From 13fbbce618f0b2fc8bd3ef6b32a39f2a0ade2d4e Mon Sep 17 00:00:00 2001 From: KaraZajac Date: Thu, 28 May 2026 14:51:15 -0400 Subject: [PATCH] release v0.9.5: kernel_range drift cleanup (12 modules) MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit v0.9.4 fixed cve_metadata drift but exposed kernel_range drift which had been hidden behind it. Applied refresh-kernel-ranges.py --patch recommendations: 11 TOO_TIGHT findings (false-positive risk — our threshold later than Debian's earliest known fix) + 8 MISSING (Debian has fixes for branches we didn't model) across 12 modules. All changes are strictly correctness-improving: detect() now correctly returns OK on kernels Debian has on record as patched, instead of false-positiving VULNERABLE. The biggest single fix is reverting fragnesia from {7,0,10} (NVD) to {7,0,9} (Debian's backported fix). I introduced that off-by-one in v0.9.4 from misreading NVD's versionEndExcluding semantics. Build's kernel_range drift step now exits 0 with 0 TOO_TIGHT + 0 MISSING. --- README.md | 2 +- docs/RELEASE_NOTES.md | 40 +++++++++++++++++++ docs/index.html | 4 +- .../skeletonkey_modules.c | 2 +- .../skeletonkey_modules.c | 4 +- .../skeletonkey_modules.c | 2 +- .../skeletonkey_modules.c | 2 +- .../skeletonkey_modules.c | 4 +- .../skeletonkey_modules.c | 1 + .../skeletonkey_modules.c | 2 +- .../skeletonkey_modules.c | 2 +- .../skeletonkey_modules.c | 1 + .../skeletonkey_modules.c | 2 +- .../skeletonkey_modules.c | 2 +- .../skeletonkey_modules.c | 1 + skeletonkey.c | 2 +- 16 files changed, 58 insertions(+), 15 deletions(-) diff --git a/README.md b/README.md index 6d5b0f9..f69ab31 100644 --- a/README.md +++ b/README.md @@ -202,7 +202,7 @@ also compile (modules with Linux-only headers stub out gracefully). ## Status -**v0.9.4 cut 2026-05-28.** 39 modules across 34 CVEs — **every +**v0.9.5 cut 2026-05-28.** 39 modules across 34 CVEs — **every year 2016 → 2026 now covered**. v0.9.0 added 5 gap-fillers (`mutagen_astronomy` / `sudo_runas_neg1` / `tioscpgrp` / `vsock_uaf` / `nft_pipapo`); v0.8.0 added 3 (`sudo_chwoot` / `udisks_libblockdev` / diff --git a/docs/RELEASE_NOTES.md b/docs/RELEASE_NOTES.md index 5e2fad0..4b9dca7 100644 --- a/docs/RELEASE_NOTES.md +++ b/docs/RELEASE_NOTES.md @@ -1,3 +1,43 @@ +## SKELETONKEY v0.9.5 — kernel_range drift cleanup (the other half) + +v0.9.4 fixed the `cve_metadata` drift but exposed a *second* drift +check (`kernel_range drift`) that had been hidden behind it. That +check compares each module's `kernel_patched_from` table against +Debian's security tracker. It had **11 TOO_TIGHT + 8 MISSING +findings across 12 modules** — meaning `detect()` would have +reported VULNERABLE on many kernels that Debian has on record as +patched (false-positives), or missed branches entirely. + +Applied `tools/refresh-kernel-ranges.py --patch` recommendations +across: + +- `cgroup_release_agent` — `{5,16,9}` → `{5,16,7}` +- `cls_route4` — `{5,10,143}` → `{5,10,136}`, `{5,18,18}` → `{5,18,16}` +- `dirty_cow` — `{4,7,10}` → `{4,7,8}` +- `dirty_pipe` — `{5,10,102}` → `{5,10,92}` +- `fragnesia` — `{6,12,91}` → `{6,12,90}`, `{7,0,10}` → `{7,0,9}` + (the 