KaraZajac
678a37b2f5
build / build (clang / debug) (push) Waiting to run
build / build (clang / default) (push) Waiting to run
build / build (gcc / debug) (push) Waiting to run
build / build (gcc / default) (push) Waiting to run
build / sanitizers (ASan + UBSan) (push) Waiting to run
build / clang-tidy (push) Waiting to run
build / drift-check (CISA KEV + Debian tracker) (push) Waiting to run
build / static-build (push) Waiting to run
Verified out-of-band on a genuinely pre-fix mainline 5.16.0 kernel (installed
from kernel.ubuntu.com onto the jammy image; every cached cloud image was
pre-5.8 or backport-patched). `skeletonkey --exploit dirty_pipe` (uid 1000) ->
EXPLOIT_OK + a -rwsr-xr-x root:root bash, and /etc/passwd is byte-identical
afterward.
Three real bugs in the shipped module:
1. Wrong escalation: it flipped the CALLER's UID field to "0000" and ran
`su <self>`, which still demands the caller's password -> never rooted
anything.
2. False EXPLOIT_OK: it execlp'd su, so the dispatcher's "exec transferred ->
clean exit = OK" path reported success even on su's auth failure.
3. Dangerous revert: revert_passwd_page_cache() used drop_caches, which needs
root -> as an unprivileged caller it left the running system's /etc/passwd
page cache corrupted (broke sshd user resolution in testing).
Rewrite (AabyssZG-style, self-contained + verifying):
- overwrite ROOT's password field with a known $6$ crypt hash via the Dirty
Pipe primitive (the longer hash clobbers into following lines, transiently);
- authenticate as root over a pty with the matching password (su reads the
password from the controlling tty, not stdin);
- plant a root-owned proof + setuid bash; judge success ONLY by stat()'ing the
root-owned artifact;
- revert the page cache by writing the saved original bytes back through the
Dirty Pipe primitive itself — no root, no drop_caches, nothing persists.
cleanup() re-reverts idempotently. Unit harness green (33 + 115).
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_0118iUgHY44hdRtANgyCmu7y