FM / security-band-aids

/usr/share/systemtap/examples/security-band-aids/

/usr/share/systemtap/examples/security-band-aids

Name	Size	Mode	Actions
cve-2008-0600.meta	209	0644	edit dl rm
cve-2008-0600.stp	144	0644	edit dl rm
cve-2008-0600.txt	345	0644	edit dl rm
cve-2011-4127.meta	209	0644	edit dl rm
cve-2011-4127.stp	296	0644	edit dl rm
cve-2012-0056.meta	209	0644	edit dl rm
cve-2012-0056.stp	75	0644	edit dl rm
cve-2013-2094.meta	209	0644	edit dl rm
cve-2013-2094.stp	418	0644	edit dl rm
cve-2014-7169.meta	209	0644	edit dl rm
cve-2014-7169.stp	82	0644	edit dl rm
cve-2015-0235.meta	209	0644	edit dl rm
cve-2015-0235.stp	2221	0644	edit dl rm
cve-2015-3456.meta	209	0644	edit dl rm
cve-2015-3456.stp	234	0644	edit dl rm
cve-2015-7547.meta	209	0644	edit dl rm
cve-2015-7547.stp	153	0644	edit dl rm
cve-2016-0728-templatized.stp	2552	0644	edit dl rm
cve-2016-0728.meta	209	0644	edit dl rm
cve-2016-0728.stp	2619	0644	edit dl rm
cve-2016-5195.meta	209	0644	edit dl rm
cve-2016-5195.stp	371	0644	edit dl rm
cve-2017-6074.meta	209	0644	edit dl rm
cve-2017-6074.stp	264	0644	edit dl rm
cve-2018-6485-templatized.stp	1521	0644	edit dl rm
cve-2018-6485.meta	209	0644	edit dl rm
cve-2018-6485.stp	1377	0644	edit dl rm
cve-2018-14634.meta	212	0644	edit dl rm
cve-2018-14634.stp	1190	0644	edit dl rm
cve-2018-1000001.meta	218	0644	edit dl rm
cve-2018-1000001.stp	1054	0644	edit dl rm
cve-2021-4034.meta	209	0644	edit dl rm
cve-2021-4034.stp	209	0644	edit dl rm
cve-2021-4155.meta	209	0644	edit dl rm
cve-2021-4155.stp	314	0644	edit dl rm
security-bandaid-template.stp	1968	0644	edit dl rm

Edit: /usr/share/systemtap/examples/security-band-aids/cve-2018-6485.stp (1377B)

// Work around CVE-2018-6485 and CVE-2018-6551 by imposing a limit
// on the incoming $bytes parameter.  If it's too close to SIZE_MAX,
// pre-CVE code could overflow.  With this band-aid, (a) the size will
// be reduced, to a number beneath the overflow range, but high
// enough that we are confident the subsequent malloc will still fail
// and/or (b) the process is killed

global hitcount
global misscount
global kill_p = 0
global fix_p = 0
global notify_p = 1

probe process("/lib*/libc.so.6").function("_int_malloc"),
      process("/lib*/libc.so.6").function("_int_memalign") {
  MALLOC_ALIGNMENT = 65536; /* over-estimate */
  MINSIZE = 64 + MALLOC_ALIGNMENT; /* way over-estimate */
  MAXSIZE = (probing_32bit_app() ? 4294967295 : 18446744073709551615) - MINSIZE*2;
  /* compare as numbers as if unsigned */
  if ((MAXSIZE > 0 && $bytes > 0 && $bytes > MAXSIZE) || 
      (MAXSIZE < 0 && $bytes < 0 && MAXSIZE < $bytes)) {
    hitcount <<< 1;
    if (notify_p)
      printf("cve-2018-6485 bandaid %s[%d] %d>%d kill?%d fix?%d\n",
	     execname(), tid(),
             $bytes, MAXSIZE,
	     kill_p, fix_p)
    if (kill_p)
      raise (9);
    if (fix_p)
      $bytes = MAXSIZE;
  }
  else
  misscount <<< 1;
}

probe timer.s(60) if (notify_p) {
  printf("cve-2018-6485 bandaid miss#%d hit#%d kill?%d fix?%d\n",
	 @count(misscount), @count(hitcount), kill_p, fix_p)
}

cmd: