CVE-2026-46333 - GitLite

KO | EN

gitlite — search

#nlp #ios #http #deep-learning #svg #devops #generative-ai #cpp #kubernetes #gpt

CVE-2026-46333

(★ 39)

CVE-2026-46333

File Explorer

ZIP Download

CVE-2026-46333-shadow.c
CVE-2026-46333.c
README.md

# Use via CDN

jsDelivr

jsDelivr serves any public GitHub repository as a CDN with zero setup. Pick a version and a file to get a ready-to-paste link and snippet.

Version

File

Link

Example

Command Glossary

Commands referenced in this DOCs, explained below.

🔍

`git clone`

View Details ▼

Clone an existing repository.

git clone {{remote_repository_location}} {{path/to/directory}}

Clone an existing repository into a new directory (the default directory is the repository name):

git clone --recursive {{remote_repository_location}}

Clone an existing repository and its submodules:

git clone {{[-n|--no-checkout]}} {{remote_repository_location}}

Clone only the `.git` directory of an existing repository:

🔍

`chage`

View Details ▼

Change user account and password expiry information.

chage {{[-l|--list]}} {{username}}

List password information for the user:

sudo chage {{[-M|--maxdays]}} {{10}} {{username}}

Enable password expiration in 10 days:

sudo chage {{[-M|--maxdays]}} {{-1}} {{username}}

Disable password expiration:

// repository documentation

Was this content helpful?

★ 0 (0 ratings)

<div align="center">

<img width="1774" height="887" alt="ChatGPT Image May 17, 2026, 11_32_19 AM" src="https://github.com/user-attachments/assets/e9c56fe8-40a3-41f3-90f8-90df124c702e" />

**High-quality Proof of Concept** for the Linux kernel race condition vulnerability

![Linux](https://img.shields.io/badge/OS-Linux-000000?style=for-the-badge&logo=linux)
![Kernel](https://img.shields.io/badge/Kernel-≤6.15-orange?style=for-the-badge)
![Exploit](https://img.shields.io/badge/Exploit-Working-success?style=for-the-badge)
![License](https://img.shields.io/badge/License-MIT-green?style=for-the-badge)

</div>

**A clean and reliable proof-of-concept exploit for CVE-2026-46333** — Local information disclosure via race condition in the Linux kernel's process exit path.

---

## 🖼️ Screenshot

<img width="1920" height="952" alt="CVE-2026-46333" src="https://github.com/user-attachments/assets/e3f4fcb2-5fa7-4f1d-b1f9-39ee0b72f3be" />

*Successfully stealing SSH host private key and /etc/shadow on Kali Linux*

---

## 📌 About the Vulnerability

**CVE-2026-46333** (also known as **ssh-keysign-pwn**) is a race condition in the Linux kernel's `ptrace` and process exit logic (`do_exit()` → `exit_mm()` before `exit_files()`).

When a privileged process (e.g. SUID `ssh-keysign` or `chage`) has `mm == NULL` during exit, the dumpability check is bypassed, allowing an unprivileged local attacker to use `pidfd_getfd()` to steal open file descriptors.

**Impact**:  
- Steal SSH host private keys (`/etc/ssh/ssh_host_*_key`)
- Dump `/etc/shadow`
- Potential for further attacks using stolen credentials

**Discovered by**: Qualys  
**Fixed in**: Kernel commit `31e62c2ebbfdc3fe3dbdf5e02c92a9dc67087a3a` (May 2026)

---

## ✨ Features

- Original clean code (not copied from existing repos)
- High success rate
- Two working exploits:
  - SSH Host Private Key Stealer
  - `/etc/shadow` Stealer via `chage`
- Clean output with progress feedback
- No external dependencies
- Well commented

---

## 🛠️ Usage

### 1. Clone & Build

```bash
git clone https://github.com/0xBlackash/CVE-2026-46333.git
cd CVE-2026-46333
```

### 2. Run SSH Host Key Exploit

```bash
sudo ./CVE-2026-46333
```

### 3. Run Shadow File Exploit

```bash
sudo ./CVE-2026-46333-shadow
```

---

## 📂 Files

| File                        | Description                              |
|----------------------------|------------------------------------------|
| `cve-2026-46333.c`         | SSH host private keys stealer            |
| `cve-2026-46333-shadow.c`  | `/etc/shadow` stealer via chage          |
| `README.md`                | This file                                |

---

## 📖 Example Output

**SSH Key Stealer:**
```bash
[+] SUCCESS! Stolen fd 3 -> /etc/ssh/ssh_host_ecdsa_key (round 0)
-----BEGIN OPENSSH PRIVATE KEY-----
b3BlbnNzaC1rZXktdjEAAAAABG5vbmUAAAAEbm9uZQAAAAAAAAAB...
```

**Shadow Stealer:**
```bash
[+] SUCCESS! Stolen /etc/shadow (round 0)
root:*:19953:0:99999:7:::
kali:$y$j9T$zY1oKFxJlTgP2WcJhzbNl1$...
```

---

## 🛡️ Mitigation

- Update your kernel to **any version containing commit `31e62c2ebbfd...`**
- Recommended: Use latest stable kernel from your distribution
- Disable `EnableSSHKeysign` in `sshd_config` if not needed

---

## ⚠️ Legal Disclaimer

This exploit is for **educational and security research purposes only**.  
Use it **only on systems you own or have explicit written permission** to test.  
The author is not responsible for any misuse or damage.

---

## ⭐ Credits

- Vulnerability: Qualys
- PoC Development: Ashraf Zaryouh ""0xBlackash""
- Original Research: Various kernel researchers

---

## 📜 License

This project is licensed under the **MIT License** — feel free to use, modify, and distribute.

---

**Made with ❤️ for the security community**

*Keeping systems updated is the best defense.*