overlayfs_setuid (CVE-2023-0386) investigated on Ubuntu 22.04.0 / 5.15.0-25
(genuinely vulnerable): the non-FUSE chown copy-up yields upper/file owned by
uid 1000 (no escalation), and overlay refuses a userns-mounted FUSE lowerdir
with ENOSYS (plain overlay-in-userns works). A working exploit must mount FUSE
in the init ns via the setuid fusermount helper (fd-passing protocol) then
overlay in the userns — a substantial dedicated port. A raw /dev/fuse server
was written and reverted after hitting the ENOSYS wall.
sudoedit_editor (CVE-2023-22809) on sudo 1.9.9 returns EXPLOIT_FAIL — the
SUDO_EDITOR/-- arg injection reaches sudoedit's writable-dir guard; needs
target-file tuning and module debugging. Tractable next.
Ledger + VERIFICATIONS.jsonl updated. No code change (overlayfs_setuid reverted
to baseline; not committing a second non-working variant).
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_0118iUgHY44hdRtANgyCmu7y
af_packet2 read getuid()/getgid() AFTER unshare(CLONE_NEWUSER), so it wrote
"0 65534 1" to uid_map/gid_map (65534 = nobody, the initial unmapped id) and
the write was rejected EPERM — the userns-root mapping silently failed and the
CAP_NET_RAW primitive could not fire. Capture the outer uid/gid before unshare.
Audited every userns module for the pattern; only cgroup_release_agent (fixed
in 8c45b2b) and af_packet2 had it. Updated docs/EXPLOITED.md.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_0118iUgHY44hdRtANgyCmu7y
ptrace_traceme reported EXPLOIT_OK while obtaining no root on a genuinely
vulnerable host (Ubuntu 18.04.2 / 4.15.0-50). The bundled ptrace sequence is a
non-working placeholder — it PTRACE_ATTACHes to the tracer, which by then has
reparented to init, so the attach fails EPERM; the parent then execve'd the
setuid trigger and the dispatcher's exec-transfer path reported a false OK.
Now the parent fires the trigger in a grandchild, stays alive, and verifies
euid==0 before claiming success — otherwise honest EXPLOIT_FAIL with a pointer
to the real CVE-2019-13272 technique (Jann Horn / bcoles) that still needs
porting.
Adds docs/EXPLOITED.md: the exploit-verification ledger (root witnessed OUT OF
BAND, not from the module's self-report). Confirmed landing root: refluxfs,
overlayfs, pwnkit (after its gconv fix), sudo_runas_neg1. Needs PoC ports:
ptrace_traceme, overlayfs_setuid (CVE-2023-0386 FUSE copy-up), sudo_samedit
(heap), cgroup_release_agent. ~30 modules still exploit-untested.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_0118iUgHY44hdRtANgyCmu7y
KaraZajac