mirror of
https://github.com/SerenityOS/serenity
synced 2024-07-22 18:46:18 +00:00
c6e552ac8f
It was possible to craft a custom ELF executable that when symbolicated would cause the kernel to read from user-controlled addresses anywhere in memory. You could then fetch this memory via /proc/PID/stack We fix this by making ELFImage hand out StringView rather than raw const char* for symbol names. In case a symbol offset is outside the ELF image, you get a null StringView. :^) Test: Kernel/elf-symbolication-kernel-read-exploit.cpp
25 lines
449 B
C++
25 lines
449 B
C++
#pragma once
|
|
|
|
#include <AK/String.h>
|
|
#include <cxxabi.h>
|
|
|
|
namespace AK {
|
|
|
|
inline String demangle(const StringView& name)
|
|
{
|
|
#ifdef KERNEL
|
|
int status = 0;
|
|
auto* demangled_name = abi::__cxa_demangle(String(name).characters(), nullptr, nullptr, &status);
|
|
auto string = String(status == 0 ? demangled_name : name);
|
|
if (status == 0)
|
|
kfree(demangled_name);
|
|
return string;
|
|
#else
|
|
return name;
|
|
#endif
|
|
}
|
|
|
|
}
|
|
|
|
using AK::demangle;
|