[CVE-2022-1786] A Journey To The Dawn

A thrilling article by kylebot about exploiting a race condition that leads to a double-free in the io_uring subsystem and winning a kCTF bounty.

The exploit uses novel techniques: overwriting binfmt structures instead of modprobe_path and using fork and msleep to safely return to userspace after executing a ROP chain.