SKELETONKEY/modules/_stubs/entrybleed_cve_2023_0458/MODULE.md

EntryBleed — CVE-2023-0458

⚪ PLANNED stub module. See ../../ROADMAP.md Phase 3.

Summary

KPTI's user-space-mapped entry trampoline is detectable via prefetchnta timing, leaking the kernel base address (defeats KASLR). Universal across modern x86_64 kernels with KPTI; only partial mitigations have shipped upstream.

Why this is here

EntryBleed is not a standalone LPE. It's a stage-1 leak primitive that future LPE modules can call when they need a kbase. Bundling it as a module:

1. Lets other modules #include "core/entrybleed.h" and call entrybleed_leak_kbase() when they need KASLR defeat
2. Ships defensive detection rules for prefetchnta-timing-attack patterns (useful for hardened environments)
3. Documents the technique with a clear writeup so users understand what "stage-1" means in the broader chain

Empirical status on recent kernels

Verified 2026-05-16: works 5/5 on lts-6.12.88 (no anti-EntryBleed mitigation configured). See security-research/findings/audit_io_uring_2026-05-16_poc_attempt.md and the EntryBleed test code at SKYFALL/bugs/leak_write_modprobe_2026-05-16/exploit.c lines ~73-150.

Upstream patches

There is no single canonical patch. Partial mitigations include:

• CONFIG_RANDOMIZE_KSTACK_OFFSET (per-syscall kernel stack jitter)
• Some KPTI hardening discussions on lkml, no merged fix as of lts-6.12.88
• The community position remains that "KASLR is best-effort, not a security boundary"

Implementation plan

• Lift the proven EntryBleed code from SKYFALL/bugs/leak_write_modprobe_2026-05-16/exploit.c into module.c here
• Expose as both a CLI mode (iamroot --leak-kbase) and as a library helper (uint64_t entrybleed_leak_kbase(void))
• Detection rules: timing-attack pattern flags, perf-counter anomaly detection (informational — these are hard to make precise without false positives)

Not started yet

Phase 3.