8eb2453001
Add kernelCTF CVE-2025-37752_cos ( #222 )
...
* Add kernelCTF CVE-2025-37752_cos
* Update exploit.c
* Update exploit.c
2026-02-06 14:55:00 +01:00
44f6ce0223
Add kernelCTF CVE-2023-52927_cos ( #220 )
...
* init CVE-2023-52927
* fix file structure
2026-02-04 17:24:22 +01:00
818793518e
Create copilot-instructions.md for kernelctf
...
Add instructions for applying Copilot to kernelctf.
2026-01-26 13:30:04 +01:00
7aafb56f9d
kernelCTF: add CVE-2024-26585_lts_cos ( #293 )
...
* kernelCTF: add CVE-2024-26585_lts_cos
* CVE-2024-26585_lts_cos: adjust timings
* CVE-2024-26585_lts_cos: limit attempts for COS
* CVE-2024-26585_lts_cos: adjust timings for COS
2026-01-22 17:51:22 +01:00
5e192cbe3c
[v8ctf] Update v8CTF challenges
2026-01-21 00:01:37 +00:00
7f68f7f1b8
kernelCTF: add explicit note about the 10% stability requirement
2026-01-07 12:45:19 +00:00
d6396d2cda
kernelCTF: fix mitigation-6.1-v2 handling issue
2026-01-07 12:17:18 +00:00
d57309a820
kernelCTF: server: update to latest version
2025-12-18 15:41:47 +00:00
7297a9e637
Submission Verification logic for Android submissions ( #289 )
...
1) Disabled AppArmor block for unpriviledged user namespaces. This hapend in ubuntu-latest: https://discourse.ubuntu.com/t/understanding-apparmor-user-namespace-restriction/58007 . Added this step to "get_android_dependencies.sh".
2) Using "get_android_dependencies.sh" script to handle dependencies for all execution options: server.py, exploit build, and exploit_reproduction.
3) Optimised exploit reproduction run time, by downloading releases and installing dependencies in parallel.
4) Conducted clean up to free up a bit of extra space for Cuttlefish runs (cleaning compilation leftovers and APT caches).
5) Using "cuttlefish.sh" to run VM in all execution options: server.py and GHA reproducer. Modified "cuttlefish.sh" to add "--test-mode" which allows easy testing by setting "falg" file permissions equivalent to exploit executable. It's disabled in prod. Improved Android16 detection logic (to enable necessary execution flags for "launch_cvd"), as apparently "launch_cvd --help" could fail sometimes. Improved cleaning logic (important as launch_cvd is super nasty and lefts a lot of tmps and random leftovers which could negatively impact next run of the VM)
6) Apparently in ubuntu-latest "sg -c" requires password. So implemented this logic canonical/data-platform-workflows@349e0c8 . This is important as Cuttlefish couldn't run without user being added in groups. By default they suggest reboot to apply those changes, but it's impossible in GHA.
7) "Check PR content" logic is already updated in prod
8) Ensured that in exploit build environment NDK is added to the PATH, so simple Makefiles like:
```
exploit: exploit.c
clang --target=x86_64-linux-android35 -static $^ -o exploit
```
The whole thing was tested with dummy exploit in my fork.
9) Implemented proper timeout check (30 mins) in "cuttlefish.sh"
10) Introduced sparse-checkout for the GHA.
2025-12-04 15:21:19 +01:00
d69153396e
[v8ctf] Remove old versions
2025-12-03 10:58:49 +01:00
a19be12183
[v8ctf] Update v8CTF challenges
2025-12-03 00:01:34 +00:00
8947e3d1e4
Update check-submission.py to handle Android folders
2025-11-27 17:15:29 +01:00
63b9e94c82
Update metadata.schema.v3.json
2025-11-27 16:23:43 +01:00
4d212a9a5b
Update regular expression in metadata.schema.v3.json to add Android releases support
2025-11-27 16:23:07 +01:00
ea8b117f6e
kernelCTF: server: upload Android related scripts and APK source code
2025-11-27 13:50:34 +01:00
b706f60a9b
Improve kernelCTF auto releaser to handle Android releases ( #284 )
...
- The auto-releaser would wok in a following logic:
1. Access https://androidbuildinternal.googleapis.com/android/internal/build/v3/builds?branches=aosp-android-latest-release&buildAttemptStatus=complete&buildType=submitted&maxResults=1&successful=true&target=aosp_cf_x86_64_only_phone-userdebug to get an information about latest Android build available in JSON format.
2. We take the build number and using fetch_artifact (https://android.googlesource.com/tools/fetch_artifact/ ) attempt to download "kernel_version.txt" artefact from Android build to get all the necessary build details.
3. Using build details check if kernelCTF GCS bucket contains already the release. If not add it to releases that should be processed by kernelctf-release-build action.
- The logic of kernelctf-release-build action updated to handle new naming style of Android releases.
2025-11-27 13:31:33 +01:00
a1a0b27123
kernelCTF: Update FAQ how to build kernelCTF releases
...
Added new FAQ entries regarding bounty payments and kernelCTF target rebuilding.
