leviathan/SKELETONKEY
1
1
Fork 0
Code Issues Pull Requests Actions 21 Packages Projects Releases Wiki Activity

cgroup_release_agent: fix uid_map (read uid pre-unshare) + add CLONE_NEWCGROUP

Browse Source 
Two real bugs found via VM verification (Ubuntu 20.04.0 / 5.4.0-26):

1. uid_map EPERM: the child captured getuid()/getgid() AFTER
   unshare(CLONE_NEWUSER), where they return 65534 (nobody, the initial
   unmapped id), so it wrote "0 65534 1" to uid_map — rejected with EPERM.
   Now the outer uid/gid are read BEFORE unshare, yielding the correct
   "0 <uid> 1" single-uid self-map. (overlayfs got this right, which is why
   it worked; this module didn't.)

2. mount EPERM: the unprivileged cgroup-v1 mount needs a private cgroup
   namespace. Added CLONE_NEWCGROUP (with a fallback) — mounting an unused v1
   controller then succeeds.

With both fixed the userns+cgroupns+mount setup is correct. Note: on a stock
systemd host every v1 controller is already mounted (its release_agent is
owned by init-root and unwritable from the userns) and creating a fresh named
hierarchy is refused, so a bare unprivileged user cannot own release_agent —
CVE-2022-0492 is reachable in a container context (CAP_SYS_ADMIN / an ownable
cgroup), consistent with the module's "host root from rootless container"
framing. Verified out-of-band; see docs/EXPLOITED.md.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_0118iUgHY44hdRtANgyCmu7y
This commit is contained in:
KaraZajac
2026-07-23 20:15:51 -04:00
parent 59cc2be065
commit 8c45b2beb8
2 changed files with 23 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files
docs/VERIFICATIONS.jsonl
+1
View File
@@ -45,3 +45,4 @@
{"module":"ptrace_traceme","verified_at":"2026-07-23T00:00:00Z","host_kernel":"4.15.0-50-generic","host_distro":"Ubuntu 18.04.2 (frozen, genuinely vuln - pre 4.15.0-58 fix)","vm_box":"ubuntu1804-cloudimg/qemu-kvm","verified_kind":"exploit","exploit_result":"EXPLOIT_OK(FALSE)","root_witness":"NONE - false positive. PTRACE_ATTACH to parent(1) EPERM, wrong technique; reports OK via exec-transfer. Needs CVE-2019-13272 PoC port","status":"false_positive"}
{"module":"sudo_samedit","verified_at":"2026-07-23T00:00:00Z","host_kernel":"4.15.0-50-generic","host_distro":"Ubuntu 18.04.2, sudo 1.8.21p2","vm_box":"ubuntu1804-cloudimg/qemu-kvm","verified_kind":"exploit","exploit_result":"EXPLOIT_FAIL","root_witness":"none - honest fail (heap not landed on this libc)","status":"exploit_fail_honest"}
{"module":"sudo_runas_neg1","verified_at":"2026-07-23T00:00:00Z","host_kernel":"4.15.0-50-generic","host_distro":"Ubuntu 18.04.2, sudo 1.8.21p2 + sudoers (ALL,!root) rule","vm_box":"ubuntu1804-cloudimg/qemu-kvm","verified_kind":"exploit","exploit_result":"EXPLOIT_OK","root_witness":"uid=0(root) via sudo -u#-1; module popped root shell","status":"root"}
{"module":"cgroup_release_agent","verified_at":"2026-07-24T00:00:00Z","host_kernel":"5.4.0-26-generic","host_distro":"Ubuntu 20.04.0","vm_box":"ubuntu2004-cloudimg/qemu-kvm","verified_kind":"exploit","exploit_result":"EXPLOIT_FAIL","root_witness":"none - fixed 2 real bugs (uid_map read post-unshare; missing CLONE_NEWCGROUP). Now sets up userns+cgroupns+mount correctly, but on stock systemd host ALL v1 controllers are pre-mounted (release_agent init-owned=EACCES) and named-hierarchy mount is EPERM. Reachable only in a container context (CAP_SYS_ADMIN / ownable cgroup). Environmental, not a module bug.","status":"env_limited_after_fix"}