zhuyifei1999

The CVE is described in https://nvd.nist.gov/vuln/detail/CVE-2016-2383 and https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=a1b14d27ed0965838350f1377ff97c93ee383492

The vulnerability

The the verifier sometimes rewrites instructions into multiple instructions, as seen in the example in the commit message:

insns[0] insns[0]

zhuyifei1999

#define _GNU_SOURCE

#include <errno.h>
#include <fcntl.h>
#include <sched.h>
#include <stdio.h>
#include <sys/mount.h>
#include <sys/stat.h>
#include <sys/syscall.h>
#include <sys/types.h>

zhuyifei1999

#!/bin/bash
# based on: https://github.com/fomichev/dotfiles/blob/master/bin/q

usage() {
	echo "q [options] [path to bzImage] [script]"
	echo
	echo "Run it from the kernel directory (make sure .config is there)"
	echo
	echo "options:"
	echo "    m - run depmod and modprobe"

zhuyifei1999

import io
import os
import sys
import token
import tokenize


def trim(source, mod):
    prev_pdoc = False
    prev_ttext = ''

zhuyifei1999

diff --git a/src/google_breakpad/common/minidump_format.h b/src/google_breakpad/common/minidump_format.h
index 7b36d112..0899b4a3 100644
--- a/src/google_breakpad/common/minidump_format.h
+++ b/src/google_breakpad/common/minidump_format.h
@@ -318,7 +318,7 @@ typedef enum {
   MD_EXCEPTION_STREAM            =  6,  /* MDRawExceptionStream */
   MD_SYSTEM_INFO_STREAM          =  7,  /* MDRawSystemInfo */
   MD_THREAD_EX_LIST_STREAM       =  8,
-  MD_MEMORY_64_LIST_STREAM       =  9,
+  MD_MEMORY_64_LIST_STREAM       =  9,  /* MDRawMemory64List */

zhuyifei1999

// cc -O2 -g -o seccomp_emu_bench seccomp_emu_bench.c

#define _GNU_SOURCE
#include <assert.h>
#include <errno.h>
#include <stdio.h>
#include <stdlib.h>
#include <stdbool.h>
#include <time.h>
#include <unistd.h>

zhuyifei1999

# WARNING:
# This code is thread-unsafe.
# This code may break dicts if any key __hash__ are mutated as a side effect.
# Don't use in production or with threads unless you know what you're doing.

import types
import ctypes
import sys
from queue import Queue

zhuyifei1999

# docker build -t gcc-with-cpychecker .
FROM ubuntu:bionic

RUN apt-get update && apt-get install -y git g++-6 gcc-6-plugin-dev python3.7 libpython3.7 libpython3.7-dev python3-dev python3-six python3-pygments graphviz python3-lxml make

WORKDIR /usr/local/src
RUN git clone --branch v0.17 https://github.com/davidmalcolm/gcc-python-plugin.git gcc-python-plugin

WORKDIR /usr/local/src/gcc-python-plugin
RUN CC=gcc-6 CXX=g++-6 make PYTHON=python3 PYTHON_CONFIG=python3-config plugin

zhuyifei1999

# Inspired by:
# https://www.reddit.com/r/AskReddit/comments/ccbpzr/what_book_fucked_you_up_mentally/etmirvt/

import code


class NS(dict):
    def __setitem__(self, key, val):
        if key in self and hasattr(self[key], 'assign'):
            return self[key].assign.__get__(self[key])(val)

zhuyifei1999

#! /usr/bin/env python
# -*- coding: UTF-8 -*-
#
# This program is free software: you can redistribute it and/or modify
# it under the terms of the GNU General License as published by
# the Free Software Foundation, either version 3 of the License, or
# (at your option) any later version.
#
# This program is distributed in the hope that it will be useful,
# but WITHOUT ANY WARRANTY; without even the implied warranty of