Exploit hidden __cerror

This commit is contained in:
joerg 2011-11-18 20:43:01 +00:00
parent ae5295ee5d
commit d7796dcc07
7 changed files with 14 additions and 42 deletions

View File

@ -30,7 +30,7 @@
* SUCH DAMAGE. * SUCH DAMAGE.
* *
* from: @(#)SYS.h 5.5 (Berkeley) 5/7/91 * from: @(#)SYS.h 5.5 (Berkeley) 5/7/91
* $NetBSD: SYS.h,v 1.10 2007/11/23 07:36:05 dsl Exp $ * $NetBSD: SYS.h,v 1.11 2011/11/18 20:43:01 joerg Exp $
*/ */
#include <machine/asm.h> #include <machine/asm.h>
@ -49,14 +49,8 @@
ENTRY(x); \ ENTRY(x); \
SYSTRAP(y) SYSTRAP(y)
#ifdef PIC
#define _SYSCALL_ERR \ #define _SYSCALL_ERR \
mov PIC_GOT(CERROR), %rcx; \
jmp *%rcx
#else
#define _SYSCALL_ERR \
jmp CERROR jmp CERROR
#endif
#define _SYSCALL(x,y) \ #define _SYSCALL(x,y) \
.text; _ALIGN_TEXT; \ .text; _ALIGN_TEXT; \

View File

@ -1,4 +1,4 @@
/* $NetBSD: __clone.S,v 1.2 2002/06/06 20:51:17 fvdl Exp $ */ /* $NetBSD: __clone.S,v 1.3 2011/11/18 20:43:01 joerg Exp $ */
/* /*
* Copyright (c) 2002 Wasabi Systems, Inc. * Copyright (c) 2002 Wasabi Systems, Inc.
@ -93,9 +93,4 @@ ENTRY(__clone)
5: 5:
popq %r13 popq %r13
popq %r12 popq %r12
#ifdef PIC
movq PIC_GOT(CERROR),%rdx
jmp *%rdx
#else
jmp CERROR jmp CERROR
#endif

View File

@ -1,4 +1,4 @@
/* $NetBSD: __vfork14.S,v 1.3 2003/08/07 16:42:37 agc Exp $ */ /* $NetBSD: __vfork14.S,v 1.4 2011/11/18 20:43:01 joerg Exp $ */
/*- /*-
* Copyright (c) 1990 The Regents of the University of California. * Copyright (c) 1990 The Regents of the University of California.
@ -36,7 +36,7 @@
#include <machine/asm.h> #include <machine/asm.h>
#if defined(SYSLIBC_SCCS) && !defined(lint) #if defined(SYSLIBC_SCCS) && !defined(lint)
RCSID("$NetBSD: __vfork14.S,v 1.3 2003/08/07 16:42:37 agc Exp $") RCSID("$NetBSD: __vfork14.S,v 1.4 2011/11/18 20:43:01 joerg Exp $")
#endif /* SYSLIBC_SCCS and not lint */ #endif /* SYSLIBC_SCCS and not lint */
#include "SYS.h" #include "SYS.h"
@ -57,9 +57,4 @@ ENTRY(__vfork14)
jmp *%r9 jmp *%r9
err: err:
pushq %r9 pushq %r9
#ifdef PIC
movq PIC_GOT(CERROR), %rcx
jmp *%rcx
#else
jmp CERROR jmp CERROR
#endif

View File

@ -1,4 +1,4 @@
/* $NetBSD: brk.S,v 1.3 2003/08/07 16:42:37 agc Exp $ */ /* $NetBSD: brk.S,v 1.4 2011/11/18 20:43:01 joerg Exp $ */
/*- /*-
* Copyright (c) 1990 The Regents of the University of California. * Copyright (c) 1990 The Regents of the University of California.
@ -36,7 +36,7 @@
#include <machine/asm.h> #include <machine/asm.h>
#if defined(SYSLIBC_SCCS) && !defined(lint) #if defined(SYSLIBC_SCCS) && !defined(lint)
RCSID("$NetBSD: brk.S,v 1.3 2003/08/07 16:42:37 agc Exp $") RCSID("$NetBSD: brk.S,v 1.4 2011/11/18 20:43:01 joerg Exp $")
#endif /* SYSLIBC_SCCS and not lint */ #endif /* SYSLIBC_SCCS and not lint */
#include "SYS.h" #include "SYS.h"
@ -68,8 +68,7 @@ ENTRY(_brk)
xorl %eax,%eax xorl %eax,%eax
ret ret
err: err:
movq PIC_GOT(CERROR),%rdx jmp CERROR
jmp *%rdx
#else #else
cmpq %rdi,_C_LABEL(__minbrk)(%rip) cmpq %rdi,_C_LABEL(__minbrk)(%rip)
jb 1f jb 1f

