Shallow analysis on the vulnerability of Cve-2016-8655,af_packet Linux internal kernel-killing rights

A simple way of thinking this stuff needs namespace support,
First open socket, a serial path (packet_set_ring ()->INIT_PRB_BDQC ()
Prb_setup_retire_blk_timer ()->prb_init_blk_timer ()
Prb_init_blk_timer ()->init_timer ()) generates a Timer object, hog the socket close.
Before controlling po->tp_version make it go other path hog first free timer object.
At this time, use the Add_key heap Sprey to overwrite the free time object.
Internal nuclear attack The old machine knows that the cover-up time object has been put in place we are ready in advance
Time object whose internal function pointer has been hijacked by us.
Hijacked function in time object from user mode.
You can get root from the user mode call hijacked function at this time.

Summary:
0x0. Race condition-UAF. In this awesome time, it's not new.
The use of 0x1 Vsyscall (similar to VDSO), and Set_memory_rx ().
0X2. Use Add_key () to do the heap spraying. In the past, Cohen (Keen Team) used sendmmsg to heap spraying.
0X3 can build Af_packet sockets with Gid=3004/aid_net_raw on Android.
(MediaServer) and can trigger the bug.

REF:
http://seclists.org/oss-sec/2016/q4/607

The writing of the warehouse to welcome the discussion.

Shallow analysis on the vulnerability of Cve-2016-8655,af_packet Linux internal kernel-killing rights