KaraZajac
bd63aabd64
New module for Qualys's 2026-05-20 disclosure: a __ptrace_may_access logic flaw leaves a process dropping privileges briefly reachable past its dumpable boundary; pidfd_getfd(2) steals root-opened fds / authenticated channels from it. Default-distro, no userns, arch-agnostic (fd-steal, no shellcode). detect(): version-pinned, predates-gate at pidfd_getfd's 5.6 introduction; kernel_range from Debian backports (5.10.251/6.1.172/6.12.88/7.0.7), drift-check clean. exploit(): spawns a setuid victim, pidfd_open()s it, sweeps pidfd_getfd() over its fd table during the cred-drop window, reports any uid-0-owned fd captured from a non-root context. Honest EXPLOIT_FAIL without a euid-0 witness; not yet VM-verified. mitigate(): yama ptrace_scope=2; cleanup() reverts. auditd/sigma/falco rules, NOTICE.md (Qualys TRU credit) + MODULE.md, safety rank 84. Wiring: registry, Makefile, cve_metadata (+JSON source), verify-vm/targets.yaml (ubuntu2204 + mainline 5.15.5 target, sweep pending). Docs: README + CVES.md + docs/index.html counts 39->40 modules / 34->35 CVEs; added to not-yet-verified lists + corpus pill.
54 lines
2.1 KiB
Markdown
54 lines
2.1 KiB
Markdown
# ptrace_pidfd — CVE-2026-46333
|
|
|
|
`__ptrace_may_access()` dumpable-race credential-descriptor theft via
|
|
`pidfd_getfd(2)`.
|
|
|
|
## The bug
|
|
|
|
When a privileged process drops its credentials, the kernel resets its
|
|
`dumpable` flag so that lower-privileged processes can no longer attach
|
|
to it. CVE-2026-46333 is a logic flaw in `__ptrace_may_access()`: there
|
|
is a narrow window during the credential drop in which the process is
|
|
*still reachable* through ptrace-family access checks even though its
|
|
`dumpable` state should already have closed that path.
|
|
|
|
`pidfd_getfd(2)` performs a `PTRACE_MODE_ATTACH_REALCREDS` access check
|
|
before duplicating a descriptor out of the target process. During the
|
|
stale window that check wrongly succeeds, so an unprivileged process can
|
|
pull descriptors — a root-opened credential file, or an authenticated
|
|
D-Bus / socket channel — out of a transiently-privileged process and
|
|
re-use them under its own uid.
|
|
|
|
## Affected range
|
|
|
|
| | |
|
|
|---|---|
|
|
| Flaw introduced | v4.10-rc1 (Nov 2016) in `__ptrace_may_access` |
|
|
| Exploit vector added | `pidfd_getfd(2)` in v5.6 (Jan 2020) |
|
|
| Fixed upstream | mainline, 2026-05-14 |
|
|
| Debian backports | 5.10.251 · 6.1.172 · 6.12.88 · 7.0.7 |
|
|
|
|
Branches Debian does not ship (5.15 / 6.6 / 6.18 / 6.19) are reported on
|
|
the version-only verdict; run `--exploit ptrace_pidfd --i-know` to fire
|
|
the real primitive and confirm empirically.
|
|
|
|
## Trigger / detection
|
|
|
|
`detect()` consults the shared host fingerprint, returns `OK` below 5.6
|
|
(no vector) or for patched branches, otherwise `VULNERABLE`. No active
|
|
probe — the empirical confirmation lives in the exploit path, which
|
|
spawns a setuid victim and sweeps `pidfd_getfd()` over its descriptor
|
|
table, reporting any uid-0-owned descriptor captured from a non-root
|
|
context.
|
|
|
|
## Fix / mitigation
|
|
|
|
Upgrade the kernel. As a runtime stopgap, `kernel.yama.ptrace_scope=2`
|
|
(or `3`) closes the `pidfd_getfd` path because it gates the same
|
|
`__ptrace_may_access(ATTACH)` check; `--mitigate` applies it and
|
|
`--cleanup` reverts it.
|
|
|
|
## Credit
|
|
|
|
Qualys Threat Research Unit (2026-05-20). See `NOTICE.md`.
|