View File

@ -1,4 +1,4 @@
/* $NetBSD: exect.S,v 1.2 2003/08/07 16:42:37 agc Exp $ */ /* $NetBSD: exect.S,v 1.3 2011/11/18 20:43:01 joerg Exp $ */
/*- /*-
* Copyright (c) 1990 The Regents of the University of California. * Copyright (c) 1990 The Regents of the University of California.
@ -36,7 +36,7 @@
#include <machine/asm.h> #include <machine/asm.h>
#if defined(SYSLIBC_SCCS) && !defined(lint) #if defined(SYSLIBC_SCCS) && !defined(lint)
RCSID("$NetBSD: exect.S,v 1.2 2003/08/07 16:42:37 agc Exp $") RCSID("$NetBSD: exect.S,v 1.3 2011/11/18 20:43:01 joerg Exp $")
#endif /* SYSLIBC_SCCS and not lint */ #endif /* SYSLIBC_SCCS and not lint */
#include "SYS.h" #include "SYS.h"
@ -47,9 +47,4 @@ ENTRY(exect)
orb $(PSL_T>>8),1(%rsp) orb $(PSL_T>>8),1(%rsp)
popfq popfq
SYSTRAP(execve) SYSTRAP(execve)
#ifdef PIC
movq PIC_GOT(CERROR), %rcx
jmp *%rcx
#else
jmp CERROR jmp CERROR
#endif

View File

@ -1,4 +1,4 @@
/* $NetBSD: ptrace.S,v 1.2 2003/08/07 16:42:37 agc Exp $ */ /* $NetBSD: ptrace.S,v 1.3 2011/11/18 20:43:01 joerg Exp $ */
/*- /*-
* Copyright (c) 1990 The Regents of the University of California. * Copyright (c) 1990 The Regents of the University of California.
@ -36,7 +36,7 @@
#include <machine/asm.h> #include <machine/asm.h>
#if defined(SYSLIBC_SCCS) && !defined(lint) #if defined(SYSLIBC_SCCS) && !defined(lint)
RCSID("$NetBSD: ptrace.S,v 1.2 2003/08/07 16:42:37 agc Exp $") RCSID("$NetBSD: ptrace.S,v 1.3 2011/11/18 20:43:01 joerg Exp $")
#endif /* SYSLIBC_SCCS and not lint */ #endif /* SYSLIBC_SCCS and not lint */
#include "SYS.h" #include "SYS.h"
@ -54,9 +54,4 @@ ENTRY(ptrace)
jc err jc err
ret ret
err: err:
#ifdef PIC
movq PIC_GOT(CERROR), %rcx
jmp *%rcx
#else
jmp CERROR jmp CERROR
#endif

View File

@ -1,4 +1,4 @@
/* $NetBSD: sbrk.S,v 1.3 2008/07/02 20:07:43 rmind Exp $ */ /* $NetBSD: sbrk.S,v 1.4 2011/11/18 20:43:01 joerg Exp $ */
/*- /*-
* Copyright (c) 1990 The Regents of the University of California. * Copyright (c) 1990 The Regents of the University of California.
@ -36,7 +36,7 @@
#include <machine/asm.h> #include <machine/asm.h>
#if defined(SYSLIBC_SCCS) && !defined(lint) #if defined(SYSLIBC_SCCS) && !defined(lint)
RCSID("$NetBSD: sbrk.S,v 1.3 2008/07/02 20:07:43 rmind Exp $") RCSID("$NetBSD: sbrk.S,v 1.4 2011/11/18 20:43:01 joerg Exp $")
#endif /* SYSLIBC_SCCS and not lint */ #endif /* SYSLIBC_SCCS and not lint */
#include "SYS.h" #include "SYS.h"
@ -67,8 +67,7 @@ ENTRY(_sbrk)
out: out:
ret ret
err: err:
mov PIC_GOT(CERROR),%rdx jmp CERROR
jmp *%rdx
#else #else
movq CURBRK(%rip),%rax movq CURBRK(%rip),%rax
test %rdi,%rdi test %rdi,%rdi