KaraZajac
4d0a0e2443
release / build (arm64) (push) Waiting to run
release / build (x86_64) (push) Waiting to run
release / build (x86_64-static / musl) (push) Waiting to run
release / build (arm64-static / musl) (push) Waiting to run
release / release (push) Blocked by required conditions
The newest nftables LPE: a use-after-free in the nf_tables transaction-
abort path. An inverted condition (a stray '!') in
nft_map_catchall_activate() makes the abort path process active catch-all
map elements instead of skipping them; a catch-all GOTO element drives a
chain's use-count to zero so a following DELCHAIN frees it while the
catch-all verdict still references it -> UAF, escalatable from an
unprivileged user (userns + nftables) via modprobe_path/selinux_state ROP.
Fixed upstream by f41c5d1; CWE-416, CVSS 7.8; not in CISA KEV. Public
reproduction by FuzzingLabs.
Takes the corpus to 43 modules / 38 CVEs.
🟡 reconstructed trigger, primitive-only, NOT VM-verified — same contract
as nf_tables (CVE-2024-1086). detect() version-gates (catch-all elems
~5.13; Debian backports 6.1.164/6.12.73/6.18.10, 7.0+ inherits) AND
requires unprivileged user_ns clone (else PRECOND_FAIL). exploit() forks
an isolated child, builds a verdict map with a catch-all GOTO element,
provokes an aborting batch to drive the abort-path UAF, observes slabinfo,
and returns EXPLOIT_FAIL — the per-kernel leak + R/W + modprobe_path ROP
is not bundled. kernel_range table verified drift-clean against the live
Debian tracker (the 6.18 branch / 6.18.10 fix is the real forky/sid
backport; the earlier 7.0.10 figure was wrong).
Wired: registry, Makefile, safety rank (35), 6 detect() test rows (version
+ userns gating), CVE_METADATA.json + cve_metadata.c + KEV_CROSSREF.md
(sorted insert, CWE-416/T1068/not-KEV), README + CVES.md + website counts
(43/38) + yellow pill, RELEASE_NOTES v0.9.11, verify-vm target. Credit:
FuzzingLabs + upstream fix f41c5d1. Version 0.9.11.
71 lines
2.8 KiB
C
71 lines
2.8 KiB
C
/*
|
|
* SKELETONKEY — module registry
|
|
*
|
|
* Global list of registered modules. Each family contributes via
|
|
* register_<family>_modules() called from skeletonkey main() at startup.
|
|
*/
|
|
|
|
#ifndef SKELETONKEY_REGISTRY_H
|
|
#define SKELETONKEY_REGISTRY_H
|
|
|
|
#include "module.h"
|
|
|
|
void skeletonkey_register(const struct skeletonkey_module *m);
|
|
|
|
size_t skeletonkey_module_count(void);
|
|
const struct skeletonkey_module *skeletonkey_module_at(size_t i);
|
|
|
|
/* Find a module by name. Returns NULL if not found. */
|
|
const struct skeletonkey_module *skeletonkey_module_find(const char *name);
|
|
|
|
/* Each module family declares one of these in its public header. The
|
|
* top-level skeletonkey main() calls them in order at startup. */
|
|
void skeletonkey_register_copy_fail_family(void);
|
|
void skeletonkey_register_dirty_pipe(void);
|
|
void skeletonkey_register_entrybleed(void);
|
|
void skeletonkey_register_pwnkit(void);
|
|
void skeletonkey_register_nf_tables(void);
|
|
void skeletonkey_register_overlayfs(void);
|
|
void skeletonkey_register_cls_route4(void);
|
|
void skeletonkey_register_dirty_cow(void);
|
|
void skeletonkey_register_ptrace_traceme(void);
|
|
void skeletonkey_register_netfilter_xtcompat(void);
|
|
void skeletonkey_register_af_packet(void);
|
|
void skeletonkey_register_fuse_legacy(void);
|
|
void skeletonkey_register_stackrot(void);
|
|
void skeletonkey_register_af_packet2(void);
|
|
void skeletonkey_register_cgroup_release_agent(void);
|
|
void skeletonkey_register_overlayfs_setuid(void);
|
|
void skeletonkey_register_nft_set_uaf(void);
|
|
void skeletonkey_register_af_unix_gc(void);
|
|
void skeletonkey_register_nft_fwd_dup(void);
|
|
void skeletonkey_register_nft_payload(void);
|
|
void skeletonkey_register_sudo_samedit(void);
|
|
void skeletonkey_register_sequoia(void);
|
|
void skeletonkey_register_sudoedit_editor(void);
|
|
void skeletonkey_register_vmwgfx(void);
|
|
void skeletonkey_register_dirtydecrypt(void);
|
|
void skeletonkey_register_fragnesia(void);
|
|
void skeletonkey_register_pack2theroot(void);
|
|
void skeletonkey_register_sudo_chwoot(void);
|
|
void skeletonkey_register_udisks_libblockdev(void);
|
|
void skeletonkey_register_pintheft(void);
|
|
void skeletonkey_register_mutagen_astronomy(void);
|
|
void skeletonkey_register_sudo_runas_neg1(void);
|
|
void skeletonkey_register_tioscpgrp(void);
|
|
void skeletonkey_register_vsock_uaf(void);
|
|
void skeletonkey_register_nft_pipapo(void);
|
|
void skeletonkey_register_ptrace_pidfd(void);
|
|
void skeletonkey_register_sudo_host(void);
|
|
void skeletonkey_register_cifswitch(void);
|
|
void skeletonkey_register_nft_catchall(void);
|
|
|
|
/* Call every skeletonkey_register_<family>() above in canonical order.
|
|
* Single source of truth so the main binary and the test binary stay
|
|
* in sync — adding a new module is one register_* declaration here
|
|
* and one call inside skeletonkey_register_all_modules() in
|
|
* core/registry.c (the test harness picks it up automatically). */
|
|
void skeletonkey_register_all_modules(void);
|
|
|
|
#endif /* SKELETONKEY_REGISTRY_H */
|