| // Copyright (c) 2013 Google Inc. |
| // All rights reserved. |
| // |
| // Redistribution and use in source and binary forms, with or without |
| // modification, are permitted provided that the following conditions are |
| // met: |
| // |
| // * Redistributions of source code must retain the above copyright |
| // notice, this list of conditions and the following disclaimer. |
| // * Redistributions in binary form must reproduce the above |
| // copyright notice, this list of conditions and the following disclaimer |
| // in the documentation and/or other materials provided with the |
| // distribution. |
| // * Neither the name of Google Inc. nor the names of its |
| // contributors may be used to endorse or promote products derived from |
| // this software without specific prior written permission. |
| // |
| // THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS |
| // "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT |
| // LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR |
| // A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT |
| // OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, |
| // SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT |
| // LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, |
| // DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY |
| // THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT |
| // (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE |
| // OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. |
| |
| // exploitability_linux.cc: Linux specific exploitability engine. |
| // |
| // Provides a guess at the exploitability of the crash for the Linux |
| // platform given a minidump and process_state. |
| // |
| // Author: Matthew Riley |
| |
| #include "processor/exploitability_linux.h" |
| |
| #include "google_breakpad/common/minidump_exception_linux.h" |
| #include "google_breakpad/processor/call_stack.h" |
| #include "google_breakpad/processor/process_state.h" |
| #include "google_breakpad/processor/stack_frame.h" |
| #include "processor/logging.h" |
| |
| namespace { |
| |
| // This function in libc is called if the program was compiled with |
| // -fstack-protector and a function's stack canary changes. |
| const char kStackCheckFailureFunction[] = "__stack_chk_fail"; |
| |
| // This function in libc is called if the program was compiled with |
| // -D_FORTIFY_SOURCE=2, a function like strcpy() is called, and the runtime |
| // can determine that the call would overflow the target buffer. |
| const char kBoundsCheckFailureFunction[] = "__chk_fail"; |
| |
| } // namespace |
| |
| namespace google_breakpad { |
| |
| ExploitabilityLinux::ExploitabilityLinux(Minidump *dump, |
| ProcessState *process_state) |
| : Exploitability(dump, process_state) { } |
| |
| ExploitabilityRating ExploitabilityLinux::CheckPlatformExploitability() { |
| // Check the crashing thread for functions suggesting a buffer overflow or |
| // stack smash. |
| if (process_state_->requesting_thread() != -1) { |
| CallStack* crashing_thread = |
| process_state_->threads()->at(process_state_->requesting_thread()); |
| const vector<StackFrame*>& crashing_thread_frames = |
| *crashing_thread->frames(); |
| for (size_t i = 0; i < crashing_thread_frames.size(); ++i) { |
| if (crashing_thread_frames[i]->function_name == |
| kStackCheckFailureFunction) { |
| return EXPLOITABILITY_HIGH; |
| } |
| |
| if (crashing_thread_frames[i]->function_name == |
| kBoundsCheckFailureFunction) { |
| return EXPLOITABILITY_HIGH; |
| } |
| } |
| } |
| |
| // Getting exception data. (It should exist for all minidumps.) |
| MinidumpException *exception = dump_->GetException(); |
| if (exception == NULL) { |
| BPLOG(INFO) << "No exception record."; |
| return EXPLOITABILITY_ERR_PROCESSING; |
| } |
| const MDRawExceptionStream *raw_exception_stream = exception->exception(); |
| if (raw_exception_stream == NULL) { |
| BPLOG(INFO) << "No raw exception stream."; |
| return EXPLOITABILITY_ERR_PROCESSING; |
| } |
| |
| // Checking for benign exceptions that caused the crash. |
| if (this->BenignCrashTrigger(raw_exception_stream)) { |
| return EXPLOITABILITY_NONE; |
