UAF exploit: confirmed crash, accurate docs, fix stale-state race

Browse Source

Rewrote the exploit to correctly avoid GET requests between OOM
trigger and crash verification (RINIT zeros BG state on every
request). Filler field spray (100 x 8200B = 300 pages) reliably
reclaims the stale struct pages. Crash confirmed on first attempt.

Updated README and FINDINGS to accurately describe:
- The 8216-byte struct (3 pages), not the earlier 64-byte bin
- GC header overlap that blocks controlled RCE (offsets 0-23)
- Three independent patch layers in PHP 8.3.36/8.4.27/8.5.12
- Honest exploitation status: UAF crash confirmed, RCE not achieved

...

This commit is contained in:

neko

2026-10-22 03:48:05 +00:00

parent a5396a6ab0

commit fbaced0a77

3 changed files with 694 additions and 793 deletions

Show all changes Ignore whitespace when comparing lines Ignore changes in amount of whitespace Ignore changes in whitespace at EOL

Download Patch File Download Diff File Expand all files Collapse all files

uaf-rce/exploit.py

+395 -521

File diff suppressed because it is too large Load Diff