leviathan
4e9741ef1f
Distro-agnostic overlayfs LPE — complements Ubuntu-specific CVE-2021-3493.
Same overlayfs family.
The bug: overlayfs copy_up preserves setuid bits even when the
unprivileged user triggering copy-up wouldn't normally have CAP_FSETID.
Exploit:
1. unshare(USER|NS), uid_map self → root in userns
2. Find a setuid binary on host (/usr/bin/su, sudo, passwd auto-pick)
3. mount overlayfs with the binary's dirname as lower
4. chown(merged/<binary>, 0, 0) — triggers copy-up; THE BUG: setuid
bit persists in upper-layer copy despite our unprivileged context
5. Open + truncate + replace upper-layer content with our payload
(a compiled C binary that setresuid(0,0,0) + execle /bin/sh -p)
6. exec upper-layer binary — runs as root via persistent setuid bit
- kernel_range: 5.11 ≤ K < 6.3, backports 5.15.110 / 6.1.27 / 6.2.13
- Detect refuses on patched / missing setuid carrier / userns denied
- Cleanup: rm -rf /tmp/iamroot-ovlsu-*
- Auditd: mount(overlay) + chown/fchown chain — shared with
CVE-2021-3493 module via the family-level 'iamroot-overlayfs' key
- Compiles payload via target's gcc/cc (fallback dynamic if no -static)
Verified on Debian 6.12.86 (patched): detect reports OK; exploit
refuses cleanly. Module count = 20.
Coverage by year now (only 2018 gap remaining):
2016: dirty_cow 🟢
2017: af_packet 🔵
2019: ptrace_traceme 🟢
2020: af_packet2 🔵
2021: pwnkit, overlayfs, netfilter_xtcompat 🟢/🟢/🔵
2022: dirty_pipe, cls_route4, fuse_legacy,
cgroup_release_agent 🟢/🔵/🔵/🟢
2023: entrybleed, stackrot, overlayfs_setuid 🟢/🔵/🟢
2024: nf_tables 🔵
2026: copy_fail family (×5) 🟢🟢🟢🟢🟢
16 of 20 modules have FULL working exploits (🟢).
41 lines
1.3 KiB
C
41 lines
1.3 KiB
C
/*
|
|
* IAMROOT — module registry
|
|
*
|
|
* Global list of registered modules. Each family contributes via
|
|
* register_<family>_modules() called from iamroot main() at startup.
|
|
*/
|
|
|
|
#ifndef IAMROOT_REGISTRY_H
|
|
#define IAMROOT_REGISTRY_H
|
|
|
|
#include "module.h"
|
|
|
|
void iamroot_register(const struct iamroot_module *m);
|
|
|
|
size_t iamroot_module_count(void);
|
|
const struct iamroot_module *iamroot_module_at(size_t i);
|
|
|
|
/* Find a module by name. Returns NULL if not found. */
|
|
const struct iamroot_module *iamroot_module_find(const char *name);
|
|
|
|
/* Each module family declares one of these in its public header. The
|
|
* top-level iamroot main() calls them in order at startup. */
|
|
void iamroot_register_copy_fail_family(void);
|
|
void iamroot_register_dirty_pipe(void);
|
|
void iamroot_register_entrybleed(void);
|
|
void iamroot_register_pwnkit(void);
|
|
void iamroot_register_nf_tables(void);
|
|
void iamroot_register_overlayfs(void);
|
|
void iamroot_register_cls_route4(void);
|
|
void iamroot_register_dirty_cow(void);
|
|
void iamroot_register_ptrace_traceme(void);
|
|
void iamroot_register_netfilter_xtcompat(void);
|
|
void iamroot_register_af_packet(void);
|
|
void iamroot_register_fuse_legacy(void);
|
|
void iamroot_register_stackrot(void);
|
|
void iamroot_register_af_packet2(void);
|
|
void iamroot_register_cgroup_release_agent(void);
|
|
void iamroot_register_overlayfs_setuid(void);
|
|
|
|
#endif /* IAMROOT_REGISTRY_H */
|