SuperAPI AI Directory
Partner with us中文AI newsFavorites
Skillsalibabacloud-ecs-sec-kernel

alibabacloud-ecs-sec-kernel

Design & creation

View repository

Updated 10-15 19:55

About this skill

sec-kernel

Linux kernel CVE vulnerability detection and PoC verification tool. 88 kernel vulnerability detectors, CTF challenge mode verification.

Version: 1.4.1 (JSON-driven architecture)

Trigger Scenarios

When the following scenarios occur, be sure to proactively invoke this skill:

  • Detect Linux kernel vulnerabilities
  • Verify whether a specific CVE is exploitable
  • Execute three-stage PoC verification (Prepare → Run → Post)
  • Kernel security assessment or audit
  • The user mentions keywords such as "kernel security", "CVE", "privilege escalation vulnerability", "PoC", etc.
  • Need to determine whether the current kernel version has known vulnerabilities
  • Execute local privilege escalation (LPE) path verification

⚠️ Security Statement

PoC verification may cause kernel crash (panic/hang/deadlock); it is recommended to run in an isolated virtual machine/snapshot-capable environment. PoC will not permanently modify system files and will not perform persistent privilege escalation. All temporary modifications are fully restored in the Post stage. By using this tool, you agree to comply with all terms in Complete Security Statement . Violation of usage requires bearing full legal responsibility.

Quick Start

# 从 skill 根目录执行：

# 需要 root 权限（sudo）

# 首次运行：编译 PoC 二进制 + 全量检测（推荐）
sudo python3 -m scripts --compile-poc --verbose

# 全量检测与 PoC 验证（poc-bin 已编译后）
sudo python3 -m scripts --verbose

# 单 CVE 验证
sudo python3 -m scripts --cve-id CVE-2026-31431 -v

# 列出所有检测器（无需 root）
python3 -m scripts --list-detectors

# 输出 JSON 格式报告
sudo python3 -m scripts --format json -v

CLI Parameters

Parameter Type Default Value Description
--mode choice host Run mode (only host, Linux server environment)
--poc-output path ./workspace PoC evidence output directory
--poc-timeout int 30 PoC execution timeout (seconds)
--no-prepare flag off Skip Prepare stage
--no-post flag off Skip Post stage
--poc-user string nobody Run stage execution user (execute with reduced privileges)
--no-force-demote flag off Do not force privilege reduction to an unprivileged user
--compile-poc flag off Automatically compile missing PoC binary files (plain mode)
--output-dir path ./workspace Report output directory
--format choice markdown Report format (markdown / json）
--cve-id string - Only detect the specified CVE
--config path - Configuration file path
--verbose / -v flag off Verbose output
--list-detectors flag off List all detectors (no root required)

Key Parameter Descriptions

Default Behavior: All in kernel_cves.yaml that are enabled: true CVEs will automatically execute PoC verification without additional parameters. The only condition to skip PoC is to set the CVE to enabled: false。

--compile-poc: When the corresponding ELF binary is missing under the poc-bin/ directory, automatically invoke poc-src/build.sh to compile. On first run,mustuse this parameter (poc-bin/ is no longer distributed with the repository and must be dynamically compiled from source).

Why: PoC binaries are dynamically compiled from source to avoid storing a large number of ELF files in git. Compilation uses static linking + strip to ensure cross-distribution compatibility.

--no-prepare / --no-post: Skip the Prepare or Post stage in the three-stage verification. Used for debugging purposes; in production environments it is recommended to retain the complete three stages.

--poc-user: In the Run stage, execute the PoC binary as the specified user, defaulting to nobody(uid=65534). Used to verify the LPE (local privilege escalation) path.

--no-force-demote: By default, PoC execution forcibly reduces privileges to the unprivileged user specified by --poc-user . This parameter disables forced privilege reduction.

