Snyk Fetch the Flag CTF 2023 writeup: Off the SETUID

This write-up for the "Off the SETUID" CTF challenge explains a kernel-level logic bug in a custom fun_setuid syscall that can commit a NULL/controlled credentials pointer, enabling local privilege escalation. The author details mapping address 0 (mmap_min_addr=0), placing a fake struct cred for root, invoking the syscall to adopt those credentials, and delivering the exploit from a PHP web process using a fileless memexec technique.