Add kernelCTF CVE-2023-3777 (lts) #85
Conversation
|
Thanks for your pull request! It looks like this may be your first contribution to a Google open source project. Before we can look at your pull request, you'll need to sign a Contributor License Agreement (CLA). View this failed invocation of the CLA check for more information. For the most up to date status, view the checks section at the bottom of the pull request. |
| - Create a rule in `Vulnerable` with an immediate expr referencing `Victim`. | ||
| - Trigger the vulnerability by flushing the rule. This results in the `Victim` having a reference count of -1. | ||
| - Create an immediate expr in `Base` that references to the Victim, making the `Victim`'s reference count 0, and destroy the `Victim`. | ||
| - Spray counter exprs (struct expr) to place it at `Victim`'s chain->name. At this time, the counter exprs are allocated in the `kmalloc-cg-16`. |
There was a problem hiding this comment.
Please use the exact structure names, you are referring to struct nft_expr by saying struct expr, right?
There was a problem hiding this comment.
Yes. I updated this to the exploit.md.
| err(1, "mnl_socket_send"); | ||
| } | ||
|
|
||
| usleep(100*1000); |
There was a problem hiding this comment.
Why are you waiting here? What happens in the kernel you are waiting for? Can you make a comment about this? (Same for all usleep calls.)
There was a problem hiding this comment.
Since free is called from destroy worker, it waits for worker to finish. I added comments to the exploit.c and removed unnecessary sleeps.
| char * chain1_name = "chain1"; | ||
| char * chain2_name = "chain2"; | ||
| char * chain3_name = "chain3_12341234"; | ||
| char * chain4_name = "chain4_1234123412341234123412341234123412341234123412341234123412341234123412341234123412341234123412341234123412341234123412341234"; |
There was a problem hiding this comment.
Please comment on this why you choose this long name. (It's 131 bytes, so you'd like to allocate in kmalloc-cg-192?)
There was a problem hiding this comment.
The long name is used to allocate object in kmalloc-cg-192. I added comment about this to exploit.c
No description provided.