Post #2707387
2026-05-07 23:17 UTC
@dalias@hachyderm.io it looks like AF_NETLINK is in the critical path of the exploit poc at least? see add_xfrm_sa, it it responsible for actually writing the shellcode and does so via a netlink socket
Replies (1)
-
@dalias@hachyderm.io 2026-05-07 23:36
@hailey@hails.org The exploit I'm looking at, https://github.com/0xdeadbeefnetwork/Copy_Fail2-Electric_Boogaloo, does not even mention AF_NETLINK. I suspect AF_NETLINK gets used by the iproute2 utilities (which they shell out to) for setting up the network namespace to do the exploit, but netlink being the mechanism is hardly relevant.