Skip to content

kernelCTF: add CVE-2024-26582_mitigation_2 - #424

Open
federico-zanca wants to merge 1 commit into
google:masterfrom
federico-zanca:exp795-cve-2024-26582-mitigation-2
Open

kernelCTF: add CVE-2024-26582_mitigation_2#424
federico-zanca wants to merge 1 commit into
google:masterfrom
federico-zanca:exp795-cve-2024-26582-mitigation-2

Conversation

@federico-zanca

Copy link
Copy Markdown

Novelty-only kernelCTF submission exp795 for mitigation-v4-6.6.

This submission targets an already exploited vulnerability and claims only the novel techniques documented in docs/novel-techniques.md.

The submitted exploit demonstrates DirtyBPF, a technique to corrupt a BPF filter with a UAF.
docs/novel-techniques.md proposes the main techniques and variants.

Bug Hunters issue: https://issuetracker.google.com/issues/553474550

@google-cla

google-cla Bot commented Aug 27, 2026

Copy link
Copy Markdown

Thanks for your pull request! It looks like this may be your first contribution to a Google open source project. Before we can look at your pull request, you'll need to sign a Contributor License Agreement (CLA).

View this failed invocation of the CLA check for more information.

For the most up to date status, view the checks section at the bottom of the pull request.

@federico-zanca

Copy link
Copy Markdown
Author

I think the structure_check failure is caused by the legacy spreadsheet row for novelty-only submission exp795 having an empty CVE field.

This PR uses CVE-2024-26582_mitigation_2. The exp795 row already contains the corresponding upstream fix commit.

Could the spreadsheet entry for exp795 please be updated so that the structure check can be rerun?

  • CVE: CVE-2024-26582
  • Patch commit title: net: tls: fix use-after-free with partial reads and async decrypt

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant