leviathan
48d5f15828
Sweep results across 3 phases:
Phase 1 (no-pin, cached boxes) — 4/5 match:
entrybleed ubuntu2204 5.15.0-91-generic match
overlayfs ubuntu2004 5.4.0-169-generic match
overlayfs_setuid ubuntu2204 5.15.0-91-generic match
nft_fwd_dup debian11 5.10.0-27-amd64 match
sudoedit_editor ubuntu2204 MISMATCH (no sudoers grant — expected-fix below)
Phase 2 (new boxes ubuntu1804 + debian12) — 0/4 match:
ptrace_traceme \
sudo_samedit \ all FAILED to build: nft_fwd_dup needs
af_packet / NFTA_CHAIN_FLAGS (kernel 5.7), not in 4.15 uapi
pack2theroot /
pack2theroot also hit 'already root' early-exit (running as root via
vagrant provision's default privileged shell)
Phase 3 (kernel-pinned) — 4/8 match:
cls_route4 ubuntu2004 + 5.15.0-43 HWE match
nft_payload ubuntu2004 + 5.15.0-43 HWE match
af_packet2 ubuntu2004 + 5.4.0-26 (still in apt!) match
sequoia ubuntu2004 + 5.4.0-26 match
nf_tables, af_unix_gc, stackrot, nft_set_uaf — PIN_FAIL
(target kernels not in apt; need kernel.ubuntu.com mainline
integration — deferred)
Total: 13 modules verified end-to-end against real Linux VMs,
covering kernels 5.4 / 5.10 / 5.15 / 5.4-HWE / 5.15-HWE across
Ubuntu 18.04/20.04/22.04 + Debian 11/12.
Three fixes for the next retry pass:
1. core/nft_compat.h — added NFTA_CHAIN_FLAGS (kernel 5.7) and
NFTA_CHAIN_ID (kernel 5.13). Without these, nft_fwd_dup fails to
compile on Ubuntu 18.04's 4.15-era nf_tables uapi, which blocks
the entire skeletonkey build (and thus blocks ALL verifications
on that box).
2. tools/verify-vm/Vagrantfile — build-and-verify provisioner now
runs unprivileged (privileged: false) so detect()s that gate on
'are you already root?' don't short-circuit. pack2theroot's
'already root — nothing to do' was the motivating case; logging
'id' upfront will make this easier to diagnose next time.
3. tools/verify-vm/targets.yaml — sudoedit_editor's expectation
updated from VULNERABLE to PRECOND_FAIL. Ubuntu 22.04 ships
sudo 1.9.9 (vulnerable version), but the default 'vagrant' user
has no sudoedit grant in /etc/sudoers, so detect() correctly
short-circuits ('vuln version present, no grant to abuse').
Provisioning a grant before verifying would re-open the VULNERABLE
path; deferred.
Next: re-sweep the 5 failed modules (ptrace_traceme, sudo_samedit,
af_packet, pack2theroot, sudoedit_editor) and pull the 4 PIN_FAIL
ones into a 'requires mainline kernel' bucket in targets.yaml.
99 lines
3.6 KiB
C
99 lines
3.6 KiB
C
/*
|
|
* SKELETONKEY — nf_tables uapi compat shims.
|
|
*
|
|
* Older distro kernel headers (e.g. Ubuntu 20.04's linux-libc-dev ships
|
|
* the 5.4 uapi; Debian 11 ships 5.10) don't define every nft attribute
|
|
* or chain flag the exploits use. The numeric values are stable kernel
|
|
* ABI — the target kernel understands them at runtime regardless of
|
|
* what was present in the build host's uapi headers. Conditionally
|
|
* define them here so modules compile against any reasonable header set.
|
|
*
|
|
* Sources for the numeric values:
|
|
* include/uapi/linux/netfilter/nf_tables.h in mainline at the kernel
|
|
* version that introduced each enum.
|
|
*
|
|
* Include AFTER <linux/netfilter/nf_tables.h>.
