KaraZajac
95589e26cb
release / build (arm64) (push) Waiting to run
release / build (x86_64) (push) Waiting to run
release / build (x86_64-static / musl) (push) Waiting to run
release / build (arm64-static / musl) (push) Waiting to run
release / release (push) Blocked by required conditions
Jaeyoung Chung's kernelCTF "Bad Epoll": a race-condition use-after-free in fs/eventpoll.c. ep_remove() clears file->f_ep under f_lock but keeps using the file (hlist_del_rcu + unlock) while a concurrent __fput() frees the still-referenced struct eventpoll. Reachable by any unprivileged user with no userns / CONFIG / capability; weaponised via cross-cache to a struct file, /proc/self/fdinfo arb-read, and ROP. Introduced 58c9b016e128 (6.4), fixed a6dc643c6931 (7.1-rc1), stable backport 7.0.13. CWE-416; not in KEV. The corpus's first epoll / VFS-teardown module. Shipped as a reconstructed, deliberately under-driven trigger on the stackrot / nft_catchall contract: detect() is a pure version gate (>= 6.4 and below the on-branch fix; no userns precondition -- epoll needs none); exploit() forks a CPU-pinned child that exercises the ep_remove-vs-__fput close window a hard-bounded 48 attempts / 2s and returns EXPLOIT_FAIL. It does not grind the race to a win, does not do the cross-cache reclaim, and does not bundle the fdinfo R/W + ROP (a won race frees a live struct file and rarely trips KASAN -> silent-corruption risk). Wired: registry, Makefile, safety rank (12 -- lowest in the corpus; a kernel race is the least predictable class), 5 detect() test rows (version gating), CVE metadata (sorted insert, CWE-416 / T1068 / not-KEV), README + CVES.md + website counts (44/39), RELEASE_NOTES v0.9.12, and a verify-vm target (sweep pending). Detection rules are intentionally weak/structural (epoll ubiquitous, rarely KASAN) -- post-exploitation euid-0 transition, no yara. Also corrects pre-existing README drift in the "not yet verified" count (8 -> 11). Not VM-verified, so the verified count stays 28 of 39. Version 0.9.12. Credit: Jaeyoung Chung (J-jaeyoung). Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01KUq4DGXSPBmPkAyJ9WnM9n
72 lines
2.9 KiB
C
72 lines
2.9 KiB
C
/*
|
|
* SKELETONKEY — module registry
|
|
*
|
|
* Global list of registered modules. Each family contributes via
|
|
* register_<family>_modules() called from skeletonkey main() at startup.
|
|
*/
|
|
|
|
#ifndef SKELETONKEY_REGISTRY_H
|
|
#define SKELETONKEY_REGISTRY_H
|
|
|
|
#include "module.h"
|
|
|
|
void skeletonkey_register(const struct skeletonkey_module *m);
|
|
|
|
size_t skeletonkey_module_count(void);
|
|
const struct skeletonkey_module *skeletonkey_module_at(size_t i);
|
|
|
|
/* Find a module by name. Returns NULL if not found. */
|
|
const struct skeletonkey_module *skeletonkey_module_find(const char *name);
|
|
|
|
/* Each module family declares one of these in its public header. The
|
|
* top-level skeletonkey main() calls them in order at startup. */
|
|
void skeletonkey_register_copy_fail_family(void);
|
|
void skeletonkey_register_dirty_pipe(void);
|
|
void skeletonkey_register_entrybleed(void);
|
|
void skeletonkey_register_pwnkit(void);
|
|
void skeletonkey_register_nf_tables(void);
|
|
void skeletonkey_register_overlayfs(void);
|
|
void skeletonkey_register_cls_route4(void);
|
|
void skeletonkey_register_dirty_cow(void);
|
|
void skeletonkey_register_ptrace_traceme(void);
|
|
void skeletonkey_register_netfilter_xtcompat(void);
|
|
void skeletonkey_register_af_packet(void);
|
|
void skeletonkey_register_fuse_legacy(void);
|
|
void skeletonkey_register_stackrot(void);
|
|
void skeletonkey_register_af_packet2(void);
|
|
void skeletonkey_register_cgroup_release_agent(void);
|
|
void skeletonkey_register_overlayfs_setuid(void);
|
|
void skeletonkey_register_nft_set_uaf(void);
|
|
void skeletonkey_register_af_unix_gc(void);
|
|
void skeletonkey_register_nft_fwd_dup(void);
|
|
void skeletonkey_register_nft_payload(void);
|
|
void skeletonkey_register_sudo_samedit(void);
|
|
void skeletonkey_register_sequoia(void);
|
|
void skeletonkey_register_sudoedit_editor(void);
|
|
void skeletonkey_register_vmwgfx(void);
|
|
void skeletonkey_register_dirtydecrypt(void);
|
|
void skeletonkey_register_fragnesia(void);
|
|
void skeletonkey_register_pack2theroot(void);
|
|
void skeletonkey_register_sudo_chwoot(void);
|
|
void skeletonkey_register_udisks_libblockdev(void);
|
|
void skeletonkey_register_pintheft(void);
|
|
void skeletonkey_register_mutagen_astronomy(void);
|
|
void skeletonkey_register_sudo_runas_neg1(void);
|
|
void skeletonkey_register_tioscpgrp(void);
|
|
void skeletonkey_register_vsock_uaf(void);
|
|
void skeletonkey_register_nft_pipapo(void);
|
|
void skeletonkey_register_ptrace_pidfd(void);
|
|
void skeletonkey_register_sudo_host(void);
|
|
void skeletonkey_register_cifswitch(void);
|
|
void skeletonkey_register_nft_catchall(void);
|
|
void skeletonkey_register_bad_epoll(void);
|
|
|
|
/* Call every skeletonkey_register_<family>() above in canonical order.
|
|
* Single source of truth so the main binary and the test binary stay
|
|
* in sync — adding a new module is one register_* declaration here
|
|
* and one call inside skeletonkey_register_all_modules() in
|
|
* core/registry.c (the test harness picks it up automatically). */
|
|
void skeletonkey_register_all_modules(void);
|
|
|
|
#endif /* SKELETONKEY_REGISTRY_H */
|