KaraZajac
1bdbe011b0
build / build (clang / debug) (push) Waiting to run
build / build (clang / default) (push) Waiting to run
build / build (gcc / debug) (push) Waiting to run
build / build (gcc / default) (push) Waiting to run
build / sanitizers (ASan + UBSan) (push) Waiting to run
build / clang-tidy (push) Waiting to run
build / drift-check (CISA KEV + Debian tracker) (push) Waiting to run
build / static-build (push) Waiting to run
Ran the full methodology on the flagship kernel primitive:
- Built Notselwyn's public universal PoC on jammy 5.15.0-25 (below patched
branch 5.15.149) and ran it: hit the deliberate post-root `kernel BUG at
mm/slub.c:379` / panic — the cross-cache slab corruption fired. Kernel is
genuinely exploitable.
- Diffed technique: the module is an honest trigger+groom SCAFFOLD (real
NFT_GOTO+NFT_DROP double-free + msg_msg cg-96 groom) whose pipapo arb-write is
FALLBACK-DEPTH (exact pipapo_elem layout is a documented TODO) -> honest
EXPLOIT_FAIL. Notselwyn uses a heavier universal cross-cache -> dirty-pagetable
technique (~2000 LOC, multi-file, static libnftnl/libmnl, no per-kernel
offsets). Completing the module's full-chain is substantial dedicated
exploit-dev, not a spot-the-bug fix.
The piece that was actually broken and is now fixed+pushed is the offset
resolver (cd9bea6): env-provided offsets were wiped under kptr_restrict, which
blocked the entire --full-chain path. Recorded in docs/EXPLOITED.md.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_0118iUgHY44hdRtANgyCmu7y
