|
The iPhone Wiki is no longer updated. Visit this article on The Apple Wiki for current information. |
Difference between revisions of "BPF STX Kernel Write Exploit"
(New page: bpf has a little virtual machine that executes packet filters. The machine includes a "scratch area" which is stored as an array on the stack. There are two instructions that write to th...) |
|||
| Line 19: | Line 19: | ||
p->k >= BPF_MEMWORDS) |
p->k >= BPF_MEMWORDS) |
||
return 0; |
return 0; |
||
| − | /* |
||
| + | This allows arbitrary locations on the stack to be modified. |
||
| − | This was actually fixed in FreeBSD: http://svn.freebsd.org/viewvc/base/head/sys/net/bpf_filter.c?r1=182380&r2=182379&pathrev=182380 |
+ | This bug was actually fixed in FreeBSD: http://svn.freebsd.org/viewvc/base/head/sys/net/bpf_filter.c?r1=182380&r2=182379&pathrev=182380 |
Revision as of 23:06, 14 May 2010
bpf has a little virtual machine that executes packet filters. The machine includes a "scratch area" which is stored as an array on the stack. There are two instructions that write to that array:
case BPF_ST:
mem[pc->k] = A;
continue;
case BPF_STX:
mem[pc->k] = X;
continue;
bpf_validate runs first to check the program, and handles BPF_ST correctly, but forgets to handle BPF_STX:
/*
* Check that memory operations use valid addresses.
*/
if ((BPF_CLASS(p->code) == BPF_ST ||
(BPF_CLASS(p->code) == BPF_LD &&
(p->code & 0xe0) == BPF_MEM)) &&
p->k >= BPF_MEMWORDS)
return 0;
This allows arbitrary locations on the stack to be modified.
This bug was actually fixed in FreeBSD: http://svn.freebsd.org/viewvc/base/head/sys/net/bpf_filter.c?r1=182380&r2=182379&pathrev=182380
