Reversing the module isn't the simplest of the tasks, but after reading through it we can notice it registers a new protocol family (family 15), which accepts 2 proto operations (ioctl and setsockopt)
Ioctl calls a function that implements 2 command (0x1337001 and 0x13371002).
s is a 0x100 bytes long buffer and n is an user controlled int64 used as the size on the call to copy_from_user. That would have been it if not for two reasons: kaslr and stack guard.
Controlling dev_info
There is a global variable called dev_info that can be controlled via the setsockopt implementation but it gets XORed against another variable called magic_key that is initialized with get_random_bytes() when the module is loaded.
The dev_info structure is composed by an int64 that is again used as the size for copy_from_user and the user controlled data that will be XORed and stored. This data is later used on the ioctl operation on a memcmp that returns the user provided size n case the comparison is true, so we can abuse this to brute the bytes of dev_info.
The whole point of getting those bytes is because there is a buffer overread on that comparison, so if we can force the first 0x100 bytes of s and dev_info to be identical we can keep bruting everything after them, which will be the stack canary and eventually the return address but for this to work we need another buffer overflow, this time in dev_info, so we can stored the bytes we want to compare.
Race condition
We can't normally control the size of dev_info but there is this function that can be called by the ioctl operation:
This temporarily sets the dev_info size field to an user provided unsigned int64. If we create a thread that will call this function and at the same time we write to dev_info, that way we can write more than 0x100 bytes. Since the printk call is pretty slow compared to the rest of the code, we can build a pretty stable race condition.
If we combine this race condition with the memcmp bruteforce we can obtain the stack canary and the return address. SMEP and SMAP are also on so we'll need to ROP also.
