leviathan/SKELETONKEY
1
1
Fork 0
Code Issues Pull Requests Actions 16 Packages Projects Releases Wiki Activity

af_packet2: fix uid_map (read uid/gid before unshare) — same bug as cgroup
build / build (clang / debug) (push) Waiting to run
Details
build / build (clang / default) (push) Waiting to run
Details
build / build (gcc / debug) (push) Waiting to run
Details
build / build (gcc / default) (push) Waiting to run
Details
build / sanitizers (ASan + UBSan) (push) Waiting to run
Details
build / clang-tidy (push) Waiting to run
Details
build / drift-check (CISA KEV + Debian tracker) (push) Waiting to run
Details
build / static-build (push) Waiting to run
Details

Browse Source 
af_packet2 read getuid()/getgid() AFTER unshare(CLONE_NEWUSER), so it wrote
"0 65534 1" to uid_map/gid_map (65534 = nobody, the initial unmapped id) and
the write was rejected EPERM — the userns-root mapping silently failed and the
CAP_NET_RAW primitive could not fire. Capture the outer uid/gid before unshare.

Audited every userns module for the pattern; only cgroup_release_agent (fixed
in 8c45b2b) and af_packet2 had it. Updated docs/EXPLOITED.md.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_0118iUgHY44hdRtANgyCmu7y
This commit is contained in:
KaraZajac
2026-07-23 20:18:03 -04:00
parent 8c45b2beb8
commit e01aa99ec6
2 changed files with 22 additions and 7 deletions
Download Patch File Download Diff File Expand all files Collapse all files
docs/EXPLOITED.md
+14 -5
View File
@@ -38,16 +38,25 @@ tamper check).
tracer, which by then has reparented to init → `EPERM`). Made **honest**
(verifies `euid==0`, otherwise `EXPLOIT_FAIL`); a faithful CVE-2019-13272 port
(Jann Horn / bcoles: `PTRACE_TRACEME` + setuid execve + registered polkit
agent) is still required to land root.
agent) is still required to land root. (commit `59cc2be`)
- **`cgroup_release_agent`** — two real bugs fixed (commit `8c45b2b`): it read
`getuid()` **after** `unshare(CLONE_NEWUSER)` (→ `65534`, so `uid_map` write
was `"0 65534 1"` → EPERM), and it omitted `CLONE_NEWCGROUP` (→ cgroup-v1
mount EPERM). Now the userns+cgroupns+mount setup is correct. It still can't
root a **bare** unprivileged user on a stock systemd host: every v1 controller
is pre-mounted (its `release_agent` is init-owned → EACCES from the userns)
and a fresh named hierarchy is refused. Reachable in a **container** context
(CAP_SYS_ADMIN / an ownable cgroup) — matches its "host root from rootless
container" framing. The `getuid()`-after-`unshare` bug is a pattern to grep
for across the other userns modules.
## Needs a faithful PoC port (genuinely vulnerable target, exploit doesn't land)
| module | CVE | target tested | what's wrong |
|---|---|---|---|
| `ptrace_traceme` | CVE-2019-13272 | Ubuntu 18.04.2 / 4.15.0-50 | placeholder technique; needs the real cred-transfer PoC |
| `overlayfs_setuid` | CVE-2023-0386 | Ubuntu 22.04.0 / 5.15.0-25 | `chown merged carrier: EPERM` — wrong method; needs the FUSE copy-up PoC (xkaneiki) |
| `sudo_samedit` | CVE-2021-3156 | Ubuntu 18.04.2 + 20.04.0 | honest `EXPLOIT_FAIL`; Baron Samedit is heap/libc-specific, needs a tuned PoC |
| `cgroup_release_agent` | CVE-2022-0492 | Ubuntu 20.04.0 / 5.4.0-26 | honest `EXPLOIT_FAIL`; cgroup-v1/userns release_agent precondition/technique |
| `ptrace_traceme` | CVE-2019-13272 | Ubuntu 18.04.2 / 4.15.0-50 | placeholder technique (now honest); needs the real cred-transfer PoC (polkit agent) — substantial port |
| `overlayfs_setuid` | CVE-2023-0386 | Ubuntu 22.04.0 / 5.15.0-25 | genuinely vulnerable target; module uses the wrong method (`chown merged carrier: EPERM`). Needs the FUSE copy-up PoC (xkaneiki): a FUSE server exporting a setuid-root lower + overlay copy-up. Substantial port. |
| `sudo_samedit` | CVE-2021-3156 | Ubuntu 18.04.2 + 20.04.0 | honest `EXPLOIT_FAIL`; Baron Samedit is heap/libc-version-specific, needs a per-target tuned PoC. Hardest. |
## Inconclusive (detect version-blind vs vendor backport)