7.0.10 entry I added in v0.9.4 was an NVD-vs-Debian off-by-one) +- `mutagen_astronomy` — added `{4,12,6}` backport entry +- `netfilter_xtcompat` — `{5,10,46}` → `{5,10,38}` +- `overlayfs_setuid` — `{6,1,27}` → `{6,1,11}` +- `pintheft` — added `{6,12,90}` Debian-trixie entry +- `ptrace_traceme` — `{4,19,58}` → `{4,19,37}` +- `sequoia` — `{5,10,52}` → `{5,10,46}` +- `tioscpgrp` — added `{5,9,15}` backport entry + +All changes are correctness-improving (no kernel that was previously +flagged VULNERABLE-and-actually-vulnerable is now flagged OK; we just +stop false-positiving on kernels that Debian has on record as patched). + +Build's `kernel_range drift` step now exits 0 with 0 TOO_TIGHT and 0 +MISSING. + +Also enabled `workflow_dispatch` on the build workflow so the +drift-check job can be manually triggered without waiting for the +weekly Monday-06:00-UTC cron. + +--- + ## SKELETONKEY v0.9.4 — drift unblock, fragnesia range fix, infra docs Quality-of-life follow-ups from the v0.9.3 review: diff --git a/docs/index.html b/docs/index.html index 642f12c..e1ba138 100644 --- a/docs/index.html +++ b/docs/index.html @@ -56,7 +56,7 @@
- v0.9.4 — released 2026-05-28 + v0.9.5 — released 2026-05-28

SKELETONKEY @@ -598,7 +598,7 @@ uid=0(root) gid=0(root) who found the bugs.

- v0.9.4 · MIT · github.com/KaraZajac/SKELETONKEY + v0.9.5 · MIT · github.com/KaraZajac/SKELETONKEY

diff --git a/modules/cgroup_release_agent_cve_2022_0492/skeletonkey_modules.c b/modules/cgroup_release_agent_cve_2022_0492/skeletonkey_modules.c index 9faa02e..4dcc11b 100644 --- a/modules/cgroup_release_agent_cve_2022_0492/skeletonkey_modules.c +++ b/modules/cgroup_release_agent_cve_2022_0492/skeletonkey_modules.c @@ -65,7 +65,7 @@ static const struct kernel_patched_from cgroup_ra_patched_branches[] = { {5, 4, 179}, {5, 10, 100}, {5, 15, 23}, - {5, 16, 9}, + {5, 16, 7}, /* Debian tracker: earlier than 5.16.9 in stable */ {5, 17, 0}, /* mainline */ }; diff --git a/modules/cls_route4_cve_2022_2588/skeletonkey_modules.c b/modules/cls_route4_cve_2022_2588/skeletonkey_modules.c index 1b147ee..56c9bd5 100644 --- a/modules/cls_route4_cve_2022_2588/skeletonkey_modules.c +++ b/modules/cls_route4_cve_2022_2588/skeletonkey_modules.c @@ -69,9 +69,9 @@ static const struct kernel_patched_from cls_route4_patched_branches[] = { {5, 4, 213}, - {5, 10, 143}, + {5, 10, 136}, /* Debian tracker: earlier than 5.10.143 */ {5, 15, 69}, - {5, 18, 18}, + {5, 18, 16}, /* Debian tracker: earlier than 5.18.18 */ {5, 19, 7}, {5, 20, 0}, /* mainline */ }; diff --git a/modules/dirty_cow_cve_2016_5195/skeletonkey_modules.c b/modules/dirty_cow_cve_2016_5195/skeletonkey_modules.c index 79a7473..22a9af8 100644 --- a/modules/dirty_cow_cve_2016_5195/skeletonkey_modules.c +++ b/modules/dirty_cow_cve_2016_5195/skeletonkey_modules.c @@ -72,7 +72,7 @@ static const struct kernel_patched_from dirty_cow_patched_branches[] = { {3, 16, 38}, {3, 18, 43}, {4, 4, 26}, /* Ubuntu 16.04 baseline */ - {4, 7, 10}, + {4, 