From 050731396d9d116a13e3cc0c19f4140cad449625 Mon Sep 17 00:00:00 2001 From: KaraZajac Date: Mon, 8 Jun 2026 13:53:29 -0400 Subject: [PATCH] docs: record partial VM verification of cifswitch (CVE-2026-46243) MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Verified 2026-06-08 on Ubuntu 24.04.4 / kernel 6.8.0-117-generic under QEMU/HVF (offline: cloud image + payload iso, no guest networking): - modprobe cifs registers the cifs.spnego key type (cifs-utils not needed to reach the primitive). - Independent python3 ctypes add_key('cifs.spnego', forged uid/creduid/upcall_target) ACCEPTED (user-key control also accepted); module exploit() independently reported 'primitive CONFIRMED' then the honest EXPLOIT_FAIL. - detect() returned PRECOND_FAIL without cifs-utils and VULNERABLE under SKELETONKEY_CIFS_ASSUME_PRESENT=1. Still pending (so cifswitch stays 🟡 and is NOT counted as a verified end-to-end CVE; verified count stays 28 of 37): a patched kernel (>=6.12.90/7.0.10) to prove add_key is REJECTED there (probe discriminates fixed-from-vulnerable), and the full namespace+NSS root-pop. Recorded in NOTICE.md, CVES.md, RELEASE_NOTES.md, and tools/verify-vm/targets.yaml. --- CVES.md | 2 +- docs/RELEASE_NOTES.md | 11 +++++++++-- modules/cifswitch_cve_2026_46243/NOTICE.md | 23 ++++++++++++++++++++++ tools/verify-vm/targets.yaml | 9 +++++---- 4 files changed, 38 insertions(+), 7 deletions(-) diff --git a/CVES.md b/CVES.md index 5dcc78c..09e7d40 100644 --- a/CVES.md +++ b/CVES.md @@ -95,7 +95,7 @@ root on a host can upstream their kernel's offsets via PR. | CVE-2026-41651 | Pack2TheRoot — PackageKit `InstallFiles` TOCTOU | LPE (userspace D-Bus daemon → `.deb` postinst as root) | PackageKit 1.3.5 (commit `76cfb675`, 2026-04-22) | `pack2theroot` | 🟡 | **Ported from the public Vozec PoC, not yet VM-verified.** Two back-to-back `InstallFiles` D-Bus calls — first `SIMULATE` (polkit bypass + queues a GLib idle), then immediately `NONE` + malicious `.deb` (overwrites the cached flags before the idle fires). GLib priority ordering makes the overwrite deterministic, not a race. Disclosure by **Deutsche Telekom security**. Affects PackageKit 1.0.2 → 1.3.4 — default-enabled on Ubuntu Desktop, Debian, Fedora, Rocky/RHEL via Cockpit. `detect()` reads `VersionMajor/Minor/Micro` over D-Bus → high-confidence verdict (vs. precondition-only for dirtydecrypt/fragnesia). Debian-family only (PoC's built-in `.deb` builder). Needs `libglib2.0-dev` at build time; Makefile autodetects via `pkg-config gio-2.0` and falls through to a stub when absent. | | CVE-2026-46333 | ptrace `__ptrace_may_access` dumpable-race → `pidfd_getfd` credential-fd theft | LPE (steal a root-opened fd / authenticated channel from a process dropping privileges) | mainline 2026-05-14 (Debian backports 5.10.251 / 6.1.172 / 6.12.88 / 7.0.7) | `ptrace_pidfd` | 🟡 | **Qualys TRU disclosure (2026-05-20), exploit not yet VM-verified.