KaraZajac
4d0a0e2443
release / build (arm64) (push) Waiting to run
release / build (x86_64) (push) Waiting to run
release / build (x86_64-static / musl) (push) Waiting to run
release / build (arm64-static / musl) (push) Waiting to run
release / release (push) Blocked by required conditions
The newest nftables LPE: a use-after-free in the nf_tables transaction-
abort path. An inverted condition (a stray '!') in
nft_map_catchall_activate() makes the abort path process active catch-all
map elements instead of skipping them; a catch-all GOTO element drives a
chain's use-count to zero so a following DELCHAIN frees it while the
catch-all verdict still references it -> UAF, escalatable from an
unprivileged user (userns + nftables) via modprobe_path/selinux_state ROP.
Fixed upstream by f41c5d1; CWE-416, CVSS 7.8; not in CISA KEV. Public
reproduction by FuzzingLabs.
Takes the corpus to 43 modules / 38 CVEs.
🟡 reconstructed trigger, primitive-only, NOT VM-verified — same contract
as nf_tables (CVE-2024-1086). detect() version-gates (catch-all elems
~5.13; Debian backports 6.1.164/6.12.73/6.18.10, 7.0+ inherits) AND
requires unprivileged user_ns clone (else PRECOND_FAIL). exploit() forks
an isolated child, builds a verdict map with a catch-all GOTO element,
provokes an aborting batch to drive the abort-path UAF, observes slabinfo,
and returns EXPLOIT_FAIL — the per-kernel leak + R/W + modprobe_path ROP
is not bundled. kernel_range table verified drift-clean against the live
Debian tracker (the 6.18 branch / 6.18.10 fix is the real forky/sid
backport; the earlier 7.0.10 figure was wrong).
Wired: registry, Makefile, safety rank (35), 6 detect() test rows (version
+ userns gating), CVE_METADATA.json + cve_metadata.c + KEV_CROSSREF.md
(sorted insert, CWE-416/T1068/not-KEV), README + CVES.md + website counts
(43/38) + yellow pill, RELEASE_NOTES v0.9.11, verify-vm target. Credit:
FuzzingLabs + upstream fix f41c5d1. Version 0.9.11.
59 lines
2.2 KiB
C
59 lines
2.2 KiB
C
/*
|
|
* SKELETONKEY — canonical "register every module family" enumeration.
|
|
*
|
|
* Kept in its own translation unit so registry.c stays standalone:
|
|
* the kernel_range unit-test binary links registry.c (for the basic
|
|
* register / count / find API) without pulling in every module's
|
|
* symbol. The main binary and detect-integration test link this
|
|
* file too and get the full lineup.
|
|
*
|
|
* Adding a new module is one new register_<family>() declaration in
|
|
* registry.h plus one call below — the integration test picks it up
|
|
* via skeletonkey_register_all_modules() in its main().
|
|
*/
|
|
|
|
#include "registry.h"
|
|
|
|
void skeletonkey_register_all_modules(void)
|
|
{
|
|
skeletonkey_register_copy_fail_family();
|
|
skeletonkey_register_dirty_pipe();
|
|
skeletonkey_register_entrybleed();
|
|
skeletonkey_register_pwnkit();
|
|
skeletonkey_register_nf_tables();
|
|
skeletonkey_register_overlayfs();
|
|
skeletonkey_register_cls_route4();
|
|
skeletonkey_register_dirty_cow();
|
|
skeletonkey_register_ptrace_traceme();
|
|
skeletonkey_register_netfilter_xtcompat();
|
|
skeletonkey_register_af_packet();
|
|
skeletonkey_register_fuse_legacy();
|
|
skeletonkey_register_stackrot();
|
|
skeletonkey_register_af_packet2();
|
|
skeletonkey_register_cgroup_release_agent();
|
|
skeletonkey_register_overlayfs_setuid();
|
|
skeletonkey_register_nft_set_uaf();
|
|
skeletonkey_register_af_unix_gc();
|
|
skeletonkey_register_nft_fwd_dup();
|
|
skeletonkey_register_nft_payload();
|
|
skeletonkey_register_sudo_samedit();
|
|
skeletonkey_register_sequoia();
|
|
skeletonkey_register_sudoedit_editor();
|
|
skeletonkey_register_vmwgfx();
|
|
skeletonkey_register_dirtydecrypt();
|
|
skeletonkey_register_fragnesia();
|
|
skeletonkey_register_pack2theroot();
|
|
skeletonkey_register_sudo_chwoot();
|
|
skeletonkey_register_udisks_libblockdev();
|
|
skeletonkey_register_pintheft();
|
|
skeletonkey_register_mutagen_astronomy();
|
|
skeletonkey_register_sudo_runas_neg1();
|
|
skeletonkey_register_tioscpgrp();
|
|
skeletonkey_register_vsock_uaf();
|
|
skeletonkey_register_nft_pipapo();
|
|
skeletonkey_register_ptrace_pidfd();
|
|
skeletonkey_register_sudo_host();
|
|
skeletonkey_register_cifswitch();
|
|
skeletonkey_register_nft_catchall();
|
|
}
|