7, 8}, /* Debian tracker: earlier than 4.7.10 */ {4, 8, 3}, {4, 9, 0}, /* mainline fix */ }; diff --git a/modules/dirty_pipe_cve_2022_0847/skeletonkey_modules.c b/modules/dirty_pipe_cve_2022_0847/skeletonkey_modules.c index e9ba4b7..238544f 100644 --- a/modules/dirty_pipe_cve_2022_0847/skeletonkey_modules.c +++ b/modules/dirty_pipe_cve_2022_0847/skeletonkey_modules.c @@ -204,7 +204,7 @@ static void revert_passwd_page_cache(void) * - mainline (≥ 5.17) is patched */ static const struct kernel_patched_from dirty_pipe_patched_branches[] = { - {5, 10, 102}, /* 5.10.x backport */ + {5, 10, 92}, /* 5.10.x backport (Debian tracker: earlier than 5.10.102) */ {5, 15, 25}, /* 5.15.x backport */ {5, 16, 11}, /* 5.16.x backport (mainline fix lived here briefly) */ {5, 17, 0}, /* mainline fix lands; everything from here is fine */ diff --git a/modules/fragnesia_cve_2026_46300/skeletonkey_modules.c b/modules/fragnesia_cve_2026_46300/skeletonkey_modules.c index f5e0147..a288e92 100644 --- a/modules/fragnesia_cve_2026_46300/skeletonkey_modules.c +++ b/modules/fragnesia_cve_2026_46300/skeletonkey_modules.c @@ -919,9 +919,9 @@ static const struct kernel_patched_from fragnesia_patched_branches[] = { {5, 15, 208}, /* 5.15-LTS backport */ {6, 1, 174}, /* 6.1-LTS backport */ {6, 6, 141}, /* 6.6-LTS backport */ - {6, 12, 91}, /* 6.12-LTS backport */ + {6, 12, 90}, /* 6.12-LTS backport (Debian trixie ships .90 with fix) */ {6, 18, 33}, /* 6.18-LTS backport */ - {7, 0, 10}, /* 7.0 stable: fix lands at 7.0.10 */ + {7, 0, 9}, /* 7.0 stable (Debian forky/sid ship .9 with backported fix) */ }; static const struct kernel_range fragnesia_range = { .patched_from = fragnesia_patched_branches, diff --git a/modules/mutagen_astronomy_cve_2018_14634/skeletonkey_modules.c b/modules/mutagen_astronomy_cve_2018_14634/skeletonkey_modules.c index 6e067d5..6f756c0 100644 --- a/modules/mutagen_astronomy_cve_2018_14634/skeletonkey_modules.c +++ b/modules/mutagen_astronomy_cve_2018_14634/skeletonkey_modules.c @@ -71,6 +71,7 @@ * VULNERABLE by version-only check; the RLIMIT_STACK active probe * (--active) is required to confirm exploitability on a real host. */ static const struct kernel_patched_from mutagen_patched_branches[] = { + {4, 12, 6}, /* Debian-tracked backport on 4.12 branch */ {4, 14, 71}, /* 4.14 LTS stable backport */ {4, 18, 8}, /* mainline + everything above inherits */ }; diff --git a/modules/netfilter_xtcompat_cve_2021_22555/skeletonkey_modules.c b/modules/netfilter_xtcompat_cve_2021_22555/skeletonkey_modules.c index 23ed351..79b89dc 100644 --- a/modules/netfilter_xtcompat_cve_2021_22555/skeletonkey_modules.c +++ b/modules/netfilter_xtcompat_cve_2021_22555/skeletonkey_modules.c @@ -103,7 +103,7 @@ static const struct kernel_patched_from netfilter_xtcompat_patched_branches[] = {4, 14, 240}, {4, 19, 198}, {5, 4, 128}, - {5, 10, 46}, + {5, 10, 38}, /* Debian tracker: earlier than 5.10.46 */ {5, 11, 20}, {5, 12, 13}, {5, 13, 0}, /* mainline (5.13 carries b29c457a6511) */ diff --git a/modules/overlayfs_setuid_cve_2023_0386/skeletonkey_modules.c