FM / security-band-aids

/usr/share/systemtap/examples/security-band-aids/

/usr/share/systemtap/examples/security-band-aids

Name	Size	Mode	Actions
cve-2008-0600.meta	209	0644	edit dl rm
cve-2008-0600.stp	144	0644	edit dl rm
cve-2008-0600.txt	345	0644	edit dl rm
cve-2011-4127.meta	209	0644	edit dl rm
cve-2011-4127.stp	296	0644	edit dl rm
cve-2012-0056.meta	209	0644	edit dl rm
cve-2012-0056.stp	75	0644	edit dl rm
cve-2013-2094.meta	209	0644	edit dl rm
cve-2013-2094.stp	418	0644	edit dl rm
cve-2014-7169.meta	209	0644	edit dl rm
cve-2014-7169.stp	82	0644	edit dl rm
cve-2015-0235.meta	209	0644	edit dl rm
cve-2015-0235.stp	2221	0644	edit dl rm
cve-2015-3456.meta	209	0644	edit dl rm
cve-2015-3456.stp	234	0644	edit dl rm
cve-2015-7547.meta	209	0644	edit dl rm
cve-2015-7547.stp	153	0644	edit dl rm
cve-2016-0728-templatized.stp	2552	0644	edit dl rm
cve-2016-0728.meta	209	0644	edit dl rm
cve-2016-0728.stp	2619	0644	edit dl rm
cve-2016-5195.meta	209	0644	edit dl rm
cve-2016-5195.stp	371	0644	edit dl rm
cve-2017-6074.meta	209	0644	edit dl rm
cve-2017-6074.stp	264	0644	edit dl rm
cve-2018-6485-templatized.stp	1521	0644	edit dl rm
cve-2018-6485.meta	209	0644	edit dl rm
cve-2018-6485.stp	1377	0644	edit dl rm
cve-2018-14634.meta	212	0644	edit dl rm
cve-2018-14634.stp	1190	0644	edit dl rm
cve-2018-1000001.meta	218	0644	edit dl rm
cve-2018-1000001.stp	1054	0644	edit dl rm
cve-2021-4034.meta	209	0644	edit dl rm
cve-2021-4034.stp	209	0644	edit dl rm
cve-2021-4155.meta	209	0644	edit dl rm
cve-2021-4155.stp	314	0644	edit dl rm
security-bandaid-template.stp	1968	0644	edit dl rm

Edit: /usr/share/systemtap/examples/security-band-aids/cve-2018-6485-templatized.stp (1521B)

#!/usr/bin/stap -g -m CVE_2018_6485

// Work around CVE-2018-6485 and CVE-2018-6551 by imposing a limit
// on the incoming $bytes parameter.  If it's too close to SIZE_MAX,
// pre-CVE code could overflow.  With this band-aid, (a) the size will
// be reduced, to a number beneath the overflow range, but high
// enough that we are confident the subsequent malloc will still fail
// and/or (b) the process is killed

global kill_p = 0

probe process("/lib*/libc.so.6").function("_int_malloc"),
      process("/lib*/libc.so.6").function("_int_memalign")
      if(cve_enabled_p) {
  MALLOC_ALIGNMENT = 65536; /* over-estimate */
  MINSIZE = 64 + MALLOC_ALIGNMENT; /* way over-estimate */
  MAXSIZE = (probing_32bit_app() ? 4294967295 : 18446744073709551615) - MINSIZE*2;
  /* compare as numbers as if unsigned */
  if ((MAXSIZE > 0 && $bytes > 0 && $bytes > MAXSIZE) ||
      (MAXSIZE < 0 && $bytes < 0 && MAXSIZE < $bytes)) {
    cve_count_metric("hit")
    if (cve_notify_p)
      printf("cve-2018-6485 bandaid %s[%d] %d>%d kill?%d fix?%d\n",
	     execname(), tid(),
             $bytes, MAXSIZE,
	     kill_p, cve_fix_p)
    if (kill_p)
      raise (9);
    if (cve_fix_p)
      $bytes = MAXSIZE;
  }
  else
    cve_count_metric("miss")
}

probe timer.s(60) if(cve_enabled_p) {
  if (cve_notify_p)
    printf("cve-2018-6485 bandaid miss#%d hit#%d kill?%d fix?%d\n",
	    cve_metrics["miss"], cve_metrics["hit"], kill_p, cve_fix_p)
}

# Take a look at /proc/systemtap/CVE_2018_6485/* for parameters and prometheus metrics

cmd: