module: pwnkit

host_distro: Ubuntu 20.04.6 LTS

expect_detect: VULNERABLE

actual_detect: VULNERABLE

status: match


host_distro: Debian GNU/Linux 11 (bullseye)


module: entrybleed

host_distro: Ubuntu 22.04.3 LTS


module: overlayfs


host_distro: Debian GNU/Linux 12 (bookworm)

actual_detect: OK

status: MISMATCH


module: sequoia


host_distro: Ubuntu 18.04.6 LTS


module: stackrot


module: tioscpgrp


module: dirtydecrypt


module: refluxfs

host_distro: Rocky Linux 9.8 (Blue Onyx)


host_distro: Ubuntu 20.04 LTS (frozen 20200423)

verified_kind: exploit

root_witness: uid=0(root); wrote /root/

status: root


root_witness: uid=0(root); wrote /root/ (after gconv-layout fix)


root_witness: none — honest fail (heap not landed)


root_witness: none — honest fail (cgroup/userns precondition on this host)


verified_kind: detect

expect_detect: OK

root_witness: n/a — 5.4 predates the bug (5.8), correctly not-vulnerable


host_distro: Ubuntu 22.04.0 (frozen, genuinely vuln - predates Ubuntu 5.15.0-70 fix)

root_witness: none - module technique broken (chown merged carrier: EPERM); needs CVE-2023-0386 FUSE copy-up PoC port


host_distro: Ubuntu 22.04.0 (frozen)

root_witness: none - kernel 5.15.0-25.25 likely carries Ubuntu backported fix (USN-5317); detect is version-blind. Needs a pre-fix kernel to verify exploit


host_distro: Ubuntu 18.04.2 (frozen, genuinely vuln - pre 4.15.0-58 fix)

root_witness: NONE - false positive. PTRACE_ATTACH to parent(1) EPERM, wrong technique; reports OK via exec-transfer. Needs CVE-2019-13272 PoC port


root_witness: none - honest fail (heap not landed on this libc)


host_distro: Ubuntu 18.04.2, sudo 1.8.21p2 + sudoers (ALL,!root) rule

root_witness: uid=0(root) via sudo -u#-1; module popped root shell


root_witness: none - fixed 2 real bugs (uid_map read post-unshare; missing CLONE_NEWCGROUP). Now sets up userns+cgroupns+mount correctly, but on stock systemd host ALL v1 controllers are pre-mounted (release_agent init-owned=EACCES) and named-hierarchy mount is EPERM. Reachable only in a container context (CAP_SYS_ADMIN / ownable cgroup). Environmental, not a module bug.


host_distro: Ubuntu 22.04.0 (genuinely vuln)

root_witness: none - non-FUSE chown copy-up gives uid=1000 not root; FUSE-lower overlay mount is ENOSYS in userns. Needs fusermount-in-init-ns FUSE port. Raw /dev/fuse attempt reverted.


host_distro: Ubuntu 22.04.0, sudo 1.9.9 + sudoers sudoedit grant

root_witness: none - SUDO_EDITOR/-- injection hits sudoedit writable-dir guard; needs target-file tuning + module debug. Structural, tractable.


host_distro: Ubuntu 22.04.0, sudo 1.9.9-1ubuntu2 + sudoers sudoedit grant

root_witness: uid=0(root) via su skel; /etc/passwd gained skel::0:0 (after 2 fixes: chdir / + helper basename match)


host_distro: Ubuntu 22.04.0, sudo 1.9.9-1ubuntu2 + host-restricted sudoers rule

root_witness: uid=0(root) via sudo -h fakehost01; module works as shipped (needs host-restricted rule + resolvable host)


root_witness: none - offset resolver FIXED (env modprobe_path now resolves + finisher engages + pipapo arb-write fires), but the reconstructed double-free arb-write does not reliably land the write. Honest FAIL. Primitive needs slab-groom hardening.


vm_box: bionic-cloudimg/qemu-kvm

exploit_result: ROOT

root_witness: out-of-band: uid=0(root) + root-owned setuid /tmp/rootbash written by injected shell. bcoles poc.c (pkexec + PTRACE_TRACEME + inject midpid). Kernel CONFIRMED vulnerable. Barrier was polkit authorization (active-session gate) — isolated via a permissive pkla for the backlight helper action; technique itself works.


root_witness: out-of-band: skeletonkey --exploit ptrace_traceme (as uid 1000) planted root-owned /tmp/.sk-ptrace-<pid>.proof and a -rwsr-xr-x root:root setuid bash. Ported the proven Jann Horn/bcoles PoC (embedded, runtime-compiled). Precondition: active local session / permissive polkit so pkexec authorizes the helper (isolated via pkla on the headless VM).

status: working


root_witness: out-of-band: skeletonkey --exploit sudo_samedit (as uid 1000, non-sudoer path) planted root-owned proof + -rwsr-xr-x root:root setuid bash. Ported blasty CVE-2021-3156 technique (NSS libnss_X hijack), runtime-compiled payload, primary Ubuntu lengths 56/54/63/212 landed first try.


host_distro: Ubuntu 22.04 userspace

vm_box: jammy-cloudimg + mainline 5.16.0/qemu-kvm

root_witness: out-of-band: skeletonkey --exploit dirty_pipe (uid 1000) planted root-owned proof + -rwsr-xr-x root:root setuid bash; /etc/passwd left byte-identical (root:x:0:0) after revert. Fixed 3 bugs: false EXPLOIT_OK, wrong escalation (was flipping own UID + su self), and drop_caches revert that corrupted running passwd. New technique: root passwd-field hash + su over pty + Dirty-Pipe revert.


host_kernel: 4.8.0-040800-generic (mainline, pre-4.8.3 Dirty COW fix)

vm_box: xenial-cloudimg + mainline 4.8.0/qemu-kvm

root_witness: out-of-band on a genuinely Dirty-COW-vulnerable kernel: standalone binary built from the module verbatim (dirty_cow_write primitive + find_pw_field_offset + robust poll/timeout dc_su_root_run + exploit body) — race won, su root via pty, planted root-owned proof + -rwsr-xr-x root:root setuid bash, /etc/passwd byte-identical after revert. Confirms the fix (correct escalation, OOB verify, safe revert, readback[512], robust su) lands real root end-to-end. Full skeletonkey binary would not build on xenials 4.4-era uapi headers (unrelated nft_* modern constants).