BPF STX Kernel Write Exploit - Revision history

Dialexio: Underscore in the name.

2013-05-30T19:25:34Z

Underscore in the name.

5urd at 21:25, 31 January 2013

2013-01-31T21:25:48Z

IAdam1n: Stub fix.

2013-01-31T20:30:21Z

Stub fix.

5urd at 21:25, 24 December 2012

2012-12-24T21:25:50Z

5urd at 16:14, 19 February 2011

2011-02-19T16:14:27Z

5urd at 16:13, 19 February 2011

2011-02-19T16:13:51Z

Dialexio: Added to "Exploits" category.

2010-07-15T02:59:28Z

Added to "Exploits" category.

Comex at 23:06, 14 May 2010

2010-05-14T23:06:45Z

Comex: New page: bpf has a little virtual machine that executes packet filters. The machine includes a "scratch area" which is stored as an array on the stack. There are two instructions that write to th...

2010-05-14T23:06:00Z

New page: bpf has a little virtual machine that executes packet filters. The machine includes a "scratch area" which is stored as an array on the stack. There are two instructions that write to th...

New page

bpf has a little virtual machine that executes packet filters. The machine includes a "scratch area" which is stored as an array on the stack. There are two instructions that write to that array:

case BPF_ST:
mem[pc->k] = A;
continue;

case BPF_STX:
mem[pc->k] = X;
continue;

bpf_validate runs first to check the program, and handles BPF_ST correctly, but forgets to handle BPF_STX:

/*
* Check that memory operations use valid addresses.
*/
if ((BPF_CLASS(p->code) == BPF_ST ||
(BPF_CLASS(p->code) == BPF_LD &&
(p->code & 0xe0) == BPF_MEM)) &&
p->k >= BPF_MEMWORDS)
return 0;
/*

This was actually fixed in FreeBSD: http://svn.freebsd.org/viewvc/base/head/sys/net/bpf_filter.c?r1=182380&r2=182379&pathrev=182380

← Older revision		Revision as of 19:25, 30 May 2013
Line 1:		Line 1:
		+	{{DISPLAYTITLE:BPF_STX Kernel Write Exploit}}
	bpf has a little virtual machine that executes packet filters. The machine includes a "scratch area" which is stored as an array on the stack. There are two instructions that write to that array:		bpf has a little virtual machine that executes packet filters. The machine includes a "scratch area" which is stored as an array on the stack. There are two instructions that write to that array:

@@ Line 24: / Line 24: @@
 This bug was actually fixed in FreeBSD. [http://svn.freebsd.org/viewvc/base/head/sys/net/bpf_filter.c?r1=182380&r2=182379&pathrev=182380]
-{{stub|Exploit}}
+{{stub|exploit}}
 [[Category:Exploits]]

@@ Line 24: / Line 24: @@
 This bug was actually fixed in FreeBSD. [http://svn.freebsd.org/viewvc/base/head/sys/net/bpf_filter.c?r1=182380&r2=182379&pathrev=182380]
-{{stub|exploits}}
+{{stub|Exploit}}
 [[Category:Exploits]]

@@ Line 24: / Line 24: @@
 This bug was actually fixed in FreeBSD. [http://svn.freebsd.org/viewvc/base/head/sys/net/bpf_filter.c?r1=182380&r2=182379&pathrev=182380]
-{{stub|firmware}}
+{{stub|exploits}}
 [[Category:Exploits]]

@@ Line 24: / Line 24: @@
 This bug was actually fixed in FreeBSD. [http://svn.freebsd.org/viewvc/base/head/sys/net/bpf_filter.c?r1=182380&r2=182379&pathrev=182380]
-{{stub|filesystem}}
+{{stub|firmware}}
 [[Category:Exploits]]

← Older revision		Revision as of 16:13, 19 February 2011
Line 24:		Line 24:
	This bug was actually fixed in FreeBSD. [http://svn.freebsd.org/viewvc/base/head/sys/net/bpf_filter.c?r1=182380&r2=182379&pathrev=182380]		This bug was actually fixed in FreeBSD. [http://svn.freebsd.org/viewvc/base/head/sys/net/bpf_filter.c?r1=182380&r2=182379&pathrev=182380]

		+	{{stub\|filesystem}}
	[[Category:Exploits]]		[[Category:Exploits]]

← Older revision		Revision as of 02:59, 15 July 2010
Line 22:		Line 22:
	This allows arbitrary locations on the stack to be modified.		This allows arbitrary locations on the stack to be modified.

−	This bug was actually fixed in FreeBSD: http://svn.freebsd.org/viewvc/base/head/sys/net/bpf_filter.c?r1=182380&r2=182379&pathrev=182380	+	This bug was actually fixed in FreeBSD. [http://svn.freebsd.org/viewvc/base/head/sys/net/bpf_filter.c?r1=182380&r2=182379&pathrev=182380]
		+
		+	[[Category:Exploits]]

@@ Line 19: / Line 19: @@
             p->k >= BPF_MEMWORDS)
             return 0;
-This was actually fixed in FreeBSD: http://svn.freebsd.org/viewvc/base/head/sys/net/bpf_filter.c?r1=182380&r2=182379&pathrev=182380
+This bug was actually fixed in FreeBSD: http://svn.freebsd.org/viewvc/base/head/sys/net/bpf_filter.c?r1=182380&r2=182379&pathrev=182380