KaraZajac
03324c8542
release / build (arm64) (push) Waiting to run
release / build (x86_64) (push) Waiting to run
release / build (x86_64-static / musl) (push) Waiting to run
release / build (arm64-static / musl) (push) Waiting to run
release / release (push) Blocked by required conditions
Adds the ghostlock module for CVE-2026-43499 ("GhostLock", VEGA / Nebula
Security's "IonStack part II") — a ~15-year race UAF on kernel STACK memory in
the rtmutex/futex requeue-PI path (kernel/locking/rtmutex.c). On the -EDEADLK
deadlock-rollback, remove_waiter() runs against `current` instead of the waiter
task, so a concurrent sched_setattr()-driven PI-chain priority walk on another
CPU clears pi_blocked_on on the wrong task and leaves an on-stack rt_mutex_waiter
dangling. Reachable by any unprivileged user (CVSS 7.8, PR:L) — plain
futex(2) + sched_setattr(2), no userns/CONFIG beyond CONFIG_FUTEX_PI. The
corpus's first rtmutex/futex-PI module and first kernel-stack UAF (all others
are heap/slab).
Introduced 2.6.39; fixed 3bfdc63936dd (7.1-rc1), stable backports
7.0.4 / 6.18.27 / 6.12.86 / 6.6.140 / 6.1.175; 5.15/5.10/5.4/4.19 affected with
no upstream fix. CWE-416; not in KEV.
detect() is a pure version gate over the five-branch backport table. exploit()
forks an isolated child that (A) deterministically confirms the -EDEADLK
remove_waiter() rollback path is reachable (safe — no concurrent walk means no
dangling pointer; validated on real hardware) then (B) exercises the actual race
a hard-bounded 24 iters / 2s with a sibling-CPU sched_setattr(SCHED_BATCH) storm,
and stops. Deliberately under-driven: no copy_from_user widening, no stack-frame
spray/reoccupation, and the KernelSnitch leak -> forged-waiter ->
fops/ashmem/pipe R/W -> cred-patch chain (Android/Pixel-specific, per-build
offsets) is NOT bundled. Returns EXPLOIT_FAIL. Lowest --auto safety rank (11) —
a won race corrupts the kernel stack. Unlike most races it ships a real
detection signature (futex requeue-PI returning EDEADLK + sibling sched_setattr);
auditd/sigma anchor on sched_setattr, falco/eBPF on the EDEADLK tell; no yara.
Wired: registry, Makefile, safety rank 11, version 0.9.13, 9 detect() test rows
(incl. 6.13.0 -> VULNERABLE, the multi-branch "newer than all" case), CVE
metadata (CWE-416 / T1068 / not-KEV; cve_metadata.c + KEV_CROSSREF.md regenerated
-> 13 of 40), README + CVES.md + website counts (45 modules / 40 CVEs),
RELEASE_NOTES v0.9.13, verify-vm target. Also corrects pre-existing
docs/index.html drift left by v0.9.12 (body counts stuck at 43/38 and a missing
bad_epoll corpus pill). Tests: 33 kernel_range + 101 detect, all pass.
Credit: VEGA / Nebula Security (nebusec.ai, NebuSec/CyberMeowfia, Apache-2.0);
upstream fix 3bfdc63936dd (Keenan Dong / Thomas Gleixner).
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01KUq4DGXSPBmPkAyJ9WnM9n
3.0 KiB
3.0 KiB
CISA KEV Cross-Reference
Which SKELETONKEY modules cover CVEs that CISA has observed exploited
in the wild per the Known Exploited Vulnerabilities catalog.
Refreshed via tools/refresh-cve-metadata.py.
13 of 40 modules cover KEV-listed CVEs.
