pack2theroot (CVE-2026-41651) + --auto accuracy work
Adds the third ported module — Pack2TheRoot, a userspace PackageKit
D-Bus TOCTOU LPE — and spends real effort hardening --auto so its
detect step gives an accurate, robust verdict before deploying.
pack2theroot (CVE-2026-41651):
- Ported from the public Vozec PoC
(github.com/Vozec/CVE-2026-41651). Original disclosure by the
Deutsche Telekom security team.
- Two back-to-back InstallFiles D-Bus calls (SIMULATE then NONE)
overwrite the cached transaction flags between polkit auth and
dispatch. GLib priority ordering makes the overwrite deterministic,
not a timing race; postinst of the malicious .deb drops a SUID bash
in /tmp.
- detect() reads PackageKit's VersionMajor/Minor/Micro directly over
D-Bus and compares against the pinned fix release 1.3.5 (commit
76cfb675). This is a high-confidence verdict, not precondition-only.
- Debian-family only (PoC builds its own .deb in pure C; ar/ustar/
gzip-stored inline). Cleanup removes /tmp .debs + best-effort
unlinks /tmp/.suid_bash + sudo -n dpkg -r the staging packages.
- Adds an optional GLib/GIO build dependency. The top-level Makefile
autodetects via `pkg-config gio-2.0`; when absent the module
compiles as a stub returning PRECOND_FAIL.
- Embedded auditd + sigma rules cover the file-side footprint
(/tmp/.suid_bash, /tmp/.pk-*.deb, non-root dpkg/apt execve).
--auto accuracy improvements:
- Auto-enables --active before the scan. Per-module sentinel probes
(page-cache /tmp files, fork-isolated namespace mounts) turn
version-only checks into definitive verdicts, so silent distro
backports don't fool the scan and --auto won't pick blind on
TEST_ERROR.
- Per-module verdict printing — every module's result is shown
(VULNERABLE / patched / precondition / indeterminate), not just
VULNERABLE rows. Operator sees the full picture.
- Scan-end summary line: "N vulnerable, M patched/n.a., K
precondition-fail, L indeterminate" with a separate callout when
modules crashed.
- Distro fingerprint added to the auto banner (ID + VERSION_ID from
/etc/os-release alongside kernel/arch).
- Fork-isolated detect() — each detector runs in a child process so
a SIGILL/SIGSEGV in one module's probe is contained and the scan
continues. Surfaced live while testing: entrybleed's prefetchnta
KASLR sweep SIGILLs on emulated CPUs (linuxkit on darwin); without
isolation the whole --auto died at module 7 of 31. With isolation
the scan reports "detect() crashed (signal 4) — continuing" and
finishes cleanly.
module_safety_rank additions:
- pack2theroot: 95 (userspace D-Bus TOCTOU; dpkg + /tmp SUID footprint
— clean but heavier than pwnkit's gconv-modules-only path).
- dirtydecrypt / fragnesia: 86 (page-cache writes; one step below the
verified copy_fail/dirty_frag family at 88 to prefer verified
modules when both apply).
Docs:
- README badge / tagline / tier table / ⚪ block / example output /
v0.5.0 status — all updated to "28 verified + 3 ported".
- CVES.md counts line, the ported-modules note (now calling out
pack2theroot's high-confidence detect vs. precondition-only for
the page-cache pair), inventory row, operations table row.
- ROADMAP Phase 7+: pack2theroot moved out of carry-overs into the
"landed (ported, pending VM verification)" group; added a new
"--auto accuracy work" subsection documenting the dispatcher
hardening landed in this commit.
- docs/index.html: scanning-count example bumped to 31, status line
updated to mention 3 ported modules.
Build verification: full `make clean && make` in `docker gcc:latest`
with libglib2.0-dev installed: links into a 31-module skeletonkey
ELF (413KB), `--list` shows all modules including pack2theroot,
`--detect-rules --format=auditd` emits the new pack2theroot section,
`--auto --i-know --no-shell` exercises the new banner + active
probes + verdict table + fork isolation + scan summary end-to-end.
