feature: out-of-bound write primitive and an exploit

Makefile

@@ -14,6 +14,7 @@ all:
 	gcc drill_uaf_w_pipe_buffer.c -Wall -static -o drill_uaf_w_pipe_buffer
 	gcc drill_uaf_w_pte.c -Wall -static -o drill_uaf_w_pte -lrt -lpthread
 	gcc drill_uaf_w_pud.c -Wall -static -o drill_uaf_w_pud -lrt -lpthread
+	gcc drill_oob_w_pipe_buffer.c -Wall -static -o drill_oob_w_pipe_buffer
 	make -C $(KPATH) M=$(PWD) modules
 
 clean:
@@ -26,3 +27,4 @@ clean:
 	rm drill_uaf_w_pipe_buffer
 	rm drill_uaf_w_pte
 	rm drill_uaf_w_pud
+	rm drill_oob_w_pipe_buffer

README.md

@@ -17,6 +17,7 @@ __Contents:__
 | __drill_uaf_w_pipe_buffer.c__ | a basic a UAF exploit that writes into a freed `drill_item_t`; it performs a cross-cache attack and overwrites `pipe_buffer.flags` to implement the Dirty Pipe technique and gain LPE |
 | __drill_uaf_w_pte.c__ | a basic UAF exploit that writes to a freed `drill_item_t`; it performs a cross-allocator attack and overwrites a page table entry (PTE) to implement the Dirty Pagetable technique and gain LPE on `x86_64` |
 | __drill_uaf_w_pud.c__ | an improved version of `drill_uaf_w_pte.c` that overwrites an entry in Page Directory Pointer Table (PDPT), which is called Page Upper Directory (PUD) in the Linux kernel; that allows to implement the Dirty Pagetable attack via huge pages |
+| __drill_oob_w_pipe_buffer.c__ | a basic out-of-bounds write (OOBW) exploit that corrupts the `pipe_buffer.page` pointer to perform arbitrary address read/write (AARW) of kernel memory via a pipe and gain LPE. |
 
 N.B. Only basic exploit techniques here.
 

drill_mod.c

@@ -89,11 +89,6 @@ static int drill_act_exec(long act, char *arg1_str, char *arg2_str, char *arg3_s
 			return -EINVAL;
 		}
 
-		if (offset > DRILL_ITEM_SIZE - sizeof(struct drill_item_t) - sizeof(val)) {
-			pr_err("drill: save_val: oob offset %ld\n", offset);
-			return -EINVAL;
-		}
-
 		data_addr = (unsigned long *)(drill.items[n]->data + offset);
 		pr_notice("drill: save val 0x%lx to item %lu (0x%lx) at data offset %ld (0x%lx)\n",
 			  val, n, (unsigned long)drill.items[n], offset, (unsigned long)data_addr);