0 Releases 20 Tags

RSS Feed

• v0.9.1 8ac041a295

  Compare

  release v0.9.1: VM verification sweep 22 → 27

  leviathan released this 2026-05-24 03:35:02 +00:00 | 4 commits to main since this release

  Five more CVEs empirically confirmed end-to-end against real Linux VMs:

  • CVE-2019-14287 sudo_runas_neg1 (Ubuntu 18.04 + sudoers grant)
  • CVE-2020-29661 tioscpgrp (Ubuntu 20.04 pinned to 5.4.0-26)
  • CVE-2024-26581 nft_pipapo (Ubuntu 22.04 + mainline 5.15.5)
  • CVE-2025-32463 sudo_chwoot (Ubuntu 22.04 + sudo 1.9.16p1 from source)
  • CVE-2025-6019 udisks_libblockdev (Debian 12 + udisks2 + polkit rule)

  Required real plumbing work:

  • Per-module provisioner hook (tools/verify-vm/provisioners/.sh)
  • Two-phase provision in verify.sh (prep → reboot if needed → verify)
    fixes silent-fail where new kernel installed but VM never rebooted
  • GRUB_DEFAULT pinning in both pin-kernel and pin-mainline blocks
    (kernel downgrades like 5.4.0-169 → 5.4.0-26 now actually boot the target)
  • Old-mainline URL fallback in pin-mainline (≤ 4.15 debs at /v$KVER/ not /amd64/)

  mutagen_astronomy marked manual: true — mainline 4.14.70 kernel-panics on
  Ubuntu 18.04's rootfs ('Failed to execute /init (error -8)' — kernel config
  mismatch). Genuinely needs a CentOS 6 / Debian 7 image.

  Downloads

  • Source Code (ZIP)
  • Source Code (TAR.GZ)