kernelCTF: add CVE-2024-26582_mitigation_2

[federico-zanca]

Novelty-only kernelCTF submission exp795 for mitigation-v4-6.6.

This submission targets an already exploited vulnerability and claims only the novel techniques documented in docs/novel-techniques.md.

The submitted exploit demonstrates DirtyBPF, a technique to corrupt a BPF filter with a UAF.
docs/novel-techniques.md proposes the main techniques and variants.

Bug Hunters issue: https://issuetracker.google.com/issues/553474550

[google-cla]

Thanks for your pull request! It looks like this may be your first contribution to a Google open source project. Before we can look at your pull request, you'll need to sign a Contributor License Agreement (CLA).

View this failed invocation of the CLA check for more information.

For the most up to date status, view the checks section at the bottom of the pull request.

[federico-zanca]

I think the structure_check failure is caused by the legacy spreadsheet row for novelty-only submission exp795 having an empty CVE field.

This PR uses CVE-2024-26582_mitigation_2. The exp795 row already contains the corresponding upstream fix commit.

Could the spreadsheet entry for exp795 please be updated so that the structure check can be rerun?

• CVE: CVE-2024-26582
• Patch commit title: net: tls: fix use-after-free with partial reads and async decrypt

[federico-zanca]

The only check that is not passed is vuln_verify, it seems that the github actions script fails to find the commit patch for my exploit row in the spreadsheet. The reason is that I got the flag and submitted the form before the redesign of the spreadsheet, while the pull request was made a couple hours after this redesign. The script tries to fetch it only from the default tab of the spreadsheet, the one with gid=855892526, while my exploit (exp795) is in the "kernelCTF (old)" tab, that has gid=2095368189

This is the responsible part of the script

commit_hash = hash_from_url(
    public_csv[first_exp_id]["Patch commit"]
)

The commit patch is present in the row of exp795, I believe it's just a github actions problem

This is the commit patch ID 32b55c5ff9103b8508c1e04bfa5a08c64e7a925f

Could some moderator please fix this?

Edit:
Full commit patch link (as reported in the spreadsheet) https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id%3D32b55c5ff9103b8508c1e04bfa5a08c64e7a925f

[federico-zanca]

Thanks!