Add kernelCTF CVE-2025-38000_lts_cos_mitigation#296
Open
mingi wants to merge 5 commits intogoogle:masterfrom
Open
Add kernelCTF CVE-2025-38000_lts_cos_mitigation#296mingi wants to merge 5 commits intogoogle:masterfrom
mingi wants to merge 5 commits intogoogle:masterfrom
Conversation
Collaborator
|
Hey! If I compile the stable version of the patch commit (https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id=93c276942e75de0e5bc91576300d292e968f5a02) with KASAN and run the exploit, it still crashes the kernel. Can you help us understand why is that? Is this the right patch commit? (This blocks the payout of the first half of the reward.) Logs: |
Contributor
Author
|
Hi! When the vulnerability was reported, the maintainer first created the patch 93c27694. After realizing this patch did not fix the vulnerability, they created another patch to prevent UAF (https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/? id=103406b38c600fec1fe375a77b27d87e314aea09). |
Collaborator
|
Hey! Unfortunately, the kernelCTF panel determined that commit 103406b - rather than yours - was the official patch fixing the vulnerability. Since that commit had already been claimed by another researcher, we cannot attribute it to you. We encourage all researchers to ensure that the vulnerabilities they report are correctly fixed by the kernel; the panel concluded that this requirement was not met in this instance. |
Contributor
Author
|
Hi! I don't think it's fair to give all the credit to the commit 103406b. This is because I reported this vulnerability first, and Lion created a new patch based on publicly available information during the vulnerability patching process. I identified that the initially applied commit 3f98113 was insufficient and notified the maintainer as I mentioned in Discord. Meanwhile, Lion simultaneously reported the patch. Therefore, Lion was able to create the fix because I reported the vulnerability. It is unreasonable that the vulnerability founder receives no credit at all. |
Collaborator
|
Hey! We will discuss this on our next panel meeting (next Tuesday). |
Collaborator
|
Good news! The panel decided that we are making an exception in this case and accept your submission. But won't accept this in the future and we've added the following clause to the rules:
|
Contributor
Author
|
Thank you for sharing the good news! I’ll be more careful next time. |
artmetla
added
the
kCTF: vuln OK
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
3 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
No description provided.