** The `__ptrace_may_access` logic flaw leaves a process *dropping* privileges briefly reachable past its `dumpable` boundary; `pidfd_getfd(2)` rides that window. detect() is version-pinned with a predates-gate at `pidfd_getfd`'s 5.6 introduction. exploit() spawns a setuid victim (chage / pkexec / ssh-keysign), `pidfd_open()`s it and sweeps `pidfd_getfd()` across its descriptor table during the credential-drop window, reporting any uid-0-owned fd captured from a non-root context — honest `EXPLOIT_FAIL` without a euid-0 witness; the target-specific full root-pop is not bundled until VM-verified. Arch-agnostic (descriptor theft, no shellcode). `--mitigate` sets `kernel.yama.ptrace_scope=2`; `--cleanup` reverts it. Credit: Qualys TRU. | | CVE-2025-32462 | sudo `-h`/`--host` policy bypass (Stratascale) | LPE (userspace; abuse a host-restricted sudoers rule for local root) | sudo 1.9.17p1 (2025-06-30) | `sudo_host` | 🟢 | **Stratascale CRU disclosure (Rich Mirch); sibling of `sudo_chwoot`.** sudo's `-h`/`--host` option — meant only to pair with `-l` — was honored when running a command, so a sudoers rule scoped to a host other than the current machine (and not ALL) is usable via `sudo -h `. Affects sudo 1.8.8 → 1.9.17p0; fixed 1.9.17p1. CWE-863, CVSS 8.8; not in KEV. detect() version-gates; exploit() finds an abusable host-restricted rule in readable sudoers (or `SKELETONKEY_SUDO_HOST`), witnesses with `sudo -n -h id -u`, and pops a root shell only on a uid-0 witness — never fabricates root. Structural (no offsets/race); arch-agnostic. Most relevant to fleet-wide / LDAP / SSSD sudoers. Credit: Rich Mirch / Stratascale. | -| CVE-2026-46243 | CIFSwitch — `cifs.spnego` key type trusts userspace-forged authority fields | LPE (coerce root `cifs.upcall` into loading an attacker NSS module) | fixed 5.10.257 / 6.1.174 / 6.12.90 / 7.0.10 (Debian backports of `3da1fdf4efbc`, mainline 7.1-rc5) | `cifswitch` | 🟡 | **Asim Manizada disclosure (2026-05-28), public PoC; exploit full-chain not yet VM-verified.** ~19-year-old logic flaw in `fs/smb/client/cifs_spnego.c`: the `cifs.spnego` key description carries authority-bearing fields (`pid`/`uid`/`creduid`/`upcall_target`) that root `cifs.upcall` trusts as kernel-originating, but userspace can create such keys via `add_key(2)`/`request_key(2)`. With user+mount namespace tricks, an unprivileged user makes `cifs.upcall` load a malicious NSS `.so` as root. CWE-20; not in KEV. Preconditions: `cifs` module + `cifs-utils` (`cifs.upcall`) + `cifs.spnego` request-key rule (override the probe via `SKELETONKEY_CIFS_ASSUME_PRESENT=1/0`). detect() version-gates and PRECOND_FAILs when the cifs userspace path is absent. exploit() fires only the non-destructive primitive — `add_key(2)` of a forged-but-benign `cifs.spnego` key (no upcall, loads nothing), revoked immediately — and returns honest `EXPLOIT_FAIL` without a euid-0 witness; the namespace+NSS root-pop is not bundled until VM-verified. Structural; arch-agnostic. `--mitigate` blocklists the `cifs` module; `--cleanup` reverts. Credit: Asim Manizada. | +| CVE-2026-46243 | CIFSwitch — `cifs.spnego` key type trusts userspace-forged authority fields | LPE (coerce root `cifs.upcall` into loading an attacker NSS module) | fixed 5.10.257 / 6.1.174 / 6.12.90 / 7.0.10 (Debian backports of `3da1fdf4efbc`, mainline 7.1-rc5) | `cifswitch` | 🟡 | **Asim Manizada disclosure (2026-05-28), public PoC; detect() + add_key primitive VM-verified on Ubuntu 24.04 / 6.8.0-117 (QEMU/HVF, 2026-06-08), full chain + patched-kernel discriminator pending.