a4ca6760d1
Probes six pinned Ruby images with no network and renders a compatibility matrix for the deserialization gadget surface. Reproducible with just matrix. The matrix carries three controls, because a table that reports one value everywhere cannot be distinguished from a probe that always returns the same answer. Two axes must show more than one state, and the ERB guard column is cross-checked against the published CVE-2026-41316 affected ranges. That third control is the load-bearing one: the probe reads source and knows nothing about NVD, and it agrees with the advisory on 6 of 6 images. Findings recorded in the research docs: The gadget surface moved rather than shrank. Net::WriteAdapter is reachable at baseline on Ruby 3.1 and 3.2 and gone from 3.3 onward, which is why vakzz-era chains needed no preloaded net/http on old Ruby. Gem::URI appears in the same release that took it away, and Gem::URI reached through an autoloaded Gem::SpecFetcher is exactly the bootstrap the 2024 chain relies on. One door closed and another opened in the same version, so a defense reasoning about the known gadget classes is reasoning about a moving target. The ERB @_init guard sits only on def_method. def_module and def_class delegate to it in both vulnerable and patched releases, so one check covers all three. The first probe measured all three independently and reported the delegates as unguarded even on patched erb 6.0.1.1. That was the probe being wrong, not the patch being incomplete, and it is corrected here. Marshal stream format is 4.8 on every image, so the M1 parser applies across the whole range unchanged. make and git are absent from every slim image, so rake is the only exec binary present on that family. |
||
|---|---|---|
| .. | ||
| base64-tool | ||
| c2-beacon | ||
| caesar-cipher | ||
| canary-token-generator | ||
| deserialization-gadget-lab | ||
| dns-lookup | ||
| firewall-rule-engine | ||
| hash-cracker | ||
| keylogger | ||
| linux-cis-hardening-auditor | ||
| linux-ebpf-security-tracer | ||
| metadata-scrubber-tool | ||
| network-traffic-analyzer | ||
| simple-port-scanner | ||
| simple-vulnerability-scanner | ||
| steganography-multi-tool | ||
| systemd-persistence-scanner | ||