In KEV (prioritize patching)
| CVE | Date added to KEV | CWE | Module |
|---|---|---|---|
| CVE-2019-13272 | 2021-12-10 | ? | ptrace_traceme_cve_2019_13272 |
| CVE-2016-5195 | 2022-03-03 | CWE-362 | dirty_cow_cve_2016_5195 |
| CVE-2021-3156 | 2022-04-06 | CWE-193 | sudo_samedit_cve_2021_3156 |
| CVE-2022-0847 | 2022-04-25 | CWE-665 | dirty_pipe_cve_2022_0847 |
| CVE-2021-4034 | 2022-06-27 | CWE-787 | pwnkit_cve_2021_4034 |
| CVE-2021-3493 | 2022-10-20 | CWE-270 | overlayfs_cve_2021_3493 |
| CVE-2024-1086 | 2024-05-30 | CWE-416 | nf_tables_cve_2024_1086 |
| CVE-2022-0185 | 2024-08-21 | CWE-190 | fuse_legacy_cve_2022_0185 |
| CVE-2023-0386 | 2025-06-17 | CWE-282 | overlayfs_setuid_cve_2023_0386 |
| CVE-2025-32463 | 2025-09-29 | CWE-829 | sudo_chwoot_cve_2025_32463 |
| CVE-2021-22555 | 2025-10-06 | CWE-787 | netfilter_xtcompat_cve_2021_22555 |
| CVE-2018-14634 | 2026-01-26 | CWE-190 | mutagen_astronomy_cve_2018_14634 |
| CVE-2022-0492 | 2026-06-02 | CWE-287 | cgroup_release_agent_cve_2022_0492 |
Not in KEV
Not observed exploited per CISA — but several have public PoC code and are technically reachable. "Not in KEV" is not the same as "safe to ignore".
| CVE | CWE | Module |
|---|---|---|
| CVE-2017-7308 | CWE-681 | af_packet_cve_2017_7308 |
| CVE-2019-14287 | CWE-755 | sudo_runas_neg1_cve_2019_14287 |
| CVE-2020-14386 | CWE-250 | af_packet2_cve_2020_14386 |
| CVE-2020-29661 | CWE-416 | tioscpgrp_cve_2020_29661 |
| CVE-2021-33909 | CWE-190 | sequoia_cve_2021_33909 |
| CVE-2022-25636 | CWE-269 | nft_fwd_dup_cve_2022_25636 |
| CVE-2022-2588 | CWE-416 | cls_route4_cve_2022_2588 |
| CVE-2023-0179 | CWE-190 | nft_payload_cve_2023_0179 |
| CVE-2023-0458 | CWE-476 | entrybleed_cve_2023_0458 |
| CVE-2023-2008 | CWE-129 | vmwgfx_cve_2023_2008 |
| CVE-2023-22809 | CWE-269 | sudoedit_editor_cve_2023_22809 |
| CVE-2023-32233 | CWE-416 | nft_set_uaf_cve_2023_32233 |
| CVE-2023-3269 | CWE-416 | stackrot_cve_2023_3269 |
| CVE-2023-4622 | CWE-416 | af_unix_gc_cve_2023_4622 |
| CVE-2024-26581 | ? | nft_pipapo_cve_2024_26581 |
| CVE-2024-50264 | CWE-416 | vsock_uaf_cve_2024_50264 |
| CVE-2025-32462 | CWE-863 | sudo_host_cve_2025_32462 |
| CVE-2025-6019 | CWE-250 | udisks_libblockdev_cve_2025_6019 |
| CVE-2026-23111 | CWE-416 | nft_catchall_cve_2026_23111 |
| CVE-2026-31635 | CWE-130 | dirtydecrypt_cve_2026_31635 |
| CVE-2026-41651 | CWE-367 | pack2theroot_cve_2026_41651 |
| CVE-2026-43494 | ? | pintheft_cve_2026_43494 |
| CVE-2026-43499 | CWE-416 | ghostlock_cve_2026_43499 |
| CVE-2026-46242 | CWE-416 | bad_epoll_cve_2026_46242 |
| CVE-2026-46243 | CWE-20 | cifswitch_cve_2026_46243 |
| CVE-2026-46300 | CWE-787 | fragnesia_cve_2026_46300 |
| CVE-2026-46333 | CWE-269 | ptrace_pidfd_cve_2026_46333 |