kernelCTF: add CVE-2024-26583_lts#306
Open
lambdasprocket wants to merge 1 commit intogoogle:masterfrom
Open
Conversation
Collaborator
|
Hey! If I compile the stable version of the patch commit (https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id=7a3ca06d04d589deec81f56229a9a9d62352ce01) with KASAN and run the exploit, it still crashes the kernel. Can you help us understand why is that? Is this the right patch commit? (This blocks the payout of the first half of the reward.) Logs: |
Contributor
Author
Hi! I suspect that this exploit unintentionally triggers another vulnerability (CVE-2024-26582) because of the partial read (100 bytes sent, but only 10 received). You can try making a following change to the exploit: This will get rid of the partial read (number of bytes sent/received do not affect the vulnerability targeted here) and should help avoid extra KASAN reports. |
Collaborator
|
Hmmm I made that change, but now the exploit does not repro in any environment: it shows a lot of delay / attempt message until it times out. (With the original buflen 100, it immediately crashes after the first attempt, just not at the right place.) Do you have any idea why? I will verify the exploit manually, but it would be good to understand why this is happening. |
artmetla
requested changes
Mar 20, 2026
Collaborator
artmetla
left a comment
artmetla
left a comment
There was a problem hiding this comment.
Hey @lambdasprocket. Just a ping on the comment from @koczkatamas above. Could you have a look please?
Contributor
Author
The change in the sender() function I suggested stops the exploit from triggering the wrong vulnerability - it doesn't change anything regarding the correct one, the exploit still works for me after the change on the LTS 6.1.74 image that was the original target. I suspect that the reason you can't trigger this is KASAN - it slows execution a lot and this vulnerability is a race condition with a pretty tiny window. |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
3 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
No description provided.