KaraZajac
52e8c99022
- core/module.h: struct iamroot_module + iamroot_result_t
- core/registry.{h,c}: flat-array module registry with find-by-name
- modules/copy_fail_family/iamroot_modules.{h,c}: bridge layer
exposing 5 modules (copy_fail, copy_fail_gcm, dirty_frag_esp,
dirty_frag_esp6, dirty_frag_rxrpc) wired to the absorbed DIRTYFAIL
detect/exploit functions; df_result_t/iamroot_result_t share numeric
values intentionally for zero-cost translation
- iamroot.c: top-level CLI dispatcher with --scan / --list / --exploit /
--mitigate / --cleanup, JSON output, --i-know gate
- Restored modules/copy_fail_family/src/ structure (DIRTYFAIL Makefile
expects it; the initial flat copy broke that contract)
- Top-level Makefile builds one binary; filters out DIRTYFAIL's
original dirtyfail.c main so it doesn't conflict with iamroot.c
Verified end-to-end on kctf-mgr (Linux): clean compile, 5 modules
register, --scan --json output ingest-ready, exit codes propagate.
47 lines
1.7 KiB
C
47 lines
1.7 KiB
C
/*
|
|
* DIRTYFAIL — dirtyfrag_esp6.h
|
|
*
|
|
* IPv6 dual of the xfrm-ESP page-cache write (CVE-2026-43284).
|
|
*
|
|
* `esp6_input()` carries the same `if (!skb_has_frag_list(skb)) goto
|
|
* skip_cow` branch as `esp_input()`. The mainline patch
|
|
* f4c50a4034e62ab75f1d5cdd191dd5f9c77fdff4 covers BOTH v4 and v6,
|
|
* but some distro backports may have shipped only the v4 fix —
|
|
* particularly when they cherry-picked the ipv4 patch in isolation.
|
|
*
|
|
* A vulnerable system in the wild may therefore be:
|
|
* - patched on v4, vulnerable on v6
|
|
* - patched on v6, vulnerable on v4
|
|
* - vulnerable on both
|
|
*
|
|
* This module is the v6 detector + exploit. Differences from the v4
|
|
* path:
|
|
* - AF_INET6 sockets, ::1 source/dest, sockaddr_in6
|
|
* - XFRM SA registered with family=AF_INET6 and 16-byte addresses
|
|
* - ESP packet padded to >= 48 bytes total to clear the
|
|
* `xfrm6_input.c` size gate (which v4 does not have)
|
|
*/
|
|
|
|
#ifndef DIRTYFAIL_DIRTYFRAG_ESP6_H
|
|
#define DIRTYFAIL_DIRTYFRAG_ESP6_H
|
|
|
|
#include "common.h"
|
|
|
|
df_result_t dirtyfrag_esp6_detect(void);
|
|
|
|
/* OUTER (init ns): prompts → fork → wait → verify → su.
|
|
* INNER (bypass userns): SA reg + trigger only. */
|
|
df_result_t dirtyfrag_esp6_exploit(bool do_shell);
|
|
df_result_t dirtyfrag_esp6_exploit_inner(void);
|
|
|
|
/* Active probe: fires the v6 ESP-in-UDP trigger against a /tmp sentinel
|
|
* file (never /etc/passwd) and reports whether the marker landed.
|
|
* Used by `--scan --active`. Returns DF_VULNERABLE on marker hit, DF_OK
|
|
* if the kernel is patched (no STORE), DF_PRECOND_FAIL if AA-blocked.
|
|
* The inner half runs in the bypass userns and reads
|
|
* DIRTYFAIL_PROBE_SENTINEL for the target path. */
|
|
df_result_t dirtyfrag_esp6_active_probe(void);
|
|
df_result_t dirtyfrag_esp6_active_probe_inner(void);
|
|
|
|
#endif
|