** ~19-year-old logic flaw in `fs/smb/client/cifs_spnego.c`: the `cifs.spnego` key description carries authority-bearing fields (`pid`/`uid`/`creduid`/`upcall_target`) that root `cifs.upcall` trusts as kernel-originating, but userspace can create such keys via `add_key(2)`/`request_key(2)`. With user+mount namespace tricks, an unprivileged user makes `cifs.upcall` load a malicious NSS `.so` as root. CWE-20; not in KEV. Preconditions: `cifs` module + `cifs-utils` (`cifs.upcall`) + `cifs.spnego` request-key rule (override the probe via `SKELETONKEY_CIFS_ASSUME_PRESENT=1/0`). detect() version-gates and PRECOND_FAILs when the cifs userspace path is absent. exploit() fires only the non-destructive primitive — `add_key(2)` of a forged-but-benign `cifs.spnego` key (no upcall, loads nothing), revoked immediately — and returns honest `EXPLOIT_FAIL` without a euid-0 witness; the namespace+NSS root-pop is not bundled until VM-verified. Structural; arch-agnostic. `--mitigate` blocklists the `cifs` module; `--cleanup` reverts. Credit: Asim Manizada. | ## Operations supported per module diff --git a/docs/RELEASE_NOTES.md b/docs/RELEASE_NOTES.md index 2f2e393..32ef8d9 100644 --- a/docs/RELEASE_NOTES.md +++ b/docs/RELEASE_NOTES.md @@ -30,8 +30,15 @@ module (`/etc/modprobe.d/skeletonkey-disable-cifs.conf`); `--cleanup` reverts. Structural, arch-agnostic (keyring + namespace logic, no shellcode). Ships auditd + sigma + falco rules, MITRE ATT&CK T1068 + CWE-20 metadata, six new `detect()` unit-test rows, and credits Asim -Manizada in `NOTICE.md`. Not yet VM-verified (sweep pending in -`tools/verify-vm/targets.yaml`), so the verified count stays 28 of 37. +Manizada in `NOTICE.md`. **Partially VM-verified** (2026-06-08, Ubuntu +24.04.4 / kernel 6.8.0-117, QEMU/HVF): `detect()`'s precondition + version +gating and the `add_key` primitive are confirmed — an independent +`python3` `ctypes` `add_key("cifs.spnego", …)` was accepted and the +module's `exploit()` reported "primitive CONFIRMED" then honest +`EXPLOIT_FAIL`. The full namespace+NSS root-pop and a patched-kernel +discriminator check remain pending, so cifswitch is **not** counted as a +verified end-to-end CVE — the verified count stays 28 of 37. Details in +the module `NOTICE.md` and `tools/verify-vm/targets.yaml`. ## SKELETONKEY v0.9.9 — install.sh needs no root; CVE-2022-0492 KEV drift diff --git a/modules/cifswitch_cve_2026_46243/NOTICE.md b/modules/cifswitch_cve_2026_46243/NOTICE.md index c60e115..c83be54 100644 --- a/modules/cifswitch_cve_2026_46243/NOTICE.md +++ b/modules/cifswitch_cve_2026_46243/NOTICE.md @@ -67,3 +67,26 @@ vulnerable VM, in keeping with the project's no-fabrication rule. (blocklists the `cifs` module — the vendor-recommended runtime mitigation); `--cleanup` removes it. Architecture-agnostic — keyring and namespace logic, no shellcode. + +## Verification status (partial) + +Verified **2026-06-08** on **Ubuntu 24.04.4 LTS, kernel 6.8.0-117-generic** +(QEMU/HVF, x86_64): + +- `modprobe cifs` registers the `cifs.spnego` key type (dmesg: + `Key type cifs.spnego registered`) — `cifs-utils` is **not** required to + reach the primitive. +- An **independent** `python3` `ctypes` probe calling + `add_key("cifs.spnego", )` was + **ACCEPTED** (a plain `user`-key control was also accepted), and the + module's own `exploit()` independently reported **primitive CONFIRMED** + then the honest `EXPLOIT_FAIL`. +- `detect()` returned `PRECOND_FAIL` with `cifs-utils` absent and + `VULNERABLE` under `SKELETONKEY_CIFS_ASSUME_PRESENT=1`. + +**Still pending** (so this stays 🟡 and is *not* counted as a verified +end-to-end CVE): (a) confirming `add_key` is **rejected** on a *patched* +kernel (≥ 6.12.90 / 7.0.10) — i.e. that the probe distinguishes +fixed-from-vulnerable rather than the key type always permitting userspace +creation; and (b) the full namespace + malicious-NSS root-pop, which +remains unbundled. diff --git a/tools/verify-vm/targets.yaml b/tools/verify-vm/targets.yaml index 1b8ca30..2528b1b 100644 --- a/tools/verify-vm/targets.yaml +++ b/tools/verify-vm/targets.yaml @@ -307,9 +307,10 @@ sudo_host: # ── cifswitch (CVE-2026-46243) addition ───────────────────────────── cifswitch: - box: ubuntu2204 + box: ubuntu2404 kernel_pkg: "" - mainline_version: "6.12.89" # one below the 6.12.90 backport; ~19yo bug present - kernel_version: "6.12.89" + kernel_version: "6.8.0-117-generic" expect_detect: VULNERABLE - notes: "CVE-2026-46243 'CIFSwitch'; cifs.spnego key type trusts userspace-forged authority fields (Asim Manizada, 2026-05-28). Fixed 5.10.257 / 6.1.174 / 6.12.90 / 7.0.10 (Debian backports of commit 3da1fdf4efbc, mainline 7.1-rc5); a ~19-year-old bug below those. Mainline 6.12.89 is one below the 6.12.90 backport so the version gate flags VULNERABLE — but detect() ALSO requires the cifs userspace path: provision cifs-utils (so /usr/sbin/cifs.upcall + the cifs.spnego request-key rule exist) and `modprobe cifs`, else detect() returns PRECOND_FAIL (or force with SKELETONKEY_CIFS_ASSUME_PRESENT=1). exploit() fires the non-destructive add_key(2) cifs.spnego probe and reports the forged-key accept as the primitive witness; the namespace+NSS root-pop is not bundled until VM-verified. Brand-new addition this cycle; provisioner (cifs-utils install) + sweep pending." + verified: partial # detect() + add_key primitive confirmed; full root-pop + patched-kernel discriminator pending + verified_on: "2026-06-08 — Ubuntu 24.04.4 LTS, kernel 6.8.0-117-generic, QEMU/HVF (x86_64)" + notes: "CVE-2026-46243 'CIFSwitch'; cifs.spnego key type trusts userspace-forged authority fields (Asim Manizada, 2026-05-28). Fixed 5.10.257 / 6.1.174 / 6.12.90 / 7.0.10 (Debian backports of commit 3da1fdf4efbc, mainline 7.1-rc5); a ~19-year-old bug below those. PARTIALLY VM-VERIFIED 2026-06-08 on Ubuntu 24.04.4 / 6.8.0-117 (QEMU/HVF): (1) `modprobe cifs` registers the cifs.spnego key type (dmesg 'Key type cifs.spnego registered') — cifs-utils not required to reach the primitive; (2) an INDEPENDENT python ctypes add_key('cifs.spnego', forged uid/creduid/upcall_target) was ACCEPTED (serial 374940108; a `user`-key control also accepted), and the module's own exploit() reported 'primitive CONFIRMED' (serial 294765294) then honest EXPLOIT_FAIL; (3) detect() correctly returned PRECOND_FAIL with cifs-utils absent, and VULNERABLE under SKELETONKEY_CIFS_ASSUME_PRESENT=1. STILL PENDING: (a) a PATCHED kernel (>=6.12.90 / 7.0.10) to prove add_key is REJECTED there (i.e. that the probe discriminates fixed-from-vulnerable, not merely that the key type always allows userspace creation), and (b) the full user+mount-namespace + malicious-NSS root-pop, which is not bundled. Reproduce via tools/verify-vm or the QEMU offline harness used on 2026-06-08 (cloud image + payload iso, no guest networking needed)."