Claude Wrote a Full FreeBSD Remote Kernel RCE with Root Shell (CVE-2026-4747)

This write-up details a chilling achievement: an AI, specifically Claude, successfully developed a complete remote kernel exploit for FreeBSD. The target was CVE-2026-4747, a stack buffer overflow in the kgssapi.ko module, which could lead to arbitrary code execution.

• The Vulnerability: A 128-byte stack buffer (rpchdr[]) in svc_rpc_gss_validate() lacked bounds checking during a memcpy operation, allowing an oversized Kerberos credential body to overwrite crucial stack elements, including the return address. The vulnerability affects NFS servers with kgssapi.ko loaded, requiring a valid (even unprivileged) Kerberos ticket for the nfs/host@REALM principal.
• Exploitation Strategy: Claude devised a sophisticated multi-round ROP (Return-Oriented Programming) chain to overcome the 400-byte credential limit and deliver its 432-byte shellcode.
  • Round 1: Modified kernel memory permissions using pmap_change_prot() to make a section of BSS (Block Started by Symbol) executable (RWX).
  • Rounds 2-14: Steadily wrote chunks of the shellcode (32 bytes per round) into the newly executable BSS region using mov [rdi], rax gadgets.
  • Round 15: Wrote the final shellcode bytes and redirected execution to the shellcode's entry point within BSS.
• The Shellcode: Operating in kernel mode (CPL 0), the shellcode followed a two-phase approach:
  • An entry function pivoted the stack, cleared debug registers (DR7) to prevent child process crashes, and used kproc_create() to spawn a new kernel process.
  • A worker function within the new process zeroed an image_args struct, allocated argument buffers, set the executable path to /bin/sh, added the -c argument, and included a complex reverse shell command. It then called kern_execve() to transform the process into a root shell, clearing the P_KPROC flag to ensure a proper userland transition.
• Overcoming Challenges: The development process tackled several intricate issues: accurately mapping register offsets (shifted by GSS headers), resolving MIT vs. Heimdal GSS token incompatibilities (requiring specific krb5.conf settings), mitigating hardware debug register inheritance, and reliably delivering shellcode across the size constraints. The exploit also necessitated a target VM with at least two CPUs to ensure sufficient NFS worker threads (16 total) could survive the 15 rounds of thread-killing RCE.
• Result: The exploit successfully established an interactive uid 0 (root) reverse shell in approximately 45 seconds.

This work highlights the rapidly evolving capabilities of large language models, pushing the boundaries of automated offensive security and prompting a reevaluation of what "human-level" exploit development truly entails.