bpf prog to catch CVE-2024-3094.

CVE-2024-3094.bt

#!/bin/env -S BPFTRACE_LOG_SIZE=33554432 bpftrace --unsafe

/*
Date: 2024 04 02 22:10:43 CST UTC+8
Author: Delta<DeltaMail@qq.com>
Copyright © [2024]. All rights reserved.
*/

uprobe:/lib/x86_64-linux-gnu/libc.so.6:system
/ comm == "sshd" /
{
    printf("pid:%d, comm:%s, args:%s\n", pid, comm, str(arg0));

    if(!(@call_time[pid]))
    { // libcrypto.so:RSA_public_decrypt has not been called
        printf("%s\n", strftime("%F %T.%f", nsecs));
        printf("CVE-2024-3094 is being exploited now.\n");
        printf("system() was called before libcrypto.so:RSA_public_decrypt.\n");
        signal("SIGKILL");
    }
}

uprobe:/lib/x86_64-linux-gnu/libcrypto.so.3:RSA_public_decrypt
{
    @call_time[pid] = elapsed;
}