| } |
| |
| // Check if the instruction pointer is in a valid instruction region |
| // by finding if it maps to an executable part of memory. |
| uint64_t instruction_ptr = 0; |
| uint64_t stack_ptr = 0; |
| |
| const MinidumpContext *context = exception->GetContext(); |
| if (context == NULL) { |
| BPLOG(INFO) << "No exception context."; |
| return EXPLOITABILITY_ERR_PROCESSING; |
| } |
| |
| // Getting the instruction pointer. |
| if (!context->GetInstructionPointer(&instruction_ptr)) { |
| BPLOG(INFO) << "Failed to retrieve instruction pointer."; |
| return EXPLOITABILITY_ERR_PROCESSING; |
| } |
| |
| // Getting the stack pointer. |
| if (!context->GetStackPointer(&stack_ptr)) { |
| BPLOG(INFO) << "Failed to retrieve stack pointer."; |
| return EXPLOITABILITY_ERR_PROCESSING; |
| } |
| |
| // Checking for the instruction pointer in a valid instruction region. |
| if (!this->InstructionPointerInCode(instruction_ptr) || |
| this->StackPointerOffStack(stack_ptr)) { |
| return EXPLOITABILITY_HIGH; |
| } |
| |
| // There was no strong evidence suggesting exploitability, but the minidump |
| // does not appear totally benign either. |
| return EXPLOITABILITY_INTERESTING; |
| } |
| |
| bool ExploitabilityLinux::StackPointerOffStack(uint64_t stack_ptr) { |
| MinidumpLinuxMapsList *linux_maps_list = dump_->GetLinuxMapsList(); |
| // Inconclusive if there are no mappings available. |
| if (!linux_maps_list) { |
| return false; |
| } |
| const MinidumpLinuxMaps *linux_maps = |
| linux_maps_list->GetLinuxMapsForAddress(stack_ptr); |
| // Checks if the stack pointer maps to a valid mapping and if the mapping |
| // is not the stack. If the mapping has no name, it is inconclusive whether |
| // it is off the stack. |
| return !linux_maps || |
| (linux_maps->GetPathname().compare("") && |
| linux_maps->GetPathname().compare("[stack]")); |
| } |
| |
| bool ExploitabilityLinux::InstructionPointerInCode(uint64_t instruction_ptr) { |
| // Get Linux memory mapping from /proc/self/maps. Checking whether the |
| // region the instruction pointer is in has executable permission can tell |
| // whether it is in a valid code region. If there is no mapping for the |
| // instruction pointer, it is indicative that the instruction pointer is |
| // not within a module, which implies that it is outside a valid area. |
| MinidumpLinuxMapsList *linux_maps_list = dump_->GetLinuxMapsList(); |
| const MinidumpLinuxMaps *linux_maps = |
| linux_maps_list ? |
| linux_maps_list->GetLinuxMapsForAddress(instruction_ptr) : NULL; |
| return linux_maps ? linux_maps->IsExecutable() : false; |
| } |
| |
| bool ExploitabilityLinux::BenignCrashTrigger(const MDRawExceptionStream |
| *raw_exception_stream) { |
| // Check the cause of crash. |
| // If the exception of the crash is a benign exception, |
| // it is probably not exploitable. |
| switch (raw_exception_stream->exception_record.exception_code) { |
| case MD_EXCEPTION_CODE_LIN_SIGHUP: |
| case MD_EXCEPTION_CODE_LIN_SIGINT: |
| case MD_EXCEPTION_CODE_LIN_SIGQUIT: |
| case MD_EXCEPTION_CODE_LIN_SIGTRAP: |
| case MD_EXCEPTION_CODE_LIN_SIGABRT: |
| case MD_EXCEPTION_CODE_LIN_SIGFPE: |
| case MD_EXCEPTION_CODE_LIN_SIGKILL: |
| case MD_EXCEPTION_CODE_LIN_SIGUSR1: |
| case MD_EXCEPTION_CODE_LIN_SIGUSR2: |
| case MD_EXCEPTION_CODE_LIN_SIGPIPE: |
| case MD_EXCEPTION_CODE_LIN_SIGALRM: |
| case MD_EXCEPTION_CODE_LIN_SIGTERM: |
| case MD_EXCEPTION_CODE_LIN_SIGCHLD: |
| case MD_EXCEPTION_CODE_LIN_SIGCONT: |
| case MD_EXCEPTION_CODE_LIN_SIGSTOP: |
| case MD_EXCEPTION_CODE_LIN_SIGTSTP: |
| case MD_EXCEPTION_CODE_LIN_SIGTTIN: |
| case MD_EXCEPTION_CODE_LIN_SIGTTOU: |
| case MD_EXCEPTION_CODE_LIN_SIGURG: |
| case MD_EXCEPTION_CODE_LIN_SIGXCPU: |
| case MD_EXCEPTION_CODE_LIN_SIGXFSZ: |
| case MD_EXCEPTION_CODE_LIN_SIGVTALRM: |
| case MD_EXCEPTION_CODE_LIN_SIGPROF: |
| case MD_EXCEPTION_CODE_LIN_SIGWINCH: |
| case MD_EXCEPTION_CODE_LIN_SIGIO: |
| case MD_EXCEPTION_CODE_LIN_SIGPWR: |
| case MD_EXCEPTION_CODE_LIN_SIGSYS: |
| case MD_EXCEPTION_CODE_LIN_DUMP_REQUESTED: |
| return true; |
| break; |
| default: |
| return false; |
| break; |
| } |
| } |
| |
| } // namespace google_breakpad |