mirror of
https://github.com/RGBCube/serenity
synced 2025-07-25 14:57:35 +00:00
Kernel+LibELF: Don't blindly trust ELF symbol offsets in symbolication
It was possible to craft a custom ELF executable that when symbolicated would cause the kernel to read from user-controlled addresses anywhere in memory. You could then fetch this memory via /proc/PID/stack We fix this by making ELFImage hand out StringView rather than raw const char* for symbol names. In case a symbol offset is outside the ELF image, you get a null StringView. :^) Test: Kernel/elf-symbolication-kernel-read-exploit.cpp
This commit is contained in:
parent
60143c8d4e
commit
c6e552ac8f
9 changed files with 140 additions and 24 deletions
|
@ -51,7 +51,7 @@ private:
|
|||
|
||||
struct SortedSymbol {
|
||||
u32 address;
|
||||
const char* name;
|
||||
StringView name;
|
||||
};
|
||||
#ifdef KERNEL
|
||||
mutable OwnPtr<Region> m_sorted_symbols_region;
|
||||
|
|
Loading…
Add table
Add a link
Reference in a new issue