CVE-2023-0461

jichiep

An update on my attempt to repeat the exploitation of CVE-2023-0461. I managed to bypass KASLR by dumping a function pointer to tls_sw_push_pending_record_offset which is part of tls_context. The function pointer is at a known offset to the kernel base* (.text) address so if I subtract the offset from the pointer I'm left with the base address (which was randomly shifted by KASLR). I ran into quite a few problems with FUSE/xattr, but I can probably create a fake tls_context now with valid, but malicious function pointers, which I should be able to trigger with various operations. I'm not sure if I have all the prerequisites for creating a ROP/JOP chain though. There are pointers to data as well, which maybe could be used for R/W other memory. Or I could try freeing the xattr buffer using the double free of tls_context. Then allocate some easier to exploit object in there. No option seems obviously more attractive at the moment. *I guess if the TLS module weren't builtin, I'd only get he module's base address? IDK.