Steal SSH host private keys and /etc/shadow via the ptrace_may_access mm-NULL bypass + pidfd_getfd. Pre-31e62c2ebbfd kernels. - 0xdeadbeefnetwork/ssh-keysign-pwn

Steal SSH host private keys and /etc/shadow via the ptrace_may_access mm-NULL bypass + pidfd_getfd. Pre-31e62c2ebbfd kernels. - 0xdeadbeefnetwork/ssh-keysign-pwn

Steal SSH host private keys and /etc/shadow via the ptrace_may_access mm-NULL bypass + pidfd_getfd. Pre-31e62c2ebbfd kernels. - 0xdeadbeefnetwork/ssh-keysign-pwn

strace -p gets EPERM on the server and works in a container on the Mac. Yama's rule is lineage, not 'child'; /proc/pid/mem to pidfd_getfd share one gate. Leaks: userns, setcap, PR_SET_PTRACER.

Steal SSH host private keys and /etc/shadow via the ptrace_may_access mm-NULL bypass + pidfd_getfd. Pre-31e62c2ebbfd kernels. - 0xdeadbeefnetwork/ssh-keysign-pwn

Security researchers at Qualys Threat Research Unit have disclosed a serious vulnerability in the Linux kernel that allows local, unprivileged users to escalate privileges to root on affected systems. The flaw, tracked as CVE-2026-46333, stems from a logic issue in how the kernel handles credential dropping during process termination, combined with reachable ptrace-family operations and the pidfd_getfd() system call. This combination creates a window in which a process that should no longer be accessible remains vulnerable to interception of its file descriptors and inter-process communication channels. According to the disclosure, attackers can exploit this condition to capture sensitive resources from privileged processes, including open file descriptors and authenticated communication channels. These can then be reused to access restricted data such as /etc/shadow, SSH host private keys stored under /etc/ssh, and other credential material. In some scenarios, the flaw can also be leveraged to execute arbitrary commands as root by hijacking system-level communication mechanisms like D-Bus interactions with systemd. The vulnerability has existed in the mainline Linux kernel since version 4.10-rc1, released in 2016, meaning a wide range of enterprise systems, cloud environments, and container hosts may be affected. Although upstream patches have already been developed and distributed, exploitation techniques have reportedly been circulating publicly, increasing the urgency for administrators to apply updates immediately. Qualys reported the issue responsibly in May 2026, and the Linux kernel security team quickly coordinated a fix, with the patch being publicly committed shortly afterward. Security experts warn that any local shell on a vulnerable system could potentially be escalated to full root compromise, making even limited user accounts or compromised CI environments a significant security risk until systems are updated.

Steal SSH host private keys and /etc/shadow via the ptrace_may_access mm-NULL bypass + pidfd_getfd. Pre-31e62c2ebbfd kernels. - 0xdeadbeefnetwork/ssh-keysign-pwn

Learn how the ptrace_may_access bug lets attackers steal root files like SSH keys and shadow file. Find out if your Linux distro is patched.

Related: #1760 Syscall: https://man7.org/linux/man-pages/man2/pidfd_getfd.2.html It should be possible to use this syscall to implement DuplicateAndClose, it seems with it Linux no longer fundament...

Steal SSH host private keys and /etc/shadow via the ptrace_may_access mm-NULL bypass + pidfd_getfd. Pre-31e62c2ebbfd kernels. - 0xdeadbeefnetwork/ssh-keysign-pwn

Steal SSH host private keys and /etc/shadow via the ptrace_may_access mm-NULL bypass + pidfd_getfd. Pre-31e62c2ebbfd kernels. - 0xdeadbeefnetwork/ssh-keysign-pwn

Steal SSH host private keys and /etc/shadow via the ptrace_may_access mm-NULL bypass + pidfd_getfd. Pre-31e62c2ebbfd kernels. - 0xdeadbeefnetwork/ssh-keysign-pwn

Posted by David Gonzalez on May 15 [Resending since I don't think my previous response made it due to incorrect type] Hi! (as Qualys just confirmed) Looking at the call graph for sys_pidfd_getfd we can see: sys_pidfd_getfd -> pidfd_getfd -> __pidfd_fget -> ptrace_may_access(task, PTRACE_MODE_ATTACH_REALCREDS) -> __ptrace_may_access If ptrace_may_access returns an error, the file is not returned....

Steal SSH host private keys and /etc/shadow via the ptrace_may_access mm-NULL bypass + pidfd_getfd. Pre-31e62c2ebbfd kernels. - 0xdeadbeefnetwork/ssh-keysign-pwn

Steal SSH host private keys and /etc/shadow via the ptrace_may_access mm-NULL bypass + pidfd_getfd. Pre-31e62c2ebbfd kernels. - 0xdeadbeefnetwork/ssh-keysign-pwn

Steal SSH host private keys and /etc/shadow via the ptrace_may_access mm-NULL bypass + pidfd_getfd. Pre-31e62c2ebbfd kernels. - 0xdeadbeefnetwork/ssh-keysign-pwn

Steal SSH host private keys and /etc/shadow via the ptrace_may_access mm-NULL bypass + pidfd_getfd. Pre-31e62c2ebbfd kernels. - 0xdeadbeefnetwork/ssh-keysign-pwn