leviathan/SKELETONKEY
1
1
Fork 0
Code Issues Pull Requests Actions 16 Packages Projects Releases Wiki Activity

docs: record overlayfs_setuid (FUSE port needed) + sudoedit_editor findings
build / build (clang / debug) (push) Waiting to run
Details
build / build (clang / default) (push) Waiting to run
Details
build / build (gcc / debug) (push) Waiting to run
Details
build / build (gcc / default) (push) Waiting to run
Details
build / sanitizers (ASan + UBSan) (push) Waiting to run
Details
build / clang-tidy (push) Waiting to run
Details
build / drift-check (CISA KEV + Debian tracker) (push) Waiting to run
Details
build / static-build (push) Waiting to run
Details

Browse Source 
overlayfs_setuid (CVE-2023-0386) investigated on Ubuntu 22.04.0 / 5.15.0-25
(genuinely vulnerable): the non-FUSE chown copy-up yields upper/file owned by
uid 1000 (no escalation), and overlay refuses a userns-mounted FUSE lowerdir
with ENOSYS (plain overlay-in-userns works). A working exploit must mount FUSE
in the init ns via the setuid fusermount helper (fd-passing protocol) then
overlay in the userns — a substantial dedicated port. A raw /dev/fuse server
was written and reverted after hitting the ENOSYS wall.

sudoedit_editor (CVE-2023-22809) on sudo 1.9.9 returns EXPLOIT_FAIL — the
SUDO_EDITOR/-- arg injection reaches sudoedit's writable-dir guard; needs
target-file tuning and module debugging. Tractable next.

Ledger + VERIFICATIONS.jsonl updated. No code change (overlayfs_setuid reverted
to baseline; not committing a second non-working variant).

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_0118iUgHY44hdRtANgyCmu7y
This commit is contained in:
KaraZajac
2026-07-23 20:34:58 -04:00
parent e01aa99ec6
commit 58b44ebc43
2 changed files with 4 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files
docs/EXPLOITED.md
+2 -1
View File
@@ -55,7 +55,8 @@ tamper check).
| module | CVE | target tested | what's wrong |
|---|---|---|---|
| `ptrace_traceme` | CVE-2019-13272 | Ubuntu 18.04.2 / 4.15.0-50 | placeholder technique (now honest); needs the real cred-transfer PoC (polkit agent) — substantial port |
| `overlayfs_setuid` | CVE-2023-0386 | Ubuntu 22.04.0 / 5.15.0-25 | genuinely vulnerable target; module uses the wrong method (`chown merged carrier: EPERM`). Needs the FUSE copy-up PoC (xkaneiki): a FUSE server exporting a setuid-root lower + overlay copy-up. Substantial port. |
| `overlayfs_setuid` | CVE-2023-0386 | Ubuntu 22.04.0 / 5.15.0-25 | genuinely vulnerable target. Investigated deeply (this session): the non-FUSE `chown` copy-up produces `upper/file` owned by **uid 1000, not root** here, so it doesn't escalate — the CVE needs the FUSE-reported-uid-0 lower. But **overlay refuses a userns-mounted FUSE lowerdir with `ENOSYS`** (plain overlay-in-userns works; FUSE-lower does not). A working port must mount FUSE in the **init ns** via the setuid `fusermount` helper (implement its fd-passing unix-socket protocol, or link libfuse), then overlay in the userns. A raw `/dev/fuse` server was written and reverted (hit the overlay-on-userns-FUSE `ENOSYS`). Substantial dedicated port. |
| `sudoedit_editor` | CVE-2023-22809 | Ubuntu 22.04.0 / sudo 1.9.9 | vulnerable sudo version + sudoers `sudoedit` grant present; module returns `EXPLOIT_FAIL` — the `SUDO_EDITOR`/`--` arg-injection reaches sudoedit's writable-dir guard. Needs a target-file whose dir the injection can satisfy (e.g. `/etc/passwd`), and module debugging. Structural, tractable next. |
| `sudo_samedit` | CVE-2021-3156 | Ubuntu 18.04.2 + 20.04.0 | honest `EXPLOIT_FAIL`; Baron Samedit is heap/libc-version-specific, needs a per-target tuned PoC. Hardest. |
## Inconclusive (detect version-blind vs vendor backport)