pintheft: drop --full-chain stub (calls undefined finisher symbol)
release / build (arm64) (push) Waiting to run
release / build (x86_64) (push) Waiting to run
release / build (x86_64-static / musl) (push) Waiting to run
release / build (arm64-static / musl) (push) Waiting to run
release / release (push) Blocked by required conditions
release / build (arm64) (push) Waiting to run
release / build (x86_64) (push) Waiting to run
release / build (x86_64-static / musl) (push) Waiting to run
release / build (arm64-static / musl) (push) Waiting to run
release / release (push) Blocked by required conditions
The x86_64 path called finisher_modprobe_path_overwrite() which doesn't exist — the real API is skeletonkey_finisher_modprobe_path() with a callback signature. arm64 builds dodged it via the #if guard; x86_64 linker rightly choked. Same fix as tioscpgrp/vsock_uaf/nft_pipapo: primitive-only modules return EXPLOIT_FAIL honestly per verified-vs- claimed.
This commit is contained in:
@@ -344,31 +344,15 @@ static skeletonkey_result_t pintheft_exploit(const struct skeletonkey_ctx *ctx)
|
|||||||
|
|
||||||
fprintf(stderr, "[+] pintheft: primitive fired %d/256 — page refcount delta witnessed\n", leaked);
|
fprintf(stderr, "[+] pintheft: primitive fired %d/256 — page refcount delta witnessed\n", leaked);
|
||||||
|
|
||||||
/* The cred-overwrite step requires the V12 PoC's io_uring chain.
|
/* The cred-overwrite step requires the V12 PoC's io_uring chain
|
||||||
* We don't ship the full chain here yet. If --full-chain is set
|
* (fixed buffer + page-cache write into the SUID carrier). We don't
|
||||||
* AND we're on x86_64 AND the finisher table has resolved kernel
|
* ship that chain — primitive only. Return EXPLOIT_FAIL honestly per
|
||||||
* offsets, fall through to the shared modprobe_path finisher;
|
* the verified-vs-claimed bar. See V12's PoC for the full payload:
|
||||||
* otherwise return EXPLOIT_FAIL honestly. */
|
* https://github.com/v12-security/pocs/tree/main/pintheft */
|
||||||
if (!ctx->full_chain) {
|
(void)ctx;
|
||||||
fprintf(stderr,
|
|
||||||
"[i] pintheft: primitive complete. The cred-overwrite step\n"
|
|
||||||
" (io_uring fixed buffer + page-cache write into the SUID\n"
|
|
||||||
" carrier) is x86_64-only and needs the V12 chain. Re-run\n"
|
|
||||||
" with --full-chain to invoke the shared modprobe_path\n"
|
|
||||||
" finisher. See V12's PoC for the full payload:\n"
|
|
||||||
" https://github.com/v12-security/pocs/tree/main/pintheft\n");
|
|
||||||
return SKELETONKEY_EXPLOIT_FAIL;
|
return SKELETONKEY_EXPLOIT_FAIL;
|
||||||
}
|
}
|
||||||
|
|
||||||
#if defined(__x86_64__)
|
|
||||||
fprintf(stderr, "[+] pintheft: --full-chain on x86_64 → invoking modprobe_path finisher\n");
|
|
||||||
return finisher_modprobe_path_overwrite(ctx);
|
|
||||||
#else
|
|
||||||
fprintf(stderr, "[-] pintheft: --full-chain unsupported on non-x86_64 (V12 PoC is x86-only)\n");
|
|
||||||
return SKELETONKEY_EXPLOIT_FAIL;
|
|
||||||
#endif
|
|
||||||
}
|
|
||||||
|
|
||||||
#else /* !__linux__ */
|
#else /* !__linux__ */
|
||||||
|
|
||||||
static skeletonkey_result_t pintheft_exploit(const struct skeletonkey_ctx *ctx)
|
static skeletonkey_result_t pintheft_exploit(const struct skeletonkey_ctx *ctx)
|
||||||
|
|||||||
Reference in New Issue
Block a user