leviathan
d84b3b0033
Five new modules close the 2018 gap entirely and thicken 2019 / 2020 / 2024. All five carry the full 4-format detection-rule corpus + opsec_notes + arch_support + register helpers. CVE-2018-14634 — mutagen_astronomy (Qualys, closes 2018) create_elf_tables() int wrap → SUID-execve stack corruption. CISA KEV-listed Jan 2026 despite the bug's age; legacy RHEL 7 / CentOS 7 / Debian 8 fleets still affected. 🟡 PRIMITIVE. arch_support: x86_64+unverified-arm64. CVE-2019-14287 — sudo_runas_neg1 (Joe Vennix) sudo -u#-1 → uid_t underflow → root despite (ALL,!root) blacklist. Pure userspace logic bug; the famous Apple Information Security finding. detect() looks for a (ALL,!root) grant in sudo -ln output; PRECOND_FAIL when no such grant exists for the invoking user. arch_support: any (4 -> 5 userspace 'any' modules). CVE-2020-29661 — tioscpgrp (Jann Horn / Project Zero) TTY TIOCSPGRP ioctl race on PTY pairs → struct pid UAF in kmalloc-256. Affects everything through Linux 5.9.13. 🟡 PRIMITIVE (race-driver + msg_msg groom). Public PoCs from grsecurity / spender + Maxime Peterlin. CVE-2024-50264 — vsock_uaf (a13xp0p0v / Pwnie Award 2025 winner) AF_VSOCK connect-race UAF in kmalloc-96. Pwn2Own 2024 + Pwnie 2025 winner. Reachable as plain unprivileged user (no userns required — unusual). Two public exploit paths: @v4bel+@qwerty kernelCTF (BPF JIT spray + SLUBStick) and Alexander Popov / PT SWARM (msg_msg). 🟡 PRIMITIVE. CVE-2024-26581 — nft_pipapo (Notselwyn II, 'Flipping Pages') nft_set_pipapo destroy-race UAF. Sibling to nf_tables (CVE-2024-1086) from the same Notselwyn paper. Distinct bug in the pipapo set substrate. Same family signature. 🟡 PRIMITIVE. Plumbing changes: core/registry.h + registry_all.c — 5 new register declarations + calls. Makefile — 5 new MUT/SRN/TIO/VSK/PIP module groups in MODULE_OBJS. tests/test_detect.c — 7 new test rows covering the new modules (above-fix OK, predates-the-bug OK, sudo-no-grant PRECOND_FAIL). tools/verify-vm/targets.yaml — verifier entries for all 5 with honest 'expect_detect' values based on what Vagrant boxes can realistically reach (mutagen_astronomy gets OK on stock 18.04 since 4.15.0-213 is post-fix; sudo_runas_neg1 gets PRECOND_FAIL because no (ALL,!root) grant on default vagrant user; tioscpgrp + nft_pipapo VULNERABLE with kernel pins; vsock_uaf flagged manual because vsock module rarely available on CI runners). tools/refresh-cve-metadata.py — added curl fallback for the CISA KEV CSV fetch (urlopen times out intermittently against CISA's HTTP/2 endpoint). Corpus growth across v0.8.0 + v0.9.0: v0.7.1 v0.8.0 v0.9.0 Modules 31 34 39 Distinct CVEs 26 29 34 KEV-listed 10 10 11 (mutagen_astronomy) arch 'any' 4 6 7 (sudo_runas_neg1) Years 2016-2026: 10/11 10/11 **11/11** Year-by-year coverage: 2016: 1 2017: 1 2018: 1 2019: 2 2020: 2 2021: 5 2022: 5 2023: 8 2024: 3 2025: 2 2026: 4 CVE-2018 gap → CLOSED. Every year from 2016 through 2026 now has at least one module. Surfaces updated: - README.md: badge → 22 VM-verified / 34, Status section refreshed - docs/index.html: hero eyebrow + footer → v0.9.0, hero tagline 'every year 2016 → 2026', stats chips → 39 / 22 / 11 / 151 - docs/RELEASE_NOTES.md: v0.9.0 entry added on top with year coverage matrix + per-module breakdown; v0.8.0 + v0.7.1 entries preserved below - docs/og.svg + og.png: regenerated with new numbers + 'Every year 2016 → 2026' tagline CVE metadata refresh (tools/refresh-cve-metadata.py) deferred to follow-up — CISA KEV CSV + NVD CVE API were timing out during the v0.9.0 push window. The 5 new CVEs will return NULL from cve_metadata_lookup() until the refresh runs (—module-info simply skips the WEAKNESS/THREAT INTEL header for them; no functional impact). Re-run 'tools/refresh-cve-metadata.py' when network cooperates. Tests: macOS local 33/33 kernel_range pass; detect-test stubs (88 total) build clean; ASan/UBSan + clang-tidy CI jobs still green from the v0.7.x setup.
55 lines
2.0 KiB
C
55 lines
2.0 KiB
C
/*
|
|
* SKELETONKEY — canonical "register every module family" enumeration.
|
|
*
|
|
* Kept in its own translation unit so registry.c stays standalone:
|
|
* the kernel_range unit-test binary links registry.c (for the basic
|
|
* register / count / find API) without pulling in every module's
|
|
* symbol. The main binary and detect-integration test link this
|
|
* file too and get the full lineup.
|
|
*
|
|
* Adding a new module is one new register_<family>() declaration in
|
|
* registry.h plus one call below — the integration test picks it up
|
|
* via skeletonkey_register_all_modules() in its main().
|
|
*/
|
|
|
|
#include "registry.h"
|
|
|
|
void skeletonkey_register_all_modules(void)
|
|
{
|
|
skeletonkey_register_copy_fail_family();
|
|
skeletonkey_register_dirty_pipe();
|
|
skeletonkey_register_entrybleed();
|
|
skeletonkey_register_pwnkit();
|
|
skeletonkey_register_nf_tables();
|
|
skeletonkey_register_overlayfs();
|
|
skeletonkey_register_cls_route4();
|
|
skeletonkey_register_dirty_cow();
|
|
skeletonkey_register_ptrace_traceme();
|
|
skeletonkey_register_netfilter_xtcompat();
|
|
skeletonkey_register_af_packet();
|
|
skeletonkey_register_fuse_legacy();
|
|
skeletonkey_register_stackrot();
|
|
skeletonkey_register_af_packet2();
|
|
skeletonkey_register_cgroup_release_agent();
|
|
skeletonkey_register_overlayfs_setuid();
|
|
skeletonkey_register_nft_set_uaf();
|
|
skeletonkey_register_af_unix_gc();
|
|
skeletonkey_register_nft_fwd_dup();
|
|
skeletonkey_register_nft_payload();
|
|
skeletonkey_register_sudo_samedit();
|
|
skeletonkey_register_sequoia();
|
|
skeletonkey_register_sudoedit_editor();
|
|
skeletonkey_register_vmwgfx();
|
|
skeletonkey_register_dirtydecrypt();
|
|
skeletonkey_register_fragnesia();
|
|
skeletonkey_register_pack2theroot();
|
|
skeletonkey_register_sudo_chwoot();
|
|
skeletonkey_register_udisks_libblockdev();
|
|
skeletonkey_register_pintheft();
|
|
skeletonkey_register_mutagen_astronomy();
|
|
skeletonkey_register_sudo_runas_neg1();
|
|
skeletonkey_register_tioscpgrp();
|
|
skeletonkey_register_vsock_uaf();
|
|
skeletonkey_register_nft_pipapo();
|
|
}
|