Hi Jonathan,
On 05/21/2012 03:28 PM, Jonathan M. Foote wrote:
From the CERT Triage Tools webpage
(
http://www.cert.org/vuls/discovery/triage.html):
'''
The CERT Triage Tools can be used to assist software vendors and analysts in identifying
the impact of defects discovered through techniques such as fuzz testing and
prioritizing
their remediation in the software development process. The CERT Triage Tools include
a GNU Debugger (GDB) extension called "exploitable" that classifies Linux
application
bugs by severity and a wrapper script for batch execution.
'''
The 'exploitable' GDB extension mentioned above is a Python script that can be
used
to determine how exploitable a crash is. I recently published a blog post with some
more information on the extension and how to use it:
http://www.cert.org/blogs/certcc/2012/04/cert_triage_tools_10.html
Josh Bressers and Steve Grubb, of Red Hat, have been investigating use
of the tools by your organization. I have CC’d them on this message.
(Josh and Steve: The first message I sent didn’t post to the mailing list
due to a clerical error on my part – feel free to ignore this re-send)
Regardless, I have been passively following the work your team has been
doing and thought our tools might be useful to you. If you have any questions,
comments, or ideas feel please feel free to drop me a line.
I decided to try it and installed CERT_triage_tools-1.0.tar.gz
into /usr/share/gdb/python. Then added
python import exploitable
exploitable
commands to our gdb script which we run on coredumps of crashed processes,
then crashed md5sum for testing. These two commands resulted in just
this output:
/usr/share/gdb/python/exploitable.py:105: UserWarning: Untested OS: Linux mammoth
3.3.6-3.fc16.i686.PAE #1 SMP Wed May 16 22:18:40 UTC 2012 i686
warnings.warn("Untested OS: %s" % " ".join([str(u) for u in
uname]))
Unable to read siginfo
My gdb is:
$ gdb --version
GNU gdb (GDB) Fedora (7.3.50.20110722-13.fc16)
so it appears new enough (readme.txt says "GDB 7.2 or later").
I looked into the problem and my current theory is that the problem is
in usage of gdb.parse_and_eval("$_siginfo.<something>") in gdb_wrapper.py
(two instances).
I verified that gdb is unable to access $_siginfo on coredumps
when I interactively run "print $_siginfo.<something>".
(At least my gdb on my kernel can't.)
I also verified by gdb source code inspection that
"Unable to read siginfo" message is indeed generated if $_siginfo
pseudo-variable can't be accesses.
However, when I tried to nail it down by modifying gdb_wrapper.py
code like this:
def si_signo(self):
print "HERE1"
sys.stdout.flush()
try:
print "HERE2a"
sys.stdout.flush()
z = gdb.parse_and_eval("$_siginfo.si_signo")
print "HERE2b"
sys.stdout.flush()
return z
except:
print "HERE3"
sys.stdout.flush()
return None
@memoized..
def si_addr(self):
print "HERE-1"
sys.stdout.flush()
try:
print "HERE-2a"
sys.stdout.flush()
z = gdb.parse_and_eval("$_siginfo._sifields._sigfault.si_addr")
print "HERE-2b"
sys.stdout.flush()
return z
except:
print "HERE-3"
sys.stdout.flush()
return None
the output I got was:
/usr/share/gdb/python/exploitable.py:105: UserWarning: Untested OS: Linux mammoth
3.3.6-3.fc16.i686.PAE #1 SMP Wed May 16 22:18:40 UTC 2012 i686
warnings.warn("Untested OS: %s" % " ".join([str(u) for u in
uname]))
HERE1
HERE2a
HERE2b
Unable to read siginfo
I expected:
HERE1
HERE2a
Unable to read siginfo
HERE2b
Seeing this, I'm a bit unsure about my analysis,
but at the moment I have no more ideas.
What do you think is happening here?
Is "exploitable" meant to work on coredumps?
--
vda