⬢ DragonFlyBSD Kernel Audit
DF-2965 / brk_exec.c
← back to finding ↓ download raw 
 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
/* DF-2965: brk/sbrk mappings are created RWX (VM_PROT_ALL).
 *
 * sbrk a page, copy a tiny function into it (ret 42), call it.
 * expect (vulnerable): prints 42 -> heap is executable.
 * expect (patched):    SIGSEGV at the indirect call (heap RW only).
 */
#include <stdio.h>
#include <stdlib.h>
#include <string.h>
#include <unistd.h>
#include <signal.h>
#include <setjmp.h>

static sigjmp_buf jb;
static volatile int got_sig;

static void
segv(int sig)
{
	got_sig = sig;
	siglongjmp(jb, 1);
}

int
main(void)
{
	unsigned char *heap;
	int rv = -1;

	heap = sbrk(4096);
	if (heap == (void *)-1) { perror("sbrk"); return 1; }

	/* mov eax,42; ret */
	heap[0] = 0xb8; heap[1] = 42; heap[2] = 0x00; heap[3] = 0x00;
	heap[4] = 0x00; heap[5] = 0xc3;

	signal(SIGSEGV, segv);
	if (sigsetjmp(jb, 1) == 0)
		rv = ((int (*)(void))heap)();
	else
		rv = -1;

	if (got_sig)
		printf("DF2965 heap exec: SIGSEGV (heap NOT executable, patched)\n");
	else
		printf("DF2965 heap exec: ret=%d (heap IS executable, RWX)\n", rv);
	return 0;
}