almkuznetsov/cve-2024-1441
이 저장소는 CVE-2024-1441 발견 과정의 퍼징(fuzzing) 및 분석 프로세스를 재현하기 위해 만들어졌습니다.
# 패키지 설치를 위한 2개 명령어
apt-get update
apt-get install
# git 명령어 1개
git clone
# 빌드 명령어 4개
meson
ninja
make
cargo build
# 환경 변수 설정을 위한 1개 명령어
export
# 퍼징 실행을 위한 1개 명령어
afl-fuzz
# 크래시 분석을 위한 2개 명령어
casr-afl
casr-cli
Docker 컨테이너 실행:
docker run --privileged --security-opt seccomp=unconfined -ti alt:p10
기본 종속성 설치 및 이 저장소 클론:
apt-get update
apt-get install -y git make
git clone --recurse-submodules --shallow-submodules https://github.com/almkuznetsov/CVE-2024-1441
libvirt 및 preeny 종속성 설치:
# libvirt 종속성 설치
apt-get install -y xsltproc xml-utils libgnutls-devel libnl-devel \
libdevmapper-devel libpciaccess-devel udev libudev-devel \
libpciaccess-devel libyajl-devel libpcap-devel libselinux-devel dnsmasq \
iptables radvd ebtables libsasl2-devel util-linux lvm2 libparted-devel \
parted dmsetup libdevmapper-devel open-iscsi libiscsi-devel libnuma-devel \
libcap-ng-devel libcurl-gnutls-compat libcurl-devel libaudit-devel \
pm-utils bridge-utils libblkid-devel libgcrypt-devel libp11-kit-devel \
libreadline-devel libtasn1-devel attr libxml2-devel xsltproc python3 \
python3-dev iproute2 dmidecode libtirpc-devel kmod autoconf-archive \
python3-module-flake8 gnutls-utils python3-module-docutils meson rpcgen \
libgio-devel
# preeny 종속성 설치
apt-get install -y libini_config-devel libseccomp-devel
AFL++ 및 해당 종속성 설치:
apt-get install -y AFLplusplus llvm15.0
CASR 종속성 설치:
apt-get install -y gdb rust rust-cargo
AFL++ 계측(instrumentation)으로 libvirt 빌드:
cd /CVE-2024-1441/libvirt/
export CC=afl-clang-lto \
CXX=afl-clang-lto++ \
CFLAGS="-O0 -Wframe-larger-than=30000" \
CXXFLAGS="-O0 -Wframe-larger-than=30000" \
AR=llvm-ar \
RANLIB=llvm-ranlib \
AS=llvm-as \
GIT_SSL_NO_VERIFY=1
meson build -Dsystem=true -Dgit_werror=disabled
cd build
ninja
preeny에서 desock 빌드:
cd /CVE-2024-1441/preeny/
export CC="gcc" \
CFLAGS="-Werror=frame-larger-than=70000"
make -C src desock.so
테스트 입력 생성:
cd /CVE-2024-1441/
mkdir input
echo "testinput" > input/1
퍼징 실행:
export INPUT=/CVE-2024-1441/input \
OUTPUT=/CVE-2024-1441/out \
LD_LIBRARY_PATH=/CVE-2024-1441/libvirt/build/src/ \
TARGET="/CVE-2024-1441/libvirt/build/src/libvirtd -l -f /CVE-2024-1441/libvirtd.conf" \
AFL_PRELOAD="$(ls /CVE-2024-1441/libvirt/build/src/*.so | tr -s '[:space:]' ' ') /CVE-2024-1441/preeny/src/desock.so"
afl-fuzz -i $INPUT -o $OUTPUT -- $TARGET
CASR 빌드:
git clone https://github.com/ispras/casr
cd casr
cargo build --release
CASR 분석 실행:
export LD_PRELOAD=" /CVE-2024-1441/preeny/src/desock.so"
./target/release/casr-afl -f -i /CVE-2024-1441/afl-out/ -o /CVE-2024-1441/casr-out -t 1
/CVE-2024-1441/casr/target/release/casr-cli /CVE-2024-1441/casr-out/cl1/id\:000000\,sig\:11\,src\:002081+001122\,time\:4318315404\,execs\:60143\,op\:splice\,rep\:1.casrep
분석 실패 시 백업:
/CVE-2024-1441/casr/target/release/casr-cli /CVE-2024-1441/backup/casr-out/cl1/id\:000000\,sig\:11\,src\:001498+001021\,time\:3766191045\,execs\:60441\,op\:splice\,rep\:1.casrep
문제가 발생한 경우:
echo core >/proc/sys/kernel/core_pattern