Only build warning is the pre-existing
`-Wunterminated-string-initialization` in dirty_pipe (not introduced
here).
This commit is contained in:
@@ -0,0 +1,28 @@
|
||||
# Pack2TheRoot (CVE-2026-41651) — auditd detection rules
|
||||
#
|
||||
# PackageKit TOCTOU LPE: two back-to-back InstallFiles D-Bus calls
|
||||
# install a malicious .deb as root, whose postinst drops a SUID bash
|
||||
# in /tmp. The D-Bus traffic itself is not auditable without bus
|
||||
# monitoring (dbus-monitor / dbus-broker logs), so these rules cover
|
||||
# the file-side footprint.
|
||||
#
|
||||
# Install: copy into /etc/audit/rules.d/ and `augenrules --load`, or
|
||||
# skeletonkey --detect-rules --format=auditd | sudo tee \
|
||||
# /etc/audit/rules.d/99-skeletonkey.rules
|
||||
|
||||
# The exact SUID payload path the published PoC lands
|
||||
-w /tmp/.suid_bash -p wa -k skeletonkey-pack2theroot
|
||||
|
||||
# Any setuid bit set on /tmp/.suid_bash by anyone
|
||||
-a always,exit -F arch=b64 -S chmod,fchmod,fchmodat \
|
||||
-F path=/tmp/.suid_bash -k skeletonkey-pack2theroot-suid
|
||||
|
||||
# The PoC drops two .deb files in /tmp immediately before the install
|
||||
-a always,exit -F arch=b64 -S openat,creat \
|
||||
-F dir=/tmp -F success=1 -k skeletonkey-pack2theroot-deb
|
||||
|
||||
# packagekitd-driven dpkg/apt activity initiated by a non-root caller
|
||||
-a always,exit -F arch=b64 -S execve -F path=/usr/bin/dpkg \
|
||||
-F auid!=0 -k skeletonkey-pack2theroot-dpkg
|
||||
-a always,exit -F arch=b64 -S execve -F path=/usr/bin/apt-get \
|
||||
-F auid!=0 -k skeletonkey-pack2theroot-apt
|
||||
@@ -0,0 +1,32 @@
|
||||
title: Possible Pack2TheRoot exploitation (CVE-2026-41651)
|
||||
id: 3f2b8d54-skeletonkey-pack2theroot
|
||||
status: experimental
|
||||
description: |
|
||||
Detects the file-side footprint of Pack2TheRoot (CVE-2026-41651): a
|
||||
non-root user triggers PackageKit InstallFiles, dpkg runs a postinst
|
||||
that drops /tmp/.suid_bash (a setuid bash), and a privileged shell
|
||||
follows. The trigger itself is two back-to-back D-Bus calls with no
|
||||
polkit prompt — only visible via dbus-monitor or the file side
|
||||
effects flagged below.
|
||||
references:
|
||||
- https://github.security.telekom.com/2026/04/pack2theroot-linux-local-privilege-escalation.html
|
||||
- https://github.com/PackageKit/PackageKit/security/advisories/GHSA-f55j-vvr9-69xv
|
||||
- https://github.com/Vozec/CVE-2026-41651
|
||||
logsource:
|
||||
product: linux
|
||||
service: auditd
|
||||
detection:
|
||||
suid_drop:
|
||||
type: 'PATH'
|
||||
name|startswith:
|
||||
- '/tmp/.suid_bash'
|
||||
- '/tmp/.pk-payload-'
|
||||
- '/tmp/.pk-dummy-'
|
||||
not_root:
|
||||
auid|expression: '!= 0'
|
||||
condition: suid_drop and not_root
|
||||
level: high
|
||||
tags:
|
||||
- attack.privilege_escalation
|
||||
- attack.t1068
|
||||
- cve.2026.41651
|
||||
Reference in New Issue
Block a user