leviathan
f03efbff13
- modules/entrybleed_cve_2023_0458/ (promoted out of _stubs):
- iamroot_modules.{c,h}: full EntryBleed primitive (rdtsc_start/end
+ prefetchnta + KASLR-slot timing sweep) wired into the standard
iamroot_module interface. x86_64 only; ARM/other gracefully
return IAMROOT_PRECOND_FAIL.
- detect(): reads /sys/.../vulnerabilities/meltdown to decide
KPTI status. Mitigation: PTI → VULNERABLE. Not affected → OK.
- exploit(): sweeps the 16MiB KASLR range, prints leaked kbase
(and KASLR slide). JSON-mode emits {"kbase":"0x..."} to stdout.
- entrybleed_leak_kbase_lib(off) declared as a public library
helper so future LPE chains needing a stage-1 leak can just
#include the module's header and call it.
- entry_SYSCALL_64 slot offset overridable via
IAMROOT_ENTRYBLEED_OFFSET (default 0x5600000 for lts-6.12.x).
- __always_inline fallback added since glibc/Linux-kernel macro
isn't universal; module now builds clean under macOS clangd lint
and on musl.
- iamroot.c registers entrybleed alongside the other families;
Makefile gains it as a separate object set.
Verified end-to-end on kctf-mgr (Debian 6.12.86):
iamroot --exploit entrybleed --i-know
→ [+] entrybleed: leaked kbase = 0xffffffff8d800000
This is the FIRST WORKING-EXPLOIT module in IAMROOT (5
copy_fail_family modules wrap existing code from DIRTYFAIL;
dirty_pipe is detect-only). EntryBleed is x86_64 stage-1 brick
that future chains can compose.
21 lines
682 B
C
21 lines
682 B
C
/*
|
|
* entrybleed_cve_2023_0458 — IAMROOT module registry hook
|
|
*/
|
|
|
|
#ifndef ENTRYBLEED_IAMROOT_MODULES_H
|
|
#define ENTRYBLEED_IAMROOT_MODULES_H
|
|
|
|
#include "../../core/module.h"
|
|
|
|
extern const struct iamroot_module entrybleed_module;
|
|
|
|
/* Library entry point for other modules that need a kbase leak.
|
|
* Returns the leaked kernel _text base on success, or 0 on failure
|
|
* (x86_64 only; ARM and other arches return 0). The optional
|
|
* `entry_syscall_slot_offset` is the offset from kbase to
|
|
* entry_SYSCALL_64's 2MiB-aligned slot. Pass 0 for a kernel-default
|
|
* (lts-6.12.x-style; ~0x5600000). */
|
|
unsigned long entrybleed_leak_kbase_lib(unsigned long entry_syscall_slot_offset);
|
|
|
|
#endif
|