|
|
*/
|
|
|
|
#ifndef SKELETONKEY_NFT_COMPAT_H
|
|
#define SKELETONKEY_NFT_COMPAT_H
|
|
|
|
#include <linux/netfilter/nf_tables.h>
|
|
|
|
/* ── chain flags ─────────────────────────────────────────────────── */
|
|
|
|
/* NFT_CHAIN_HW_OFFLOAD: kernel 5.5 (commit be0b86e0594d). Needed by
|
|
* nft_fwd_dup_cve_2022_25636. */
|
|
#ifndef NFT_CHAIN_HW_OFFLOAD
|
|
#define NFT_CHAIN_HW_OFFLOAD 0x2
|
|
#endif
|
|
|
|
/* NFT_CHAIN_BINDING: kernel 5.9 (commit d164385ec572). */
|
|
#ifndef NFT_CHAIN_BINDING
|
|
#define NFT_CHAIN_BINDING 0x4
|
|
#endif
|
|
|
|
/* ── chain attrs ─────────────────────────────────────────────────── */
|
|
|
|
/* NFTA_CHAIN_FLAGS: kernel 5.7 (commit 65038428b2c6). Ubuntu 18.04's
|
|
* 4.15-era uapi lacks it. Position 10 in the enum
|
|
* (NFTA_CHAIN_TABLE=1..NFTA_CHAIN_USERDATA=9, NFTA_CHAIN_FLAGS=10). */
|
|
#ifndef NFTA_CHAIN_FLAGS
|
|
#define NFTA_CHAIN_FLAGS 10
|
|
#endif
|
|
|
|
/* NFTA_CHAIN_ID: kernel 5.13 (commit 837830a4b439). */
|
|
#ifndef NFTA_CHAIN_ID
|
|
#define NFTA_CHAIN_ID 11
|
|
#endif
|
|
|
|
/* ── verdict attrs ──────────────────────────────────────────────── */
|
|
|
|
/* NFTA_VERDICT_CHAIN_ID: kernel 5.14 (commit 4ed8eb6570a4). Needed by
|
|
* nf_tables_cve_2024_1086. */
|
|
#ifndef NFTA_VERDICT_CHAIN_ID
|
|
#define NFTA_VERDICT_CHAIN_ID 3 /* CODE=1, CHAIN=2, CHAIN_ID=3 */
|
|
#endif
|
|
|
|
/* ── set attrs ──────────────────────────────────────────────────── */
|
|
|
|
/* NFTA_SET_DESC_CONCAT: kernel 5.6 (commit 8aeff38e08d2 — concat sets). */
|
|
#ifndef NFTA_SET_DESC_CONCAT
|
|
#define NFTA_SET_DESC_CONCAT 2 /* DESC_SIZE=1, DESC_CONCAT=2 */
|
|
#endif
|
|
|
|
/* NFTA_SET_EXPR: kernel 5.12 (commit 65038428b2c6 — anon expr on sets). */
|
|
#ifndef NFTA_SET_EXPR
|
|
#define NFTA_SET_EXPR 13
|
|
#endif
|
|
|
|
/* NFTA_SET_EXPRESSIONS: kernel 5.16 (commit 48b0ae046ed4). */
|
|
#ifndef NFTA_SET_EXPRESSIONS
|
|
#define NFTA_SET_EXPRESSIONS 14
|
|
#endif
|
|
|
|
/* ── set-element attrs ──────────────────────────────────────────── */
|
|
|
|
/* NFTA_SET_ELEM_KEY_END: kernel 5.6 (commit 7b225d0b5c5b). */
|
|
#ifndef NFTA_SET_ELEM_KEY_END
|
|
#define NFTA_SET_ELEM_KEY_END 7
|
|
#endif
|
|
|
|
/* NFTA_SET_ELEM_EXPRESSIONS: kernel 5.16 (commit 48b0ae046ed4). */
|
|
#ifndef NFTA_SET_ELEM_EXPRESSIONS
|
|
#define NFTA_SET_ELEM_EXPRESSIONS 11
|
|
#endif
|
|
|
|
/* ── data attrs (newer additions tend to be backported uneven) ──── */
|
|
|
|
/* Make sure NFTA_DATA_VERDICT and friends exist — present since 3.13;
|
|
* here only as a tripwire if a very old header somehow lacks them. */
|
|
#ifndef NFTA_DATA_VERDICT
|
|
#define NFTA_DATA_VERDICT 2
|
|
#endif
|
|
#ifndef NFTA_DATA_VALUE
|
|
#define NFTA_DATA_VALUE 1
|
|
#endif
|
|
|
|
#endif /* SKELETONKEY_NFT_COMPAT_H */
|