I have a vulnerable Linux Kernel module (32-bit), which I can successfully exploit, and have gained privileges out of it. Basically, my exploit uses an ROP chain to disable SMEP, and directly jumps to my shellcode mapped at userland. My shellcode at userland makes a call to
commit_creds(prepare_kernel_creds(0)); and tries to return back to my userland code.
Now I don't understand how to return to user mode from kernel mode. Several articles point out that I should use
iret assembly instruction to return to user-mode. I plainly inserted an
iret after the shellcode, but it doesn't seem to work.
I write to a device file, and from the call trace:
? vfs_write ? SyS_write ? do_fast_syscall_32 ? entry_SYSENTER_32
I note that this is a fast system call, and it must return through the
Now, how do I return back to userland without panicking the kernel? I need to know which call I need to perform(
sysexit ) and how to perform it cleanly.
(I have looked over the Intel manuals and a bunch of other resources, but nothing has helped me much until now.)