leviathan
8ac041a295
release / build (arm64) (push) Waiting to run
release / build (x86_64) (push) Waiting to run
release / build (x86_64-static / musl) (push) Waiting to run
release / build (arm64-static / musl) (push) Waiting to run
release / release (push) Blocked by required conditions
Five more CVEs empirically confirmed end-to-end against real Linux VMs:
- CVE-2019-14287 sudo_runas_neg1 (Ubuntu 18.04 + sudoers grant)
- CVE-2020-29661 tioscpgrp (Ubuntu 20.04 pinned to 5.4.0-26)
- CVE-2024-26581 nft_pipapo (Ubuntu 22.04 + mainline 5.15.5)
- CVE-2025-32463 sudo_chwoot (Ubuntu 22.04 + sudo 1.9.16p1 from source)
- CVE-2025-6019 udisks_libblockdev (Debian 12 + udisks2 + polkit rule)
Required real plumbing work:
- Per-module provisioner hook (tools/verify-vm/provisioners/<module>.sh)
- Two-phase provision in verify.sh (prep → reboot if needed → verify)
fixes silent-fail where new kernel installed but VM never rebooted
- GRUB_DEFAULT pinning in both pin-kernel and pin-mainline blocks
(kernel downgrades like 5.4.0-169 → 5.4.0-26 now actually boot the target)
- Old-mainline URL fallback in pin-mainline (≤ 4.15 debs at /v$KVER/ not /amd64/)
mutagen_astronomy marked manual: true — mainline 4.14.70 kernel-panics on
Ubuntu 18.04's rootfs ('Failed to execute /init (error -8)' — kernel config
mismatch). Genuinely needs a CentOS 6 / Debian 7 image.
35 lines
1.3 KiB
Bash
Executable File
35 lines
1.3 KiB
Bash
Executable File
#!/usr/bin/env bash
|
|
# CVE-2025-6019 udisks/libblockdev SUID-on-mount (Qualys). Debian 12's
|
|
# cloud image is server-oriented and doesn't ship udisks2. Install it,
|
|
# and drop a polkit rule allowing the vagrant user to invoke the
|
|
# affected action.ids — the real-world bug-path is "active console
|
|
# user invokes loop-setup", and we don't have a graphical session in
|
|
# Vagrant. The polkit rule simulates the trust polkit would give a
|
|
# logged-in workstation user.
|
|
set -e
|
|
|
|
export DEBIAN_FRONTEND=noninteractive
|
|
apt-get install -y -qq udisks2 libblockdev-utils2 >/dev/null
|
|
|
|
mkdir -p /etc/polkit-1/rules.d
|
|
cat >/etc/polkit-1/rules.d/49-skk-verify.rules <<'EOF'
|
|
polkit.addRule(function(action, subject) {
|
|
if (subject.user == "vagrant" &&
|
|
(action.id == "org.freedesktop.UDisks2.loop-setup" ||
|
|
action.id == "org.freedesktop.UDisks2.filesystem-mount" ||
|
|
action.id == "org.freedesktop.UDisks2.filesystem-mount-other-seat" ||
|
|
action.id == "org.freedesktop.UDisks2.modify-device")) {
|
|
return polkit.Result.YES;
|
|
}
|
|
});
|
|
EOF
|
|
|
|
systemctl enable udisks2.service >/dev/null 2>&1 || true
|
|
systemctl restart udisks2.service
|
|
sleep 2
|
|
|
|
echo "[+] udisks2 status:"
|
|
systemctl is-active udisks2.service
|
|
echo "[+] udisks2 version: $(dpkg-query -W -f='${Version}' udisks2)"
|
|
echo "[+] libblockdev version: $(dpkg-query -W -f='${Version}' libblockdev-utils2)"
|