leviathan
9593d90385
Breaking change. Tool name, binary name, function/type names,
constant names, env vars, header guards, file paths, and GitHub
repo URL all rebrand IAMROOT → SKELETONKEY.
Changes:
- All "IAMROOT" → "SKELETONKEY" (constants, env vars, enum
values, docs, comments)
- All "iamroot" → "skeletonkey" (functions, types, paths, CLI)
- iamroot.c → skeletonkey.c
- modules/*/iamroot_modules.{c,h} → modules/*/skeletonkey_modules.{c,h}
- tools/iamroot-fleet-scan.sh → tools/skeletonkey-fleet-scan.sh
- Binary "iamroot" → "skeletonkey"
- GitHub URL KaraZajac/IAMROOT → KaraZajac/SKELETONKEY
- .gitignore now expects build output named "skeletonkey"
- /tmp/iamroot-* tmpfiles → /tmp/skeletonkey-*
- Env vars IAMROOT_MODPROBE_PATH etc. → SKELETONKEY_*
New ASCII skeleton-key banner (horizontal key icon + ANSI Shadow
SKELETONKEY block letters) replaces the IAMROOT banner in
skeletonkey.c and README.md.
VERSION: 0.3.1 → 0.4.0 (breaking).
Build clean on Debian 6.12.86. `skeletonkey --version` → 0.4.0.
All 24 modules still register; no functional code changes — pure
rename + banner refresh.
57 lines
1.9 KiB
Markdown
57 lines
1.9 KiB
Markdown
# EntryBleed — CVE-2023-0458
|
|
|
|
> ⚪ **PLANNED** stub module. See [`../../ROADMAP.md`](../../ROADMAP.md)
|
|
> Phase 3.
|
|
|
|
## Summary
|
|
|
|
KPTI's user-space-mapped entry trampoline is detectable via
|
|
`prefetchnta` timing, leaking the kernel base address (defeats
|
|
KASLR). Universal across modern x86_64 kernels with KPTI; only
|
|
partial mitigations have shipped upstream.
|
|
|
|
## Why this is here
|
|
|
|
EntryBleed is **not a standalone LPE**. It's a **stage-1 leak
|
|
primitive** that future LPE modules can call when they need a kbase.
|
|
Bundling it as a module:
|
|
|
|
1. Lets other modules `#include "core/entrybleed.h"` and call
|
|
`entrybleed_leak_kbase()` when they need KASLR defeat
|
|
2. Ships defensive detection rules for prefetchnta-timing-attack
|
|
patterns (useful for hardened environments)
|
|
3. Documents the technique with a clear writeup so users
|
|
understand what "stage-1" means in the broader chain
|
|
|
|
## Empirical status on recent kernels
|
|
|
|
Verified 2026-05-16: works 5/5 on lts-6.12.88 (no anti-EntryBleed
|
|
mitigation configured). See
|
|
`security-research/findings/audit_io_uring_2026-05-16_poc_attempt.md`
|
|
and the EntryBleed test code at
|
|
`SKYFALL/bugs/leak_write_modprobe_2026-05-16/exploit.c` lines ~73-150.
|
|
|
|
## Upstream patches
|
|
|
|
There is no single canonical patch. Partial mitigations include:
|
|
- `CONFIG_RANDOMIZE_KSTACK_OFFSET` (per-syscall kernel stack jitter)
|
|
- Some KPTI hardening discussions on lkml, no merged fix as of
|
|
lts-6.12.88
|
|
- The community position remains that "KASLR is best-effort,
|
|
not a security boundary"
|
|
|
|
## Implementation plan
|
|
|
|
- Lift the proven EntryBleed code from
|
|
`SKYFALL/bugs/leak_write_modprobe_2026-05-16/exploit.c` into
|
|
`module.c` here
|
|
- Expose as both a CLI mode (`skeletonkey --leak-kbase`) and as a
|
|
library helper (`uint64_t entrybleed_leak_kbase(void)`)
|
|
- Detection rules: timing-attack pattern flags, perf-counter
|
|
anomaly detection (informational — these are hard to make precise
|
|
without false positives)
|
|
|
|
## Not started yet
|
|
|
|
Phase 3.
|