leviathan
5a0aef12d0
- Implements the Dirty Pipe primitive: prepare_pipe() fills+drains a
pipe to plant the stale PIPE_BUF_FLAG_CAN_MERGE flag in every
pipe_buffer slot; dirty_pipe_write() splices 1 byte from the target
file at offset-1 (seeding the slot with the file's page) then write()s
the payload, which the buggy kernel merges back into the page cache.
- find_passwd_uid_field() + revert_passwd_page_cache() inlined in the
module. Two-of-two duplication acceptable; extraction into core/host
triggers when a third module needs the same helpers (Phase 1.5).
- dirty_pipe_exploit() resolves current euid via getpwuid, locates the
user's UID field in /etc/passwd, replaces it with same-length zeros
('0000' for a 4-digit UID), then execlp's su <user> -c /bin/sh.
Auto-refuses if detect() reports patched. --no-shell mode plants the
write and returns. Cleanup mode evicts /etc/passwd from page cache.
- _GNU_SOURCE redefine warning fixed: cmdline -D already passes it.
Verified end-to-end on kernel 6.12.86 (patched):
iamroot --scan → dirty_pipe reports OK (patched)
iamroot --exploit dirty_pipe --i-know → refuses cleanly
CI-validation against vulnerable kernel (Ubuntu 20.04 / 5.13) is Phase 4.
CVES.md: dirty_pipe 🔵 → 🟢. ROADMAP.md: Phase 2 marked complete.
59 lines
4.2 KiB
Markdown
59 lines
4.2 KiB
Markdown
# CVE inventory
|
|
|
|
The curated list of CVEs IAMROOT exploits, with patch status and
|
|
module status. Updated as new modules land or as upstream patches
|
|
ship.
|
|
|
|
Status legend:
|
|
|
|
- 🟢 **WORKING** — module verified to land root on a vulnerable host
|
|
- 🟡 **PARTIAL** — module detects + exploits on some distros, not all
|
|
- 🔵 **DETECT-ONLY** — module fingerprints presence/absence but no
|
|
exploit (yet). Useful for blue teams.
|
|
- ⚪ **PLANNED** — stub exists, work not started
|
|
- 🔴 **DEPRECATED** — fully patched everywhere relevant; kept for
|
|
historical reference only
|
|
|
|
## Inventory
|
|
|
|
| CVE | Name | Class | First patched | IAMROOT module | Status | Notes |
|
|
|---|---|---|---|---|---|---|
|
|
| CVE-2026-31431 | Copy Fail (algif_aead `authencesn` page-cache write) | LPE (page-cache write → /etc/passwd) | mainline 2026-04-22 | `copy_fail` | 🟢 | Verified on Ubuntu 26.04, Alma 9, Debian 13. Full AppArmor bypass. |
|
|
| CVE-2026-43284 (v4) | Dirty Frag — IPv4 xfrm-ESP page-cache write | LPE (same primitive shape as Copy Fail, different trigger) | mainline 2026-05-XX | `dirty_frag_esp` | 🟢 | Full PoC + active-probe scan |
|
|
| CVE-2026-43284 (v6) | Dirty Frag — IPv6 xfrm-ESP (`esp6`) | LPE | mainline 2026-05-XX | `dirty_frag_esp6` | 🟢 | V6 STORE shift auto-calibrated per kernel build |
|
|
| CVE-2026-43500 | Dirty Frag — RxRPC page-cache write | LPE | mainline 2026-05-XX | `dirty_frag_rxrpc` | 🟢 | |
|
|
| (variant, no CVE) | Copy Fail GCM variant — xfrm-ESP `rfc4106(gcm(aes))` page-cache write | LPE | n/a | `copy_fail_gcm` | 🟢 | Sibling primitive, same fix |
|
|
| CVE-2022-0847 | Dirty Pipe — pipe `PIPE_BUF_FLAG_CAN_MERGE` write | LPE (arbitrary file write into page cache) | mainline 5.17 (2022-02-23) | `dirty_pipe` | 🟢 | Full detect + exploit + cleanup. Detect: branch-backport ranges (5.10.102 / 5.15.25 / 5.16.11 / 5.17+). Exploit: page-cache write into /etc/passwd UID field followed by `su` to drop a root shell. Auto-refuses on patched kernels. Cleanup: drop_caches + POSIX_FADV_DONTNEED. CI-validation against a vulnerable kernel (e.g. Ubuntu 20.04 with stock 5.13) is Phase 4 work. |
|
|
| CVE-2023-0458 | EntryBleed — KPTI prefetchnta KASLR bypass | INFO-LEAK (kbase) | mainline (partial mitigations only) | `entrybleed` | 🟢 | Stage-1 leak brick. Working on lts-6.12.86 (verified 2026-05-16 via `iamroot --exploit entrybleed --i-know`). Default `entry_SYSCALL_64` slot offset matches lts-6.12.x; override via `IAMROOT_ENTRYBLEED_OFFSET=0x...`. Other modules can call `entrybleed_leak_kbase_lib()` as a library. x86_64 only. |
|
|
| CVE-2026-31402 | NFS replay-cache heap overflow | LPE (NFS server) | mainline 2026-04-03 | — | ⚪ | Candidate. Different audience (NFS servers) — TBD whether in-scope. |
|
|
| CVE-TBD | Fragnesia (ESP shared-frag in-place encrypt) | LPE (page-cache write) | mainline TBD | `_stubs/fragnesia_TBD` | ⚪ | Stub. Per `findings/audit_leak_write_modprobe_backups_2026-05-16.md`, requires CAP_NET_ADMIN in userns netns — may or may not be in-scope depending on target environment. |
|
|
|
|
## Pipeline for additions
|
|
|
|
1. Bug must be **patched in upstream mainline** (we don't bundle
|
|
0-days)
|
|
2. Either **CVE-assigned** or has clear advisory/patch reference
|
|
3. Affects a kernel version range with realistic deployment footprint
|
|
(we don't bundle exploits for kernels nobody runs)
|
|
4. PoC works on at least one distro+kernel in our CI matrix
|
|
5. Detection signature(s) shipped alongside the exploit
|
|
|
|
## Patch-status tracking
|
|
|
|
Each module's `kernel-range.json` (planned) declares the affected
|
|
range. CI verifies the exploit fails on the first-patched version
|
|
and succeeds below it. When a distro backports the fix into a kernel
|
|
version below the original first-patched, the matrix updates and
|
|
the relevant distro drops out of the "WORKING" list for that module.
|
|
|
|
## Why we exclude some things
|
|
|
|
- **0-days the maintainer found themselves**: those go through
|
|
responsible disclosure first, then enter IAMROOT after upstream patch
|
|
- **kCTF VRP submissions in flight**: same as above; disclosure
|
|
before bundling
|
|
- **Hardware-specific side channels** (Spectre/Meltdown variants):
|
|
out of scope; not page-cache or process-isolation primitives
|
|
- **Container-escape only**: unless it cleanly chains to host-root,
|
|
out of scope (separate tool space)
|