b/modules/overlayfs_setuid_cve_2023_0386/skeletonkey_modules.c index 1942458..2b31924 100644 --- a/modules/overlayfs_setuid_cve_2023_0386/skeletonkey_modules.c +++ b/modules/overlayfs_setuid_cve_2023_0386/skeletonkey_modules.c @@ -62,7 +62,7 @@ static const struct kernel_patched_from overlayfs_setuid_patched_branches[] = { {5, 10, 179}, /* 5.10.x stable backport (per Debian tracker — bullseye) */ {5, 15, 110}, - {6, 1, 27}, + {6, 1, 11}, /* Debian tracker: earlier than 6.1.27 */ {6, 2, 13}, {6, 3, 0}, /* mainline */ }; diff --git a/modules/pintheft_cve_2026_43494/skeletonkey_modules.c b/modules/pintheft_cve_2026_43494/skeletonkey_modules.c index 7a6e958..7aa0b8e 100644 --- a/modules/pintheft_cve_2026_43494/skeletonkey_modules.c +++ b/modules/pintheft_cve_2026_43494/skeletonkey_modules.c @@ -97,6 +97,7 @@ * patch (likely 6.16 once the post-rc release tags). Conservatively * placeholding at {7, 0, 0} until that lands. */ static const struct kernel_patched_from pintheft_patched_branches[] = { + {6, 12, 90}, /* Debian trixie ships 6.12.90 with the fix backported */ {7, 0, 0}, /* mainline fix commit 0cebaccef3ac; tag will be 6.16 or 7.0 depending on when 6.15 closes — refresh when known */ }; diff --git a/modules/ptrace_traceme_cve_2019_13272/skeletonkey_modules.c b/modules/ptrace_traceme_cve_2019_13272/skeletonkey_modules.c index ad2c487..345b724 100644 --- a/modules/ptrace_traceme_cve_2019_13272/skeletonkey_modules.c +++ b/modules/ptrace_traceme_cve_2019_13272/skeletonkey_modules.c @@ -53,7 +53,7 @@ static const struct kernel_patched_from ptrace_traceme_patched_branches[] = { {4, 4, 182}, {4, 9, 182}, {4, 14, 131}, - {4, 19, 58}, + {4, 19, 37}, /* Debian tracker: earlier than 4.19.58 */ {5, 0, 20}, {5, 1, 17}, {5, 2, 0}, /* mainline (5.2-rc) */ diff --git a/modules/sequoia_cve_2021_33909/skeletonkey_modules.c b/modules/sequoia_cve_2021_33909/skeletonkey_modules.c index 3f196e8..82b5b9d 100644 --- a/modules/sequoia_cve_2021_33909/skeletonkey_modules.c +++ b/modules/sequoia_cve_2021_33909/skeletonkey_modules.c @@ -127,7 +127,7 @@ static const struct kernel_patched_from sequoia_patched_branches[] = { {5, 4, 134}, - {5, 10, 52}, + {5, 10, 46}, /* Debian tracker: earlier than 5.10.52 */ {5, 13, 4}, {5, 14, 0}, /* mainline */ }; diff --git a/modules/tioscpgrp_cve_2020_29661/skeletonkey_modules.c b/modules/tioscpgrp_cve_2020_29661/skeletonkey_modules.c index 21873dd..36cb62e 100644 --- a/modules/tioscpgrp_cve_2020_29661/skeletonkey_modules.c +++ b/modules/tioscpgrp_cve_2020_29661/skeletonkey_modules.c @@ -56,6 +56,7 @@ static const struct kernel_patched_from tioscpgrp_patched_branches[] = { {4, 14, 213}, /* 4.14 LTS */ {4, 19, 165}, /* 4.19 LTS */ {5, 4, 85}, /* 5.4 LTS */ + {5, 9, 15}, /* Debian-tracked 5.9 backport */ {5, 10, 0}, /* mainline fix in 5.10 */ }; diff --git a/skeletonkey.c b/skeletonkey.c index a46ccb0..255a0d1 100644 --- a/skeletonkey.c +++ b/skeletonkey.c @@ -35,7 +35,7 @@ #include #include -#define SKELETONKEY_VERSION "0.9.4" +#define SKELETONKEY_VERSION "0.9.5" static const char BANNER[] = "\n"