diff --git a/README.md b/README.md index afc331d31b038abdb15ba7948c5d88837c787e5f..2a75592d87b7e66e8a572664a2508567ca119bea 100644 --- a/README.md +++ b/README.md @@ -1,24 +1,3 @@ -### CVE-2017-8890 -Vulnerable kernel version: -- 3.10.105 -- 3.18.55 -- 4.4.70 - -vuln in inet_csk_clone_lock in net/ipv4/inet_connection_sock.c -- https://elixir.bootlin.com/linux/v3.10.105/source/net/ipv4/inet_connection_sock.c#L674 - -mc_list set in ip_mc_join_group in net/ipv4/igmp.c -- https://elixir.bootlin.com/linux/v3.10.105/source/net/ipv4/igmp.c#L1788 - -freed in sock_close > sock_release > (sock->ops->release) > inet_release in net/ipv4/af_inet.c (found using gdb) -- https://elixir.bootlin.com/linux/v3.10.105/source/net/ipv4/af_inet.c#L427 - -exact free of mc_list somewhow in ip_mc_drop_socket using kfree_rcu -- https://elixir.bootlin.com/linux/v3.10.105/source/net/ipv4/igmp.c#L2297 - -Using overwritten function pointer: -- Jop, Rop? How to get arbitrary read/write - ### GDB Commands ``` aarch64-linux-gnu-gdb linux-3.10.105/vmlinux diff --git a/compile.sh b/compile.sh index 6703fe9d41d4e73c47281f6b562d46110c689e3b..91ea9a8a15622252943a9878540169231e17098b 100755 --- a/compile.sh +++ b/compile.sh @@ -4,6 +4,6 @@ SCRIPTDIR=$(dirname "$0") cd $SCRIPTDIR/busybox-1.29.3/_install/ cp ../../rcS etc/init.d/rcS -aarch64-linux-gnu-gcc ../../CVE-2017-8890_PoC.c -o CVE-2017-8890_PoC -static -pthread -O0 +aarch64-linux-gnu-gcc ../../../MoreFreedomRoot/CVE-2017-8890_PoC.c -o CVE-2017-8890_PoC -static -pthread -O0 aarch64-linux-gnu-gcc ../../test_multicast.c -o test_multicast -static -pthread -O0 find . | cpio -o --format=newc > ../rootfs.img