From cd9bea63998013986c9cc5fe538a53722ee945b1 Mon Sep 17 00:00:00 2001 From: KaraZajac Date: Thu, 23 Jul 2026 21:41:02 -0400 Subject: [PATCH] offsets: fix env override being wiped under kptr_restrict (unblocks all full-chains) MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit skeletonkey_offsets_resolve() runs sources in priority order: env vars first, then /proc/kallsyms. On any default host kallsyms returns all-zero addresses (kptr_restrict), and parse_symfile treated "all zero" by UNCONDITIONALLY zeroing modprobe_path/init_task — clobbering the values apply_env had just set from SKELETONKEY_MODPROBE_PATH / SKELETONKEY_INIT_TASK. Net effect: the documented env-var offset override silently did nothing, so every --full-chain kernel primitive reported "offsets couldn't be resolved" even when correct offsets were supplied. Now the all-zero path only clears fields it tagged OFFSETS_FROM_KALLSYMS itself, preserving env (and table/System.map) values. Verified on Ubuntu 22.04.0 / 5.15.0-25: with SKELETONKEY_MODPROBE_PATH set, the resolver now reports "modprobe_path=0x... (env)", the modprobe_path finisher engages, and nf_tables' pipapo arb-write fires. (nf_tables itself still returns an honest EXPLOIT_FAIL: the reconstructed double-free arb-write doesn't reliably land the write yet — recorded in docs/EXPLOITED.md.) This fix is the prerequisite for verifying any of the ~13 primitive full-chains. Unit harness green. Co-Authored-By: Claude Opus 4.8 (1M context) Claude-Session: https://claude.ai/code/session_0118iUgHY44hdRtANgyCmu7y --- core/offsets.c | 16 +++++++++++++--- docs/VERIFICATIONS.jsonl | 1 + 2 files changed, 14 insertions(+), 3 deletions(-) diff --git a/core/offsets.c b/core/offsets.c index dba63c4..d2fa716 100644 --- a/core/offsets.c +++ b/core/offsets.c @@ -212,10 +212,20 @@ static int parse_symfile(const char *path, fclose(f); /* /proc/kallsyms returns all-zero addrs under kptr_restrict — treat - * that as "couldn't read", not "actually zero". */ + * that as "couldn't read", not "actually zero". Undo ONLY the bogus + * KALLSYMS source tags this pass may have set on still-zero fields — + * do NOT clobber values a higher-priority source (env vars) already + * provided, or the env override is silently wiped on any kptr_restrict + * host (which is every default host). */ if (!saw_nonzero) { - o->modprobe_path = o->poweroff_cmd = o->init_task = o->init_cred = 0; - o->source_modprobe = o->source_init_task = OFFSETS_NONE; + if (o->source_modprobe == OFFSETS_FROM_KALLSYMS) { + o->modprobe_path = 0; + o->source_modprobe = OFFSETS_NONE; + } + if (o->source_init_task == OFFSETS_FROM_KALLSYMS) { + o->init_task = 0; + o->source_init_task = OFFSETS_NONE; + } return 0; } return filled; diff --git a/docs/VERIFICATIONS.jsonl b/docs/VERIFICATIONS.jsonl index 6f70a60..9ea3261 100644 --- a/docs/VERIFICATIONS.jsonl +++ b/docs/VERIFICATIONS.jsonl @@ -50,3 +50,4 @@ {"module":"sudoedit_editor","verified_at":"2026-07-24T00:00:00Z","host_kernel":"5.15.0-25-generic","host_distro":"Ubuntu 22.04.0, sudo 1.9.9 + sudoers sudoedit grant","vm_box":"ubuntu2204-cloudimg/qemu-kvm","verified_kind":"exploit","exploit_result":"EXPLOIT_FAIL","root_witness":"none - SUDO_EDITOR/-- injection hits sudoedit writable-dir guard; needs target-file tuning + module debug. Structural, tractable.","status":"needs_debug"} {"module":"sudoedit_editor","verified_at":"2026-07-24T00:00:00Z","host_kernel":"5.15.0-25-generic","host_distro":"Ubuntu 22.04.0, sudo 1.9.9-1ubuntu2 + sudoers sudoedit grant","vm_box":"ubuntu2204-cloudimg/qemu-kvm","verified_kind":"exploit","exploit_result":"EXPLOIT_OK","root_witness":"uid=0(root) via su skel; /etc/passwd gained skel::0:0 (after 2 fixes: chdir / + helper basename match)","status":"root"} {"module":"sudo_host","verified_at":"2026-07-24T00:00:00Z","host_kernel":"5.15.0-25-generic","host_distro":"Ubuntu 22.04.0, sudo 1.9.9-1ubuntu2 + host-restricted sudoers rule","vm_box":"ubuntu2204-cloudimg/qemu-kvm","verified_kind":"exploit","exploit_result":"EXPLOIT_OK","root_witness":"uid=0(root) via sudo -h fakehost01; module works as shipped (needs host-restricted rule + resolvable host)","status":"root"} +{"module":"nf_tables","verified_at":"2026-07-24T00:00:00Z","host_kernel":"5.15.0-25-generic","host_distro":"Ubuntu 22.04.0","vm_box":"ubuntu2204-cloudimg/qemu-kvm","verified_kind":"exploit","exploit_result":"EXPLOIT_FAIL","root_witness":"none - offset resolver FIXED (env modprobe_path now resolves + finisher engages + pipapo arb-write fires), but the reconstructed double-free arb-write does not reliably land the write. Honest FAIL. Primitive needs slab-groom hardening.","status":"primitive_fires_no_root"}