leviathan/SKELETONKEY
1
1
Fork 0
Code Issues Pull Requests Actions 21 Packages Projects Releases Wiki Activity

docs: record overlayfs_setuid (FUSE port needed) + sudoedit_editor findings
build / build (clang / debug) (push) Waiting to run
Details
build / build (clang / default) (push) Waiting to run
Details
build / build (gcc / debug) (push) Waiting to run
Details
build / build (gcc / default) (push) Waiting to run
Details
build / sanitizers (ASan + UBSan) (push) Waiting to run
Details
build / clang-tidy (push) Waiting to run
Details
build / drift-check (CISA KEV + Debian tracker) (push) Waiting to run
Details
build / static-build (push) Waiting to run
Details

Browse Source 
overlayfs_setuid (CVE-2023-0386) investigated on Ubuntu 22.04.0 / 5.15.0-25
(genuinely vulnerable): the non-FUSE chown copy-up yields upper/file owned by
uid 1000 (no escalation), and overlay refuses a userns-mounted FUSE lowerdir
with ENOSYS (plain overlay-in-userns works). A working exploit must mount FUSE
in the init ns via the setuid fusermount helper (fd-passing protocol) then
overlay in the userns — a substantial dedicated port. A raw /dev/fuse server
was written and reverted after hitting the ENOSYS wall.

sudoedit_editor (CVE-2023-22809) on sudo 1.9.9 returns EXPLOIT_FAIL — the
SUDO_EDITOR/-- arg injection reaches sudoedit's writable-dir guard; needs
target-file tuning and module debugging. Tractable next.

Ledger + VERIFICATIONS.jsonl updated. No code change (overlayfs_setuid reverted
to baseline; not committing a second non-working variant).

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_0118iUgHY44hdRtANgyCmu7y
This commit is contained in:
KaraZajac
2026-07-23 20:34:58 -04:00
parent e01aa99ec6
commit 58b44ebc43
2 changed files with 4 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files
docs/EXPLOITED.md
+2 -1
View File
@@ -55,7 +55,8 @@ tamper check).
| module | CVE | target tested | what's wrong |
|---|---|---|---|
| `ptrace_traceme` | CVE-2019-13272 | Ubuntu 18.04.2 / 4.15.0-50 | placeholder technique (now honest); needs the real cred-transfer PoC (polkit agent) — substantial port |
| `overlayfs_setuid` | CVE-2023-0386 | Ubuntu 22.04.0 / 5.15.0-25 | genuinely vulnerable target; module uses the wrong method (`chown merged carrier: EPERM`). Needs the FUSE copy-up PoC (xkaneiki): a FUSE server exporting a setuid-root lower + overlay copy-up. Substantial port. |
| `overlayfs_setuid` | CVE-2023-0386 | Ubuntu 22.04.0 / 5.15.0-25 | genuinely vulnerable target. Investigated deeply (this session): the non-FUSE `chown` copy-up produces `upper/file` owned by **uid 1000, not root** here, so it doesn't escalate — the CVE needs the FUSE-reported-uid-0 lower. But **overlay refuses a userns-mounted FUSE lowerdir with `ENOSYS`** (plain overlay-in-userns works; FUSE-lower does not). A working port must mount FUSE in the **init ns** via the setuid `fusermount` helper (implement its fd-passing unix-socket protocol, or link libfuse), then overlay in the userns. A raw `/dev/fuse` server was written and reverted (hit the overlay-on-userns-FUSE `ENOSYS`). Substantial dedicated port. |
| `sudoedit_editor` | CVE-2023-22809 | Ubuntu 22.04.0 / sudo 1.9.9 | vulnerable sudo version + sudoers `sudoedit` grant present; module returns `EXPLOIT_FAIL` — the `SUDO_EDITOR`/`--` arg-injection reaches sudoedit's writable-dir guard. Needs a target-file whose dir the injection can satisfy (e.g. `/etc/passwd`), and module debugging. Structural, tractable next. |
| `sudo_samedit` | CVE-2021-3156 | Ubuntu 18.04.2 + 20.04.0 | honest `EXPLOIT_FAIL`; Baron Samedit is heap/libc-version-specific, needs a per-target tuned PoC. Hardest. |
## Inconclusive (detect version-blind vs vendor backport)
docs/VERIFICATIONS.jsonl
+2
View File
@@ -46,3 +46,5 @@
{"module":"sudo_samedit","verified_at":"2026-07-23T00:00:00Z","host_kernel":"4.15.0-50-generic","host_distro":"Ubuntu 18.04.2, sudo 1.8.21p2","vm_box":"ubuntu1804-cloudimg/qemu-kvm","verified_kind":"exploit","exploit_result":"EXPLOIT_FAIL","root_witness":"none - honest fail (heap not landed on this libc)","status":"exploit_fail_honest"}
{"module":"sudo_runas_neg1","verified_at":"2026-07-23T00:00:00Z","host_kernel":"4.15.0-50-generic","host_distro":"Ubuntu 18.04.2, sudo 1.8.21p2 + sudoers (ALL,!root) rule","vm_box":"ubuntu1804-cloudimg/qemu-kvm","verified_kind":"exploit","exploit_result":"EXPLOIT_OK","root_witness":"uid=0(root) via sudo -u#-1; module popped root shell","status":"root"}
{"module":"cgroup_release_agent","verified_at":"2026-07-24T00:00:00Z","host_kernel":"5.4.0-26-generic","host_distro":"Ubuntu 20.04.0","vm_box":"ubuntu2004-cloudimg/qemu-kvm","verified_kind":"exploit","exploit_result":"EXPLOIT_FAIL","root_witness":"none - fixed 2 real bugs (uid_map read post-unshare; missing CLONE_NEWCGROUP). Now sets up userns+cgroupns+mount correctly, but on stock systemd host ALL v1 controllers are pre-mounted (release_agent init-owned=EACCES) and named-hierarchy mount is EPERM. Reachable only in a container context (CAP_SYS_ADMIN / ownable cgroup). Environmental, not a module bug.","status":"env_limited_after_fix"}
{"module":"overlayfs_setuid","verified_at":"2026-07-24T00:00:00Z","host_kernel":"5.15.0-25-generic","host_distro":"Ubuntu 22.04.0 (genuinely vuln)","vm_box":"ubuntu2204-cloudimg/qemu-kvm","verified_kind":"exploit","exploit_result":"EXPLOIT_FAIL","root_witness":"none - non-FUSE chown copy-up gives uid=1000 not root; FUSE-lower overlay mount is ENOSYS in userns. Needs fusermount-in-init-ns FUSE port. Raw /dev/fuse attempt reverted.","status":"needs_fuse_port"}
{"module":"sudoedit_editor","verified_at":"2026-07-24T00:00:00Z","host_kernel":"5.15.0-25-generic","host_distro":"Ubuntu 22.04.0, sudo 1.9.9 + sudoers sudoedit grant","vm_box":"ubuntu2204-cloudimg/qemu-kvm","verified_kind":"exploit","exploit_result":"EXPLOIT_FAIL","root_witness":"none - SUDO_EDITOR/-- injection hits sudoedit writable-dir guard; needs target-file tuning + module debug. Structural, tractable.","status":"needs_debug"}