Why sudo (root privileges) is needed

Reasons why the three-phase PoC verification requires root privileges:

  • Phase 1 (Prepare): needs to load kernel modules (modprobe algif_aead、modprobe esp4 etc.), create root-owned target files, configure security policies such as xfrm SA/SP
  • Phase 3 (Post): needs to read root files to verify the write result, unload kernel modules, clean up xfrm state, restore system state
  • Privilege separation: Phase 2 (Run) deliberately drops privileges to nobody, to verify whether the vulnerability allows an unprivileged user to perform privileged operations

Why CTF mode is used

Design rationale for CTF challenge mode:

  • Objective verification: objectively prove whether the vulnerability is triggered by reading/writing file contents, rather than subjective judgment
  • Privilege escalation evidence: the nobody user successfully writing to a root file = proof that an LPE path exists
  • Safety constraint: the PoC will not actually execute setuid(0), it only proves through file operations that the vulnerability can be exploited
  • Reproducibility: the CTF flag is randomly generated each time, ensuring that each verification is a real trigger rather than a cached result

Detector statistics

Metric Count
Total detectors 88
write_root_file mode 84
read_root_file mode 24
uaf mode 5

New features (v1.2.0)

PoC execution statistics module

Automatically outputs a detailed statistics report after each execution, including:

  • SUCCESS (EXPLOITABLE / NOT_EXPLOITABLE) classification statistics
  • FAILED (TIMEOUT / CRASH / MISSING_BIN / PARSE_ERROR / PERMISSION) breakdown
  • SKIPPED（NO_MODULE）
  • Failure analysis (root cause + recommendation + whether it is a PoC implementation issue)

Standardization of three PoC modes

Mode Target file permissions Verification method Count
write_root_file root:root 0644 nobody writes to a root file through a kernel vulnerability 86
read_root_file root:root 0400 nobody reads a root file through a kernel vulnerability 24
uaf N/A Use-After-Free exploitation verification 5

Enhanced evidence display

  • CTF flag verification (write mode: write and read back to confirm; read mode: read protected content)
  • Failure analysis engine (automatically determines the root cause and gives remediation suggestions)
  • PoC implementation issue flag ([PoC-IMPL] tags distinguish environment issues from code issues)
  • Output of a complete three-phase evidence chain

Output format

Detection summary

==============================================================
  sec-kernel v1.4.1 - Linux Kernel CVE Detection
==============================================================
  Kernel: 5.15.0-91-generic (x86_64)
  Mode: host (Linux Server)
==============================================================

==============================================================
  Detection Summary
==============================================================
  Total CVEs checked:     88
  Vulnerable:             3
  Not Vulnerable:         80
  Uncertain:              2
  PoC Exploitable:        2
  Execution time:         45.32s
==============================================================

PoC execution statistics

================================================================
  sec-kernel PoC Execution Statistics
================================================================
  Total Detectors:     88    (with PoC capability)
  PoC Executed:        83
  ------------------------------------------------------------
  SUCCESS (ran correctly):     78
    +- EXPLOITABLE:            2   (vulnerability confirmed)
    +- NOT_EXPLOITABLE:        76  (kernel patched/mitigated)
  ------------------------------------------------------------
  FAILED (execution error):    5
    +- TIMEOUT:                2
    +- CRASH:                  1
    +- MISSING_BIN:            0
    +- PARSE_ERROR:            2
    +- PERMISSION:             0
  ------------------------------------------------------------
  SKIPPED:                     2
    +- NO_MODULE:              2
  ------------------------------------------------------------
  Execution Time:         45.32s
================================================================

CTF challenge mode output example

⚠️  SECURITY DISCLAIMER / 安全声明
━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━
本工具仅限在已授权的隔离测试环境中使用。
严禁用于生产环境或未授权系统。违规使用需承担全部法律责任。
━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━

[Phase 1: Prepare] (root)
  ✓ Loaded kernel module: algif_aead
  ✓ Created target file: /tmp/sec-kernel-poc-XXXX/poc_target (root:root 0644)
  ✓ Initial content: writeme_a3f8b2c1

[Phase 2: Run] (nobody, uid=65534)
  CTF_READ_BEFORE:writeme_a3f8b2c1
  CTF_WRITE:ctf{164d74cd804f9361} (attempting...)
  CTF_READ_AFTER:ctf{164d74cd804f9361}
  CTF_FLAG:ctf{164d74cd804f9361}
  POC_RESULT:EXPLOITABLE

[Phase 3: Post] (root)
  ✓ File content verified: ctf{164d74cd804f9361} ✓ MATCH
  ✓ Cleanup completed
  ✓ System state restored

[RESULT] CVE-2026-31431: EXPLOITABLE (confidence=0.95)

