Chronomaly

[carlospolop]

🤖 Automated Content Update

This PR was automatically generated by the HackTricks News Bot based on a technical blog post.

📝 Source Information

• Blog URL: https://github.com/farazsth98/chronomaly
• Blog Title: Chronomaly
• Suggested Section: Binary Exploitation -> Linux kernel exploitation - toctou (or add a new subsection under Linux kernel exploitation for Race Conditions/UAF with CPU timers & cross-cache heap shaping)

🎯 Content Summary

What this repo is (and what it provides)

Chronomaly is a Linux/Android kernel exploit for CVE-2025-38352 (noted as previously exploited in-the-wild). It targets vulnerable Linux kernels v5.10.x and was written/tested specifically on Linux kernel v5.10.157 (x86_64) running in QEMU. A key design goal stated in the README is that it does not require fixed kernel text offsets, so it is intended to work across vulnerable 5.10.x builds...

🔧 Technical Details

CPU-timer-assisted race exploitation (probabilistic windowing): When an exploit depends on a very small race window, use CPU timers to generate signal events at controllable times while a racing thread burns CPU (e.g., in race_func()). Expose whether timers fired by instrumenting the signal polling path (e.g., add printf() in the SIGUSR1 polling loop in free_func()). Tune a threshold parameter (here CPU_USAGE_THRESHOLD) so timers fire intermittently (not always), indicating the timer sometimes fires before thread exit and sometimes during exit—improving the chance of landing in the intended critical section.

Multi-process delay calibration into a specific kernel function’s race window: Coordinate a child and parent process such that the parent introduces a microsecond delay (here PARENT_SETTIME_DELAY_US) to collide with a second race window in a targeted kernel path (here s...

🤖 Agent Actions

Updated src/binary-exploitation/linux-kernel-exploitation/posix-cpu-timers-toctou-cve-2025-38352.md with Chronomaly exploitation guidance: added environment/config prerequisites, CPU-timer race tuning heuristics, parent/child alignment into send_sigqueue(), and cross-cache sigqueue→pipe buffer replacement caveats. Expanded references to include the Chronomaly PoC repo and the three-part analysis series.

---

This PR was automatically created by the HackTricks Feed Bot. Please review the changes carefully before merging.

[carlospolop]

🔗 Additional Context

Original Blog Post: https://github.com/farazsth98/chronomaly

Content Categories: Based on the analysis, this content was categorized under "Binary Exploitation -> Linux kernel exploitation - toctou (or add a new subsection under Linux kernel exploitation for Race Conditions/UAF with CPU timers & cross-cache heap shaping)".

Repository Maintenance:

• MD Files Formatting: 936 files processed

Review Notes:

• This content was automatically processed and may require human review for accuracy
• Check that the placement within the repository structure is appropriate
• Verify that all technical details are correct and up-to-date
• All .md files have been checked for proper formatting (headers, includes, etc.)

Bot Version: HackTricks News Bot v1.0