2025-11-25 17:12:39 +01:00
7c3d42660a
kernelCTF: Clarify condition for patch landing in rules ( #283 )
...
* kernelCTF: Clarify condition for patch landing in rules
* kernelCTF: Clarify wording in rules for 0-day submissions
2025-11-24 15:04:00 +01:00
d4a08c0ef1
kernelctf: add CVE-2023-4015_lts_2 ( #142 )
...
* kernelctf: add CVE-2023-4015_lts_2
* Rename post exploit func
* Remove some unneeded comments
* Add comment on reclaim
* Add comments in trigger_uaf
* Mark unused variable
* Add comment about where rsi is pointing to
* Define some magic numbers
* Fix failing compilation
2025-11-21 10:33:31 -08:00
bc5f5d844e
Revert "Add kernelCTF CVE-2025-21703_lts_cos ( #276 )" ( #281 )
...
This reverts commit 9c5e122d3c
2025-11-21 10:28:23 -08:00
9c5e122d3c
Add kernelCTF CVE-2025-21703_lts_cos ( #276 )
...
* Add kernelCTF CVE-2025-21703_lts_cos
* update filename
* update metadata.json
* update metadata.json
* update exploit.c
---------
Co-authored-by: Mingi Cho <mgcho.minic@gmail.com >
2025-11-21 03:33:47 -08:00
284329c63b
Add kernelCTF CVE-2025-40364_lts_cos ( #210 )
...
* init CVE-2025-40364
* Update exploit.c
* fix exp
* fix exp
* Update exploit.md
* Update exploit.md
* Improve
* Improve 2
* Improve 3
* Test
* TEST
* TEST
* TEST
* Added comment for sleep
* Added comment for refcount clac
---------
Co-authored-by: M Ramdhan <n0psledbyte@gmail.com >
2025-11-21 10:48:00 +01:00
662572c16c
Build Android release and upload to Cloud Bucket ( #277 )
2025-11-18 13:05:48 +01:00
9fa781e0d9
Update releases.yaml
2025-11-10 15:00:07 +01:00
8cf454374e
kernelCTF: server: update to latest version
2025-11-06 18:05:44 +01:00
744dce70df
Add kernelCTF CVE-2024-58240_cos ( #274 )
...
* Add kernelCTF CVE-2024-58240_cos
* Update exploit.c
2025-11-06 13:25:04 +01:00
49c9e8266b
kernelCTF: server: update to latest version
2025-11-03 15:08:44 +01:00
26bcc14b4d
Update kernel-codeql-release.yaml
2025-11-03 09:14:31 +01:00
9fdac8393e
Update kernel-codeql-release.yaml
2025-11-02 09:52:44 +01:00
c79816a8fd
Update kernel-codeql-release.yaml
2025-11-01 07:30:36 +01:00
170fbfd9a5
Comment out config-file in kernel-codeql-release.yaml
...
Comment out config-file line in CodeQL workflow
2025-10-31 11:00:21 +01:00
bf2aa1936b
Enable custom config file for CodeQL analysis
2025-10-29 18:10:38 +01:00
69a5dfa03b
Update kernel-codeql-release.yaml
2025-10-29 16:14:20 +01:00
76a232c60f
Update CodeQL workflow to skip queries
...
Comment out the config-file line and enable skip-queries.
2025-10-29 16:11:07 +01:00
506ea1564b
Update build_release.sh to add Mitigation v4-6.12 target ( #271 )
...
* Update build_release.sh
* Update build_release.sh
2025-10-29 16:00:52 +01:00
b2ea0b7507
Update kernel-codeql-release.yaml
2025-10-29 14:26:48 +01:00
336ad09ab0
Update kernel-codeql-release.yaml
2025-10-29 14:23:59 +01:00
e6df94994f
[v8ctf] rm M140
2025-10-29 11:06:09 +01:00
e5f51ff46b
[v8ctf] Update v8CTF challenges
2025-10-29 00:01:40 +00:00
4267632b1e
don't upload db to avoid wasting space
2025-10-27 23:45:21 +01:00
5b927de94c
Update kernel-codeql-release.yaml
2025-10-26 09:26:05 +01:00
41994a6cda
Update CodeQL release workflow to include results
2025-10-26 08:00:08 +01:00
9ef6899cbe
Update kernel-codeql-release.yaml
2025-10-25 23:59:46 +02:00
3fc2d64819
Update kernel-codeql-release.yaml
2025-10-25 23:52:48 +02:00
ff9d2545ec
Automate CodeQL DB generation
2025-10-25 19:41:01 +02:00
da26fc7ac7
Update kernel-codeql-release.yaml
2025-10-25 14:58:53 +02:00
06e93d2efd
Update kernel-codeql-release.yaml
2025-10-25 11:12:12 +02:00
032dba7a22
Update kernel-codeql-release.yaml
2025-10-25 10:58:00 +02:00
ce56c9c807
limit codeql db to 2GB
2025-10-25 10:42:04 +02:00
170366f143
Refactor kernel-codeql-release workflow steps
...
Updated the workflow to install base dependencies and prepare kernel source. Adjusted error handling for the TOKEN variable.
2025-10-24 16:52:32 +02:00
0xdevil