KaraZajac
95589e26cb
release / build (arm64) (push) Waiting to run
release / build (x86_64) (push) Waiting to run
release / build (x86_64-static / musl) (push) Waiting to run
release / build (arm64-static / musl) (push) Waiting to run
release / release (push) Blocked by required conditions
Jaeyoung Chung's kernelCTF "Bad Epoll": a race-condition use-after-free in fs/eventpoll.c. ep_remove() clears file->f_ep under f_lock but keeps using the file (hlist_del_rcu + unlock) while a concurrent __fput() frees the still-referenced struct eventpoll. Reachable by any unprivileged user with no userns / CONFIG / capability; weaponised via cross-cache to a struct file, /proc/self/fdinfo arb-read, and ROP. Introduced 58c9b016e128 (6.4), fixed a6dc643c6931 (7.1-rc1), stable backport 7.0.13. CWE-416; not in KEV. The corpus's first epoll / VFS-teardown module. Shipped as a reconstructed, deliberately under-driven trigger on the stackrot / nft_catchall contract: detect() is a pure version gate (>= 6.4 and below the on-branch fix; no userns precondition -- epoll needs none); exploit() forks a CPU-pinned child that exercises the ep_remove-vs-__fput close window a hard-bounded 48 attempts / 2s and returns EXPLOIT_FAIL. It does not grind the race to a win, does not do the cross-cache reclaim, and does not bundle the fdinfo R/W + ROP (a won race frees a live struct file and rarely trips KASAN -> silent-corruption risk). Wired: registry, Makefile, safety rank (12 -- lowest in the corpus; a kernel race is the least predictable class), 5 detect() test rows (version gating), CVE metadata (sorted insert, CWE-416 / T1068 / not-KEV), README + CVES.md + website counts (44/39), RELEASE_NOTES v0.9.12, and a verify-vm target (sweep pending). Detection rules are intentionally weak/structural (epoll ubiquitous, rarely KASAN) -- post-exploitation euid-0 transition, no yara. Also corrects pre-existing README drift in the "not yet verified" count (8 -> 11). Not VM-verified, so the verified count stays 28 of 39. Version 0.9.12. Credit: Jaeyoung Chung (J-jaeyoung). Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01KUq4DGXSPBmPkAyJ9WnM9n
61 lines
3.0 KiB
Markdown
61 lines
3.0 KiB
Markdown
# CISA KEV Cross-Reference
|
|
|
|
Which SKELETONKEY modules cover CVEs that CISA has observed exploited
|
|
in the wild per the Known Exploited Vulnerabilities catalog.
|
|
Refreshed via `tools/refresh-cve-metadata.py`.
|
|
|
|
**13 of 39 modules cover KEV-listed CVEs.**
|
|
|
|
## In KEV (prioritize patching)
|
|
|
|
| CVE | Date added to KEV | CWE | Module |
|
|
| --- | --- | --- | --- |
|
|
| CVE-2019-13272 | 2021-12-10 | ? | `ptrace_traceme_cve_2019_13272` |
|
|
| CVE-2016-5195 | 2022-03-03 | CWE-362 | `dirty_cow_cve_2016_5195` |
|
|
| CVE-2021-3156 | 2022-04-06 | CWE-193 | `sudo_samedit_cve_2021_3156` |
|
|
| CVE-2022-0847 | 2022-04-25 | CWE-665 | `dirty_pipe_cve_2022_0847` |
|
|
| CVE-2021-4034 | 2022-06-27 | CWE-787 | `pwnkit_cve_2021_4034` |
|
|
| CVE-2021-3493 | 2022-10-20 | CWE-270 | `overlayfs_cve_2021_3493` |
|
|
| CVE-2024-1086 | 2024-05-30 | CWE-416 | `nf_tables_cve_2024_1086` |
|
|
| CVE-2022-0185 | 2024-08-21 | CWE-190 | `fuse_legacy_cve_2022_0185` |
|
|
| CVE-2023-0386 | 2025-06-17 | CWE-282 | `overlayfs_setuid_cve_2023_0386` |
|
|
| CVE-2025-32463 | 2025-09-29 | CWE-829 | `sudo_chwoot_cve_2025_32463` |
|
|
| CVE-2021-22555 | 2025-10-06 | CWE-787 | `netfilter_xtcompat_cve_2021_22555` |
|
|
| CVE-2018-14634 | 2026-01-26 | CWE-190 | `mutagen_astronomy_cve_2018_14634` |
|
|
| CVE-2022-0492 | 2026-06-02 | CWE-287 | `cgroup_release_agent_cve_2022_0492` |
|
|
|
|
## Not in KEV
|
|
|
|
Not observed exploited per CISA — but several have public PoC code
|
|
and are technically reachable. "Not in KEV" is not the same as
|
|
"safe to ignore".
|
|
|
|
| CVE | CWE | Module |
|
|
| --- | --- | --- |
|
|
| CVE-2017-7308 | CWE-681 | `af_packet_cve_2017_7308` |
|
|
| CVE-2019-14287 | CWE-755 | `sudo_runas_neg1_cve_2019_14287` |
|
|
| CVE-2020-14386 | CWE-250 | `af_packet2_cve_2020_14386` |
|
|
| CVE-2020-29661 | CWE-416 | `tioscpgrp_cve_2020_29661` |
|
|
| CVE-2021-33909 | CWE-190 | `sequoia_cve_2021_33909` |
|
|
| CVE-2022-25636 | CWE-269 | `nft_fwd_dup_cve_2022_25636` |
|
|
| CVE-2022-2588 | CWE-416 | `cls_route4_cve_2022_2588` |
|
|
| CVE-2023-0179 | CWE-190 | `nft_payload_cve_2023_0179` |
|
|
| CVE-2023-0458 | CWE-476 | `entrybleed_cve_2023_0458` |
|
|
| CVE-2023-2008 | CWE-129 | `vmwgfx_cve_2023_2008` |
|
|
| CVE-2023-22809 | CWE-269 | `sudoedit_editor_cve_2023_22809` |
|
|
| CVE-2023-32233 | CWE-416 | `nft_set_uaf_cve_2023_32233` |
|
|
| CVE-2023-3269 | CWE-416 | `stackrot_cve_2023_3269` |
|
|
| CVE-2023-4622 | CWE-416 | `af_unix_gc_cve_2023_4622` |
|
|
| CVE-2024-26581 | ? | `nft_pipapo_cve_2024_26581` |
|
|
| CVE-2024-50264 | CWE-416 | `vsock_uaf_cve_2024_50264` |
|
|
| CVE-2025-32462 | CWE-863 | `sudo_host_cve_2025_32462` |
|
|
| CVE-2025-6019 | CWE-250 | `udisks_libblockdev_cve_2025_6019` |
|
|
| CVE-2026-23111 | CWE-416 | `nft_catchall_cve_2026_23111` |
|
|
| CVE-2026-31635 | CWE-130 | `dirtydecrypt_cve_2026_31635` |
|
|
| CVE-2026-41651 | CWE-367 | `pack2theroot_cve_2026_41651` |
|
|
| CVE-2026-43494 | ? | `pintheft_cve_2026_43494` |
|
|
| CVE-2026-46242 | CWE-416 | `bad_epoll_cve_2026_46242` |
|
|
| CVE-2026-46243 | CWE-20 | `cifswitch_cve_2026_46243` |
|
|
| CVE-2026-46300 | CWE-787 | `fragnesia_cve_2026_46300` |
|
|
| CVE-2026-46333 | CWE-269 | `ptrace_pidfd_cve_2026_46333` |
|