The user purchased a TP-Link EAP770 v1 access point in August 2023. The device runs on a Qualcomm IPQ9574 processor with Linux kernel 5.4.164 and firmware version 1.0.0 Build 20230605 Rel. 71641. The manufacturer discontinued support for this model, and no further firmware updates are available.
The device exhibited data corruption during high-load transfers from LAN to Wi-Fi. Analysis revealed that the Qualcomm SFE/PPE hardware offload subsystem was corrupting 64-byte blocks. Disabling this feature required root access, which the device's standard shell and GUI did not provide.
To gain root privileges, the user developed an exploit chain leveraging CVE-2022-0185, an integer underflow vulnerability in the legacy_parse_param function. The exploit uses pipe buffer manipulation to achieve arbitrary memory write capabilities, allowing the user to bypass system protections.
The exploit process involves isolating a process via unshare, heap grooming to align slab objects, and overwriting the modprobe_path variable. This allows the execution of a program with root privileges (uid 0), enabling the user to modify the sysfs settings and disable the faulty hardware offload.
