title: How does towelroot (futex exploit) works
body: <p>There is a security issue in linux kernel, which affects most of android devices and basically allows any user to become root.</p>
  
  <p>Since I am linux user for quite some time, I am very curious how this exploit works, especially how can I check whether my kernel in my PC (custom built) or on any of my servers, is vulnerable to this or not. Is there any source code (preferably documented) or details of the exploit so that I could see how it works? I could only find the generic information or closed source binaries that do exploit the bug and give you root if executed by any user, but no background information or details of which part of kernel has the flaw and how is it even possible to do this.</p>
  
  <p>So far I found this interesting article <a href="http://tinyhack.com/2014/07/07/exploiting-the-futex-bug-and-uncovering-towelroot/">http://tinyhack.com/2014/07/07/exploiting-the-futex-bug-and-uncovering-towelroot/</a> which explains that it uses stack hack, by calling certain syscalls in order to get something into a stack of <code>futex_queue</code>. While I understand how that works, I have no idea how changing anything in that stack can actually elevate privileges of current process. What I found interesting is, that this guy say that since kernel 3.13 something has changed and now different technique is needed to exploit this. Does it mean that this was <strong>not even fixed and is still exploitable in recent kernel</strong> that can be downloaded from kernel.org?</p>