28 lines
No EOL
1.3 KiB
Text
28 lines
No EOL
1.3 KiB
Text
Source: https://bugs.chromium.org/p/project-zero/issues/detail?id=1164
|
|
|
|
This is an issue that allows unentitled root to read kernel frame
|
|
pointers, which might be useful in combination with a kernel memory
|
|
corruption bug.
|
|
|
|
By design, the syscall stack_snapshot_with_config() permits unentitled
|
|
root to dump information about all user stacks and kernel stacks.
|
|
While a target thread, along with the rest of the system, is frozen,
|
|
machine_trace_thread64() dumps its kernel stack.
|
|
machine_trace_thread64() walks up the kernel stack using the chain of
|
|
saved RBPs. It dumps the unslid kernel text pointers together with
|
|
unobfuscated frame pointers.
|
|
|
|
The attached PoC dumps a stackshot into the file stackshot_data.bin
|
|
when executed as root. The stackshot contains data like this:
|
|
|
|
00000a70 de 14 40 00 80 ff ff ff a0 be 08 77 80 ff ff ff |..@........w....|
|
|
00000a80 7b b8 30 00 80 ff ff ff 20 bf 08 77 80 ff ff ff |{.0..... ..w....|
|
|
00000a90 9e a6 30 00 80 ff ff ff 60 bf 08 77 80 ff ff ff |..0.....`..w....|
|
|
00000aa0 5d ac 33 00 80 ff ff ff b0 bf 08 77 80 ff ff ff |].3........w....|
|
|
|
|
The addresses on the left are unslid kernel text pointers; the
|
|
addresses on the right are valid kernel stack pointers.
|
|
|
|
|
|
Proof of Concept:
|
|
https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/42047.zip |