Skip to content

Commit

Permalink
readme: fix grammar
Browse files Browse the repository at this point in the history
  • Loading branch information
nik012003 authored Sep 8, 2023
1 parent 569c2ee commit 2106c57
Showing 1 changed file with 6 additions and 6 deletions.
12 changes: 6 additions & 6 deletions README.md
Original file line number Diff line number Diff line change
Expand Up @@ -22,14 +22,14 @@ So, if user truncates the packet below the header size, this skb\_pull() will re

Try it executing [this](/panic6.c) c source code.

# Yeah but... I need root?
# Do we *really* need root...?

Using linux namespaces, in particular if you have `kernel.unprivileged_userns_clone=1` it's possible to create
with a non-root user a network namespace, and use the same kernel primitives that trigger the panic.
This allow you to use the vulnerability without having root.
Using linux namespaces, in particular user namespaces (enabled via `kernel.unprivileged_userns_clone=1`), a normal user is able
to create a network namespace, enabling them to use the same kernel primitives that trigger the panic.
This will allow you to use the vulnerability without having root.

This is not an uncommon possibility: for example [podman](https://podman.io/) uses this option to run his (rootless) containers,
and on some distro this option is enabled by default.
This scenario is not uncommon: for example [podman](https://podman.io/) uses this option to run its (rootless) containers,
and on some distros this option is enabled by default.

You can also try to execute the exploit without root privileges executing:

Expand Down

0 comments on commit 2106c57

Please sign in to comment.