SKELETONKEY

Files

T

leviathan 498bb36404 modules: port 5 detect-only modules to trigger+groom (Option B)

Converts the 5 remaining detect-only network/fs LPE modules to fire
the actual kernel primitive on a vulnerable host, with honest
EXPLOIT_FAIL return values since none ship the per-kernel cred-overwrite
finisher.

  af_packet (CVE-2017-7308):     +444 LoC — TPACKET_V3 int-overflow
                                  + skb spray + best-effort cred race
  af_packet2 (CVE-2020-14386):   +446 LoC — tp_reserve underflow
                                  + sendmmsg skb spray
  cls_route4 (CVE-2022-2588):    +410 LoC — route4 dangling-filter UAF
                                  + msg_msg 1k spray + classify drive
  fuse_legacy (CVE-2022-0185):   +420 LoC — fsconfig 4k OOB write
                                  + msg_msg cross-cache groom
  nf_tables (CVE-2024-1086):     +613 LoC — hand-rolled nfnetlink batch
                                  builder + NFT_GOTO/DROP double-free
                                  + msg_msg groom skeleton

All five share:
  - userns+netns reach (unshare(CLONE_NEWUSER|CLONE_NEWNET))
  - Detect-refuse-on-patched re-call from exploit()
  - geteuid()==0 short-circuit
  - Honest EXPLOIT_FAIL with continuation roadmap comments
  - macOS dev-build stubs via #ifdef __linux__ where needed

Build verified clean on Debian 6.12.86 (kctf-mgr). All five refuse on
the patched kernel.

2026-05-16 21:22:17 -04:00

_stubs/fragnesia_TBD

Phase 3: EntryBleed module — working stage-1 kbase leak brick

2026-05-16 19:55:22 -04:00

af_packet2_cve_2020_14386

modules: port 5 detect-only modules to trigger+groom (Option B)

2026-05-16 21:22:17 -04:00

af_packet_cve_2017_7308

modules: port 5 detect-only modules to trigger+groom (Option B)

2026-05-16 21:22:17 -04:00

cgroup_release_agent_cve_2022_0492

Add cgroup_release_agent CVE-2022-0492 — FULL working exploit