leviathan
102b117d4e
Two famous 2017-2020-era LPEs to broaden 'THE tool for folks' coverage. Both detect-only initially; exploit ports as follow-ups. ptrace_traceme (CVE-2019-13272 — jannh @ Google P0, Jun 2019): - Famous because works on default-config systems with no user_ns required — locked-down environments were still vulnerable. - kernel_range thresholds: 4.4.182 / 4.9.182 / 4.14.131 / 4.19.58 / 5.0.20 / 5.1.17 / mainline 5.2+ - Exploit shape (deferred): fork → child PTRACE_TRACEME → parent execve setuid binary → child ptrace-injects shellcode → root. - Auditd: flag PTRACE_TRACEME (request 0) — false positives via gdb/strace; tune by exclusion. netfilter_xtcompat (CVE-2021-22555 — Andy Nguyen @ Google P0): - Bug existed since 2.6.19 (2006) — 15 years of latent vuln. Famous for that age + default-config reachability via unprivileged_userns. - kernel_range thresholds: 4.4.266 / 4.9.266 / 4.14.230 / 4.19.185 / 5.4.110 / 5.10.27 / 5.11.10 / mainline 5.12+ - detect() probes user_ns+net_ns clone; locked-down → PRECOND_FAIL. - Exploit shape (deferred): heap massage via msg_msg + sk_buff cross- cache groom → kernel R/W → cred or modprobe_path overwrite. ~400 lines port from Andy's public exploit.c. - Auditd: unshare + iptables-style setsockopt + msgsnd — combined, the canonical exploit footprint. Both wired into iamroot.c, core/registry.h, Makefile. CVES.md rows added with detailed status. Coverage by year now: 2016: dirty_cow 🟢 2019: ptrace_traceme 🔵 2021: pwnkit, overlayfs, netfilter_xtcompat 🟢/🟢/🔵 2022: dirty_pipe, cls_route4 🟢/🔵 2023: entrybleed 🟢 2024: nf_tables 🔵 2026: copy_fail family (×5) 🟢 Module count: 14. Build clean (no warnings).
35 lines
1.1 KiB
C
35 lines
1.1 KiB
C
/*
|
|
* IAMROOT — module registry
|
|
*
|
|
* Global list of registered modules. Each family contributes via
|
|
* register_<family>_modules() called from iamroot main() at startup.
|
|
*/
|
|
|
|
#ifndef IAMROOT_REGISTRY_H
|
|
#define IAMROOT_REGISTRY_H
|
|
|
|
#include "module.h"
|
|
|
|
void iamroot_register(const struct iamroot_module *m);
|
|
|
|
size_t iamroot_module_count(void);
|
|
const struct iamroot_module *iamroot_module_at(size_t i);
|
|
|
|
/* Find a module by name. Returns NULL if not found. */
|
|
const struct iamroot_module *iamroot_module_find(const char *name);
|
|
|
|
/* Each module family declares one of these in its public header. The
|
|
* top-level iamroot main() calls them in order at startup. */
|
|
void iamroot_register_copy_fail_family(void);
|
|
void iamroot_register_dirty_pipe(void);
|
|
void iamroot_register_entrybleed(void);
|
|
void iamroot_register_pwnkit(void);
|
|
void iamroot_register_nf_tables(void);
|
|
void iamroot_register_overlayfs(void);
|
|
void iamroot_register_cls_route4(void);
|
|
void iamroot_register_dirty_cow(void);
|
|
void iamroot_register_ptrace_traceme(void);
|
|
void iamroot_register_netfilter_xtcompat(void);
|
|
|
|
#endif /* IAMROOT_REGISTRY_H */
|