Escaping the Google kCTF Container with a Data-Only Exploit

An article by h0mbre about exploiting a use-after-free on struct file in the io_uring subsystem.

The exploit uses a cross-cache attack to reclaim the freed struct file with a pipe buffer, fakes two different file structs to gain arbitrary address read and write, gets root privileges, and escapes the kernelCTF container.