
    T1059— Command and Scripting Interpreter
  4. 04
    Trigger io_uring UAFPrivilege Escalation
    LK-IO-URING-UAF— io_uring UAF / Privesc
  5. 05
    Kernel write primitivePrivilege Escalation
    LK-DIRTY-PAGETABLE— Dirty Pagetable
  6. 06
    Overwrite modprobe_pathPrivilege Escalation
    LK-MODPROBE-PATH— modprobe_path Overwrite

§ References

§ Frequently asked

What is the "io_uring UAF → modprobe_path overwrite → root" attack path?
Use an io_uring UAF to land arbitrary kernel write, repoint /proc/sys/kernel/modprobe to an attacker binary, then trigger a kernel auto-modprobe — runs the binary as root. It chains 6 steps drawn from real-world offensive-security techniques.
What starting position does this attack require?
The first step is Attacker binary runs as root (T1078) — a initial access primitive. Assumed environment: foothold as a regular user on Linux.
What is the final impact of this kill-chain?
The final step lands on Overwrite modprobe_path (LK-MODPROBE-PATH), which falls under Privilege Escalation. From here, an operator typically pivots into post-exploitation or maintains persistence.
How can defenders detect or prevent this attack?
Detection and prevention vary per step. Refer to each linked MITRE ATT&CK entry under "References" — every technique on that page lists defensive controls, detection telemetry, and known threat-actor usage.

§ Related dossiers