KaraZajac
bd63aabd64
New module for Qualys's 2026-05-20 disclosure: a __ptrace_may_access logic flaw leaves a process dropping privileges briefly reachable past its dumpable boundary; pidfd_getfd(2) steals root-opened fds / authenticated channels from it. Default-distro, no userns, arch-agnostic (fd-steal, no shellcode). detect(): version-pinned, predates-gate at pidfd_getfd's 5.6 introduction; kernel_range from Debian backports (5.10.251/6.1.172/6.12.88/7.0.7), drift-check clean. exploit(): spawns a setuid victim, pidfd_open()s it, sweeps pidfd_getfd() over its fd table during the cred-drop window, reports any uid-0-owned fd captured from a non-root context. Honest EXPLOIT_FAIL without a euid-0 witness; not yet VM-verified. mitigate(): yama ptrace_scope=2; cleanup() reverts. auditd/sigma/falco rules, NOTICE.md (Qualys TRU credit) + MODULE.md, safety rank 84. Wiring: registry, Makefile, cve_metadata (+JSON source), verify-vm/targets.yaml (ubuntu2204 + mainline 5.15.5 target, sweep pending). Docs: README + CVES.md + docs/index.html counts 39->40 modules / 34->35 CVEs; added to not-yet-verified lists + corpus pill.
52 lines
2.5 KiB
Markdown
52 lines
2.5 KiB
Markdown
# NOTICE — ptrace_pidfd (CVE-2026-46333)
|
|
|
|
## Vulnerability
|
|
|
|
**CVE-2026-46333** — a logic flaw in the Linux kernel's
|
|
`__ptrace_may_access()` path leaves a privileged process that is
|
|
*dropping* its credentials briefly reachable through ptrace-family
|
|
operations, even though its `dumpable` flag should already have closed
|
|
that path. Paired with `pidfd_getfd(2)`, an unprivileged local user can
|
|
capture open file descriptors and authenticated IPC channels from a
|
|
dying privileged process and re-use them under their own uid → local
|
|
root and credential disclosure.
|
|
|
|
The underlying flaw has resided in mainline since **v4.10-rc1**
|
|
(November 2016); the `pidfd_getfd(2)` exploitation vector was added in
|
|
**v5.6** (January 2020). Affects default installations of Debian 13,
|
|
Ubuntu 24.04 / 26.04, Fedora 43 / 44, SUSE, AlmaLinux, and CloudLinux.
|
|
|
|
## Research credit
|
|
|
|
Discovered and disclosed by **Qualys Threat Research Unit (TRU)**,
|
|
published 2026-05-20. The four proof-of-concept exploits demonstrated
|
|
by Qualys targeted `chage`, `ssh-keysign`, `pkexec`, and
|
|
`accounts-daemon`.
|
|
|
|
- Qualys advisory:
|
|
<https://blog.qualys.com/vulnerabilities-threat-research/2026/05/20/cve-2026-46333-local-root-privilege-escalation-and-credential-disclosure-in-the-linux-kernel-ptrace-path>
|
|
- Upstream fix: mainline, committed 2026-05-14.
|
|
- Debian-tracked stable backports: 5.10.251 (bullseye) / 6.1.172
|
|
(bookworm) / 6.12.88 (trixie) / 7.0.7 (forky, sid).
|
|
|
|
All research credit for finding and analysing this bug belongs to
|
|
Qualys. SKELETONKEY is the bundling and bookkeeping layer only.
|
|
|
|
## SKELETONKEY role
|
|
|
|
🟡 **Primitive / ported-from-disclosure — not yet VM-verified.**
|
|
`detect()` is version-pinned against the Debian backport thresholds
|
|
above (kernels < 5.6 are reported OK, lacking the bundled vector).
|
|
`exploit()` fires the real primitive: it spawns a setuid victim,
|
|
`pidfd_open()`s it, and sweeps `pidfd_getfd()` across its descriptor
|
|
table during the credential-drop window, recording whether a root-owned
|
|
descriptor is actually captured from a non-root context. It returns
|
|
`EXPLOIT_FAIL` unless it can witness euid 0 — the target-specific
|
|
fd-weaponization that lands a root shell is **not** bundled until it can
|
|
be verified end-to-end against a real vulnerable VM, in keeping with the
|
|
project's no-fabrication rule.
|
|
|
|
`--mitigate` sets `kernel.yama.ptrace_scope=2` (the check `pidfd_getfd`
|
|
rides); `--cleanup` restores it. Architecture-agnostic — the technique
|
|
steals descriptors rather than injecting shellcode.
|