Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Fix UaF on Mira's kernel process (7.55) #159

Open
wants to merge 1 commit into
base: port/755
Choose a base branch
from
Open

Fix UaF on Mira's kernel process (7.55) #159

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
2 changes: 1 addition & 1 deletion kernel/Makefile
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -68,7 +68,7 @@ LIBS :=
C_DEFS := -D_KERNEL=1 -D_DEBUG -D_STANDALONE -D"MIRA_PLATFORM=${MIRA_PLATFORM}" -DMIRA_UNSUPPORTED_PLATFORMS -D__LP64__ -D_M_X64 -D__amd64__ -D__BSD_VISIBLE

# C++ Flags, -02 Optimizations break shit badly
CFLAGS := $(I_DIRS) $(C_DEFS) -fpic -m64 -O0 -fno-builtin -nodefaultlibs -nostdlib -nostdinc -fcheck-new -ffreestanding -fno-strict-aliasing -fno-exceptions -fno-asynchronous-unwind-tables -Wall -Werror -Wno-unknown-pragmas
CFLAGS := $(I_DIRS) $(C_DEFS) -fpic -m64 -O0 -fno-builtin -nodefaultlibs -nostdlib -nostdinc -fcheck-new -ffreestanding -fno-strict-aliasing -fno-exceptions -fno-asynchronous-unwind-tables -Wall -Wno-unknown-pragmas -mno-red-zone

# Assembly flags
SFLAGS := -m64 -nodefaultlibs -nostdlib
Expand Down
7 changes: 7 additions & 0 deletions kernel/src/Mira.cpp
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -224,6 +224,13 @@ extern "C" void mira_entry(void* args)

// At this point we don't need kernel context anymore
WriteLog(LL_Info, "Mira initialization complete");

// Try not to exit
int pipe_fds[2];
kpipe_t(pipe_fds, curthread);
char cha;
kread_t(pipe_fds[0], &cha, 1, curthread);

kthread_exit();
}

Expand Down
12 changes: 9 additions & 3 deletions kernel/src/Plugins/Substitute/Substitute.cpp
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -1084,7 +1084,9 @@ bool Substitute::OnProcessExecEnd(struct proc *p)

char* s_SandboxPath = nullptr;
char* s_Freepath = nullptr;
vn_fullpath(s_MainThread, fd->fd_jdir, &s_SandboxPath, &s_Freepath);
if (fd->fd_jdir != nullptr) {
vn_fullpath(s_MainThread, fd->fd_jdir, &s_SandboxPath, &s_Freepath);
}

if (s_SandboxPath == nullptr) {
if (s_Freepath)
Expand Down Expand Up @@ -1202,7 +1204,9 @@ bool Substitute::OnProcessExit(struct proc *p) {

char* s_SandboxPath = nullptr;
char* s_Freepath = nullptr;
vn_fullpath(s_MainThread, fd->fd_jdir, &s_SandboxPath, &s_Freepath);
if (fd->fd_jdir != nullptr) {
vn_fullpath(s_MainThread, fd->fd_jdir, &s_SandboxPath, &s_Freepath);
}

if (s_SandboxPath == nullptr) {
if (s_Freepath)
Expand Down Expand Up @@ -1290,7 +1294,9 @@ int Substitute::Sys_dynlib_dlsym_hook(struct thread* td, struct dynlib_dlsym_arg

char* s_SandboxPath = nullptr;
char* s_Freepath = nullptr;
vn_fullpath(s_MainThread, fd->fd_jdir, &s_SandboxPath, &s_Freepath);
if (fd->fd_jdir != nullptr) {
vn_fullpath(s_MainThread, fd->fd_jdir, &s_SandboxPath, &s_Freepath);
}

if (s_SandboxPath == nullptr) {
if (s_Freepath)
Expand Down
53 changes: 53 additions & 0 deletions kernel/src/Utils/SysWrappers.cpp
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -2520,3 +2520,56 @@ int ksandbox_path_t(char* path, struct thread* td)

return ret;
}

int kpipe_internal(int* ans, struct thread* td)
{
auto sv = (struct sysentvec*)kdlsym(self_orbis_sysvec);
struct sysent* sysents = sv->sv_table;
auto sys_pipe = (int(*)(struct thread*, struct pipe_args*))sysents[SYS_PIPE].sy_call;
if (!sys_pipe)
return -1;

int error;
struct pipe_args uap;

// clear errors
td->td_retval[0] = 0;

// call syscall
error = sys_pipe(td, &uap);
if (error)
return -error;

// return pipes
ans[0] = td->td_retval[0];
ans[1] = td->td_retval[1];
return 0;
}

int kpipe_t(int* ans, struct thread* td)
{
int ret = -EIO;
int retry = 0;

for (;;)
{
ret = kpipe_internal(ans, td);
if (ret < 0)
{
if (ret == -EINTR)
{
if (retry > MaxInterruptRetries)
break;

retry++;
continue;
}

return ret;
}

break;
}

return ret;
}
4 changes: 3 additions & 1 deletion kernel/src/Utils/SysWrappers.hpp
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -159,4 +159,6 @@ extern "C"
extern int klinkat_t(int fd1, const char *path1, int fd2, const char *path2, int flag, struct thread* td);

extern int ksandbox_path_t(char* path, struct thread* td);
};

extern int kpipe_t(int* fds, struct thread* td);
};
2 changes: 1 addition & 1 deletion loader/Makefile
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -59,7 +59,7 @@ LIBS :=
C_DEFS := -D_KERNEL=1 -D_DEBUG -D_STANDALONE -D"MIRA_PLATFORM=${MIRA_PLATFORM}" -DMIRA_UNSUPPORTED_PLATFORMS -D__LP64__ -D_M_X64 -D__amd64__ -D__BSD_VISIBLE

# C++ Flags, -02 Optimizations break shit badly
CFLAGS := $(I_DIRS) $(C_DEFS) -fpie -fPIC -m64 -std=c++17 -O0 -fno-builtin -nodefaultlibs -nostdlib -nostdinc -fcheck-new -ffreestanding -fno-strict-aliasing -fno-exceptions -fno-asynchronous-unwind-tables -Wall -Werror -Wno-unknown-pragmas
CFLAGS := $(I_DIRS) $(C_DEFS) -fpie -fPIC -m64 -std=c++17 -O0 -fno-builtin -nodefaultlibs -nostdlib -nostdinc -fcheck-new -ffreestanding -fno-strict-aliasing -fno-exceptions -fno-asynchronous-unwind-tables -Wall -Werror -Wno-unknown-pragmas -mno-red-zone

# Assembly flags
SFLAGS := -fPIE -m64 -nodefaultlibs -nostdlib
Expand Down