Skip to contentSkip to conversation

Test for CVE-2017-2618 in setprocattr

PATCH New Guangwen Feng 2 participants 3 messages Aug 31, 2017 – Oct 16, 2017

lore
Share & tools
lore

Guangwen Feng

author
#0 lore raw

PATCH 1/1 Test for CVE-2017-2618 in setprocattr

Signed-off-by Guangwen Feng <[email protected]>
---
 runtest/cve                   |  1 +
 testcases/cve/.gitignore      |  1 +
 testcases/cve/cve-2017-2618.c | 59 +++++++++++++++++++++++++++++++++++++++++++
 3 files changed, 61 insertions(+)
 create mode 100644 testcases/cve/cve-2017-2618.c
runtest/cve +1 -0
index 5b16e9e..e789b66 100644
@@ -11,6 +11,7 @@ cve-2016-4997 cve-2016-4997
 cve-2016-5195 dirtyc0w
 cve-2016-7042 cve-2016-7042
 cve-2016-7117 cve-2016-7117
+cve-2017-2618 cve-2017-2618
 cve-2017-2671 cve-2017-2671
 cve-2017-5669 cve-2017-5669
 cve-2017-6951 cve-2017-6951
testcases/cve/.gitignore +1 -0
index ea9036d..24036bc 100644
@@ -3,6 +3,7 @@ cve-2014-0196
 cve-2016-4997
 cve-2016-7042
 cve-2016-7117
+cve-2017-2618
 cve-2017-2671
 cve-2017-6951
 cve-2017-5669
testcases/cve/cve-2017-2618.c new file +59 -0

59 lines not on this page · raw message

Signature · 1 line
2.9.4
#1 lore raw

PATCH 1/1 Test for CVE-2017-2618 in setprocattr

Hello,

testcases/cve/cve-2017-2618.c line 36

Quoted 8 lines · Guangwen Feng
testcases/cve/cve-2017-2618.c new file +8 -0
+
+#include <errno.h>
+#include <stdlib.h>
+#include <unistd.h>
+#include "tst_test.h"
+
+#define LOOPS	100
+#define PATH_ATTRFS	"/proc/self/attr/fscreate"

Will this exist on all systems? I am guessing that if SELINUX is not configured in the kernel then this won't exist. So it is probably best to exit with TCONF if we can not find it.

Quoted 24 lines
testcases/cve/cve-2017-2618.c new file +23 -1
+
+static void do_test(void)
+{
+	int i, fd;
+
+	for (i = 0; i < LOOPS; i++) {
+		if (!SAFE_FORK()) {
+			fd = SAFE_OPEN(PATH_ATTRFS, O_WRONLY);
+			write(fd, "\n", 1);
+			SAFE_CLOSE(fd);
+			exit(0);
+		}
+
+		tst_reap_children();
+	}
+
+	tst_res(TPASS, "Bug not reproduced");
+}
+
+static struct tst_test test = {
+	.forks_child = 1,
+	.test_all = do_test,
+};
--
Quoted 1 line

2.9.4

Otherwise this looks good.

--
Thank you,
Richard.

author
#2 lore raw

PATCH 1/1 Test for CVE-2017-2618 in setprocattr

Hi, Richard

Thanks for your review, but it looks like this patch has been pushed. I will send a new patch to add the check.

Best Regards,
Guangwen Feng

Quoted 51 lines · Richard Palethorpe

Hello,

testcases/cve/cve-2017-2618.c line 36

Quoted 8 lines · Guangwen Feng
testcases/cve/cve-2017-2618.c new file +8 -0
+
+#include <errno.h>
+#include <stdlib.h>
+#include <unistd.h>
+#include "tst_test.h"
+
+#define LOOPS	100
+#define PATH_ATTRFS	"/proc/self/attr/fscreate"

Will this exist on all systems? I am guessing that if SELINUX is not configured in the kernel then this won't exist. So it is probably best to exit with TCONF if we can not find it.

Quoted 24 lines
testcases/cve/cve-2017-2618.c new file +23 -1
+
+static void do_test(void)
+{
+	int i, fd;
+
+	for (i = 0; i < LOOPS; i++) {
+		if (!SAFE_FORK()) {
+			fd = SAFE_OPEN(PATH_ATTRFS, O_WRONLY);
+			write(fd, "\n", 1);
+			SAFE_CLOSE(fd);
+			exit(0);
+		}
+
+		tst_reap_children();
+	}
+
+	tst_res(TPASS, "Bug not reproduced");
+}
+
+static struct tst_test test = {
+	.forks_child = 1,
+	.test_all = do_test,
+};
--
Quoted 1 line

2.9.4

Otherwise this looks good.

--
Thank you,
Richard.