leviathan/SKELETONKEY
1
1
Fork 0
Code Issues Pull Requests Actions 31 Packages Projects Releases Wiki Activity

modules: add sudo_host (CVE-2025-32462, Stratascale sudo --host policy bypass)

Browse Source 
Second new module this cycle; sibling of sudo_chwoot (CVE-2025-32463, same Stratascale/Rich Mirch disclosure). sudo's -h/--host option — meant only to pair with -l/--list — was honored when running a command, so a sudoers rule scoped to a host other than the current machine (and not ALL) is usable via 'sudo -h <host> <cmd>' for local root. Affects sudo 1.8.8 -> 1.9.17p0; fixed 1.9.17p1. CWE-863, CVSS 8.8 (not in KEV).

detect(): version-gate [1.8.8, 1.9.17p0] via ctx->host->sudo_version (the host-restricted rule itself isn't probeable unprivileged, so VULNERABLE means 'vulnerable sudo present'). exploit(): discovers an abusable host-restricted rule from readable sudoers (or SKELETONKEY_SUDO_HOST), witnesses with 'sudo -n -h <host> id -u', pops 'sudo -h <host> /bin/bash' (SKELETONKEY_SUDO_CMD) only on a uid-0 witness; honest EXPLOIT_FAIL + operator guidance otherwise. Shared 'sudo' family; structural, arch=any; safety rank 96. auditd/sigma/falco rules, NOTICE.md (Rich Mirch / Stratascale) + MODULE.md, 4 detect() test rows.

Wiring: registry, Makefile, cve_metadata (+JSON), verify-vm/targets.yaml (ubuntu1804 sudo 1.8.21p2 target, sweep pending). Docs: README + CVES.md + docs/index.html counts 40->41 modules / 35->36 CVEs; not-yet-verified lists + corpus pill.
This commit is contained in:
KaraZajac
2026-06-02 08:43:09 -04:00
parent 3d9db6b93e
commit dd5f4fa06d
15 changed files with 665 additions and 28 deletions
Download Patch File Download Diff File Expand all files Collapse all files
tests/test_detect.c
+33
View File
@@ -69,6 +69,7 @@ extern const struct skeletonkey_module tioscpgrp_module;
extern const struct skeletonkey_module vsock_uaf_module;
extern const struct skeletonkey_module nft_pipapo_module;
extern const struct skeletonkey_module ptrace_pidfd_module;
extern const struct skeletonkey_module sudo_host_module;
static int g_pass = 0;
static int g_fail = 0;
@@ -770,6 +771,38 @@ static void run_all(void)
&ptrace_pidfd_module, &h_pidfd_7_1_0,
SKELETONKEY_OK);
/* ── sudo_host (CVE-2025-32462) ──────────────────────────────
* Version-gated on sudo [1.8.8, 1.9.17p0]; fixed 1.9.17p1.
* Assumes sudo is installed on the runner (as the other sudo_*
* rows do — detect() PRECOND_FAILs without a setuid sudo). */
/* vulnerable sudo 1.8.31 (in range) → VULNERABLE */
run_one("sudo_host: sudo 1.8.31 (in range) → VULNERABLE",
&sudo_host_module, &h_vuln_sudo,
SKELETONKEY_VULNERABLE);
/* fixed sudo 1.9.17p1 → OK (note: 1.9.13p1 is still vulnerable to
* THIS CVE, so h_fixed_sudo can't be reused here) */
struct skeletonkey_host h_sudo_host_fixed = h_kernel_6_12;
strcpy(h_sudo_host_fixed.sudo_version, "1.9.17p1");
run_one("sudo_host: sudo 1.9.17p1 (fixed) → OK",
&sudo_host_module, &h_sudo_host_fixed,
SKELETONKEY_OK);
/* sudo 1.8.6 predates the -h behaviour (< 1.8.8) → OK */
struct skeletonkey_host h_sudo_host_old = h_kernel_6_12;
strcpy(h_sudo_host_old.sudo_version, "1.8.6");
run_one("sudo_host: sudo 1.8.6 (pre-1.8.8) → OK",
&sudo_host_module, &h_sudo_host_old,
SKELETONKEY_OK);
/* sudo 1.9.17 plain (== 1.9.17p0) → VULNERABLE (fix is p1) */
struct skeletonkey_host h_sudo_host_1917 = h_kernel_6_12;
strcpy(h_sudo_host_1917.sudo_version, "1.9.17");
run_one("sudo_host: sudo 1.9.17 (==p0, pre-p1 fix) → VULNERABLE",
&sudo_host_module, &h_sudo_host_1917,
SKELETONKEY_VULNERABLE);
/* ── coverage report ─────────────────────────────────────────
* Iterate the runtime registry (populated by skeletonkey_register_*
* calls in main()) and warn for any module that was not touched