ncapsa su-exec integer wraparound: strtol to strtoumax fix, pre-auth UID 0 bypass POC

Summary of Critical Vulnerability Information Vulnerability Overview Vulnerability Type: Privilege-drop bypass caused by unchecked numeric conversion / integer wraparound. Affected Product: Affected Versions: v0.3, v0.2, v0.1, and the current commit . Root Cause: The code directly uses the return value of as a valid numeric identity without performing range/sign validation, allowing negative numbers or excessively large values to wrap around to 0 (root). Impact Scope A local attacker who can influence the runtime identity identifiers passed to (such as / , / , / , etc.) can bypass the expected privilege drop, causing the target process to run as UID 0 (root). The impact depends on mounted resources, container capabilities, and deployment configuration; within a container, this allows reading root-readable files and executing root commands. Remediation Replace with for strict parsing. Reject the following inputs: - Empty strings - Leading or - Leading - Parsing containing - - Values that cannot be rounded to / - and - Numeric UIDs and passed entries (unless GID 0 or supplementary group 0 is not explicitly retained) POC / Exploit Code 1. Dockerfile (Build and Test Environment) ```dockerfile FROM debian:trixie-slim RUN apt-get update \ && apt-get install -y --no-install-recommends gcc libc-dev make \ && rm -rf /var/lib/apt/lists/* WORKDIR /src COPY src/su-exec.c . / RUN make clean all Install su-exec RUN install -D /src/su-exec /usr/local/bin/su-exec POC: su-exec-priv-drop-bypass.cve-request/poc/probe.c COPY su-exec-priv-drop-bypass.cve-request/poc/probe.c /probe.c COPY su-exec-priv-drop-bypass.cve-request/poc/Makefile /Makefile POC: su-exec-priv-drop-bypass.cve-request/poc/entrypoint-uid-only.sh COPY su-exec-priv-drop-bypass.cve-request/poc/entrypoint-uid-only.sh /entrypoint-uid-only POC: su-exec-priv-drop-bypass.cve-request/poc/entrypoint-uid-gid.sh COPY su-exec-priv-drop-bypass.cve-request/poc/entrypoint-uid-gid.sh /entrypoint-uid-gid RUN chmod +x /usr/local/bin/su-exec /entrypoint-uid-only /entrypoint-uid-gid RUN printf 'container-root-6000 secret\n' > /root/secret-6000 RUN printf 'container-root-6000 secret\n' > /root/group-secret-6000 RUN printf 'root-owned-app-conf\n' > /usr/local/share/root-owned-app-file RUN install -d /usr/local/share RUN printf 'root-owned-app-conf\n' > /usr/local/share/root-owned-app-file RUN chown 1000:1000 /tmp/chown-target RUN chown 1000:1000 /tmp/chown-target RUN chmod 600 /tmp/chown-target RUN chown 1000:1000 /tmp/chown-target RUN chown 1000:1000 /tmp/chown-target RUN chown 1000:1000 /tmp/chown-target RUN chown 1000:1000 /tmp/chown-target RUN chown 1000:1000 /tmp/chown-target RUN chown 1000:1000 /tmp/chown-target RUN chown 1000:1000 /tmp/chown-target RUN chown 1000:1000 /tmp/chown-target RUN chown 1000:1000 /tmp/chown-target RUN chown 1000:1000 /tmp/chown-target RUN chown 1000:1000 /tmp/chown-target RUN chown 1000:1000 /tmp/chown-target RUN chown 1000:1000 /tmp/chown-target RUN chown 1000:1000 /tmp/chown-target RUN chown 1000:1000 /tmp/chown-target RUN chown 1000:1000 /tmp/chown-target RUN chown 1000:1000 /tmp/chown-target RUN chown 1000:1000 /tmp/chown-target RUN chown 1000:1000 /tmp/chown-target RUN chown 1000:1000 /tmp/chown-target RUN chown 1000:1000 /tmp/chown-target RUN chown 1000:1000 /tmp/chown-target RUN chown 1000:1000 /tmp/chown-target RUN chown 1000:1000 /tmp/chown-target RUN chown 1000:1000 /tmp/chown-target RUN chown 1000:1000 /tmp/chown-target RUN chown 1000:1000 /tmp/chown-target RUN chown 1000:1000 /tmp/chown-target RUN chown 1000:1000 /tmp/chown-target RUN chown 1000:1000 /tmp/chown-target RUN chown 1000:1000 /tmp/chown-target RUN chown 1000:1000 /tmp/chown-target RUN chown 1000:1000 /tmp/chown-target RUN chown 1000:1000 /tmp/chown-target RUN chown 1000:1000 /tmp/chown-target RUN chown 1000:1000 /tmp/chown-target RUN chown 1000:1000 /tmp/chown-target RUN chown 1000:1000 /tmp/chown-target RUN chown 1000:1000 /tmp/chown-target RUN chown 1000:1000 /tmp/chown-target RUN chown 1000:1000 /tmp/chown-target RUN chown 1000:1000 /tmp/chown-target RUN chown 1000:1000 /tmp/chown-target RUN chown 1000:1000 /tmp/chown-target RUN chown 1000:1000 /tmp/chown-target RUN chown 1000:1000 /tmp/chown-target RUN chown 1000:1000 /tmp/chown-target RUN chown 1000:1000 /tmp/chown-target RUN chown 1000:1000 /tmp/chown-target RUN chown 1000:1000 /tmp/chown-target RUN chown 1000:1000 /tmp/chown-target RUN chown 1000:1000 /tmp/chown-target RUN chown 1000:1000 /tmp/chown-target RUN chown 1000:1000 /tmp/chown-target RUN chown 1000:1000 /tmp/chown-target RUN chown 1000:1000 /tmp/chown-target RUN chown 1000:1000 /tmp/chown-target RUN chown 1000:1000 /tmp/chown-target RUN chown 1000:1000 /tmp/chown-target RUN chown 1000:1000 /tmp/chown-target RUN chown 1000:1000 /tmp/chown-target RUN chown 1000:1000 /tmp/chown-target RUN chown 1000:1000 /tmp/chown-target RUN chown 1000:1000 /tmp/chown-target RUN chown 1000:1000 /tmp/chown-target RUN chown 1000:1000 /tmp/chown-target RUN chown 1000:1000 /tmp/cho

Goal Reached Thanks to every supporter — we hit 100%!

ncapsa su-exec integer wraparound: strtol to strtoumax fix, pre-auth UID 0 bypass POC

More from this source