Abstract

The Linux kernel’s vsock subsystem contains CVE-2024-50264, a multi-task race condition in the vsock loopback path that can trigger a Use-After-Free by carefully orchestrating races among four or more tasks.

This talk first briefly reviews vsock’s internal behavior and the root cause of the bug (timing vulnerabilities and state-machine inconsistencies), then focuses on the advanced techniques we used to exploit it in practice. Concretely, we explain how we combined timerfd-based timing control, sequencing to induce state-machine confusion, SLUBStick-driven allocation/free pattern control, and Dirty PageTable techniques for manipulating memory state to build a reliable exploit chain.

Using this approach we submitted the exploit to Google kernelCTF and won a prize of $81,337, and the vulnerability later received the Pwnie Awards 2025 Best Privilege Escalation prize. Finally, we share interesting anecdotes and unexpected obstacles encountered during the exploit development so other researchers can benefit when analyzing and exploiting similarly complex race vulnerabilities.