Key output fields

Field Meaning
CTF_READ_BEFORE: Original file content read before PoC execution
CTF_WRITE: The CTF value that the PoC attempts to write
CTF_READ_AFTER: File content read after PoC execution
CTF_FLAG:ctf{xxx} The marker value of successful exploitation
POC_RESULT:EXPLOITABLE Vulnerability exploitable
POC_RESULT:NOT_EXPLOITABLE Vulnerability not exploitable (kernel has been fixed)

Result determination

Result Meaning Recommended action
EXPLOITABLE The current kernel has an exploitable vulnerability Upgrade the kernel immediately
NOT_EXPLOITABLE Vulnerability conditions not met or already fixed No action needed
DETECTION_ONLY Version matched but PoC not executed Further verification recommended

CTF privilege escalation verification evidence

The following CVEs have been verified for successful privilege escalation (EXPLOITABLE) in a real kernel environment via CTF challenge mode, with the CTF flag randomly generated each time.

CVE-2026-31431 (CRITICAL) - AF_ALG AEAD splice page cache poisoning

[Phase 1: Prepare] (root)
  Created CTF target: /tmp/sec-kernel-poc-XXXX/poc_target_canary
  mode=write_root_file, uid=0, perm=644
  Initial content: writeme_f9de12afe0d6da5a

[Phase 2: Run] (nobody, uid=65534)
  CTF_WRITE:ctf{dddb28301f24e3db} (attempting...)
  CTF_FLAG:ctf{dddb28301f24e3db}
  POC_RESULT:EXPLOITABLE

[Phase 3: Post] (root)
  CTF write_root_file PASSED: inner value matches (dddb28301f24e3db)
  Rollback executed: target file removed
  System state restored

[RESULT] CVE-2026-31431: EXPLOITABLE (confidence=0.95)
  Kernel: 6.6.87.2-microsoft-standard-WSL2
  Exploit path: AF_ALG AEAD authencesn + splice() -> page cache corruption

CVE-2026-PENDING-DIRTYFRAG (CRITICAL) - DirtyFrag ESP+RxRPC dual variant

[Phase 1: Prepare] (root)
  Created CTF target: /tmp/sec-kernel-poc-XXXX/poc_target_dirtyfrag
  mode=write_root_file, uid=0, perm=644, size=4096
  Module state snapshot: esp4=loaded

[Phase 2: Run] (nobody, uid=65534)
  CTF_WRITE:ctf{ab2084cd52cdad11} (attempting via rxrpc/rxkad...)
  RxRPC variant failed (EAFNOSUPPORT), trying ESP/xfrm fallback...
  CTF_WRITE:ctf{ab2084cd52cdad11} (attempting via esp/xfrm fallback...)
  CTF_FLAG:ctf{ab2084cd52cdad11}
  POC_RESULT:EXPLOITABLE

[Phase 3: Post] (root)
  CTF write_root_file PASSED: inner value matches (ab2084cd52cdad11)
  Rollback executed: target file removed
  System state restored

[RESULT] CVE-2026-PENDING-DIRTYFRAG: EXPLOITABLE (confidence=0.95)
  Kernel: 6.6.87.2-microsoft-standard-WSL2
  Exploit path: ESP/xfrm variant (RxRPC fallback) -> splice() page cache write
  Dual-variant: RxRPC (Ubuntu 24.04) / ESP (WSL2) automatic fallback

Three-stage execution flow

Phase 1 (root):   准备环境 — 加载模块、创建目标文件、记录初始状态
Phase 2 (nobody): 执行 PoC — 读原值 → 漏洞利用写入 → 读回验证
Phase 3 (root):   验证清理 — 独立确认写入结果、恢复系统状态

Supported CVEs

See the full CVE detection list at references/cve-list.md(88 kernel vulnerability detectors, all with CTF challenge mode verification enabled).

Covered subsystems: Netfilter/nf_tables (18) | eBPF/BPF (8) | Network/Socket (12) | TLS (7) | io_uring (3) | Memory/Page Cache (5) | Filesystem (3) | IPsec/xfrm (3) | ptrace/cred (3) | Others (23)

System requirements

  • Linux x86_64
  • Python 3.8+
  • root privileges (sudo)
  • Kernel module loading capability (modprobe)

Logs

PoC execution log:workspace/poc-{CVE-ID}.log Fallback path:/tmp/poc-{CVE-ID}.log(when workspace is not writable)