leviathan/SKELETONKEY
1
1
Fork 0
Code Issues Pull Requests Actions 31 Packages Projects Releases Wiki Activity

docs: record partial VM verification of cifswitch (CVE-2026-46243)

Browse Source 
Verified 2026-06-08 on Ubuntu 24.04.4 / kernel 6.8.0-117-generic under
QEMU/HVF (offline: cloud image + payload iso, no guest networking):

- modprobe cifs registers the cifs.spnego key type (cifs-utils not needed
  to reach the primitive).
- Independent python3 ctypes add_key('cifs.spnego', forged
  uid/creduid/upcall_target) ACCEPTED (user-key control also accepted);
  module exploit() independently reported 'primitive CONFIRMED' then the
  honest EXPLOIT_FAIL.
- detect() returned PRECOND_FAIL without cifs-utils and VULNERABLE under
  SKELETONKEY_CIFS_ASSUME_PRESENT=1.

Still pending (so cifswitch stays 🟡 and is NOT counted as a verified
end-to-end CVE; verified count stays 28 of 37): a patched kernel
(>=6.12.90/7.0.10) to prove add_key is REJECTED there (probe discriminates
fixed-from-vulnerable), and the full namespace+NSS root-pop. Recorded in
NOTICE.md, CVES.md, RELEASE_NOTES.md, and tools/verify-vm/targets.yaml.
This commit is contained in:
KaraZajac
2026-06-08 13:53:29 -04:00
parent ada56b0db3
commit 050731396d
4 changed files with 38 additions and 7 deletions
Download Patch File Download Diff File Expand all files Collapse all files
docs/RELEASE_NOTES.md
+9 -2
View File
@@ -30,8 +30,15 @@ module (`/etc/modprobe.d/skeletonkey-disable-cifs.conf`); `--cleanup`
reverts. Structural, arch-agnostic (keyring + namespace logic, no
shellcode). Ships auditd + sigma + falco rules, MITRE ATT&CK T1068 +
CWE-20 metadata, six new `detect()` unit-test rows, and credits Asim
Manizada in `NOTICE.md`. Not yet VM-verified (sweep pending in
`tools/verify-vm/targets.yaml`), so the verified count stays 28 of 37.
Manizada in `NOTICE.md`. **Partially VM-verified** (2026-06-08, Ubuntu
24.04.4 / kernel 6.8.0-117, QEMU/HVF): `detect()`'s precondition + version
gating and the `add_key` primitive are confirmed — an independent
`python3` `ctypes` `add_key("cifs.spnego", …)` was accepted and the
module's `exploit()` reported "primitive CONFIRMED" then honest
`EXPLOIT_FAIL`. The full namespace+NSS root-pop and a patched-kernel
discriminator check remain pending, so cifswitch is **not** counted as a
verified end-to-end CVE — the verified count stays 28 of 37. Details in
the module `NOTICE.md` and `tools/verify-vm/targets.yaml`.
## SKELETONKEY v0.9.9 — install.sh needs no root; CVE-2022-0492 KEV drift