RGBCube/serenity
1
Fork 0
mirror of https://github.com/RGBCube/serenity synced 2025-07-26 19:57:45 +00:00
Code Issues Activity Actions

Kernel+LibELF: Don't blindly trust ELF symbol offsets in symbolication

Browse source 
It was possible to craft a custom ELF executable that when symbolicated
would cause the kernel to read from user-controlled addresses anywhere
in memory. You could then fetch this memory via /proc/PID/stack

We fix this by making ELFImage hand out StringView rather than raw
const char* for symbol names. In case a symbol offset is outside the
ELF image, you get a null StringView. :^)

Test: Kernel/elf-symbolication-kernel-read-exploit.cpp
This commit is contained in:
Andreas Kling 2020-01-16 22:04:44 +01:00
parent 60143c8d4e
commit c6e552ac8f
9 changed files with 140 additions and 24 deletions
Download patch file Download diff file Expand all files Collapse all files

4
AK/Demangle.h
View file

@ -5,11 +5,11 @@
namespace AK {
inline String demangle(const char* name)
inline String demangle(const StringView& name)
{
#ifdef KERNEL
int status = 0;
auto* demangled_name = abi::__cxa_demangle(name, nullptr, nullptr, &status);
auto* demangled_name = abi::__cxa_demangle(String(name).characters(), nullptr, nullptr, &status);
auto string = String(status == 0 ? demangled_name : name);
if (status == 0)
kfree(demangled_name);