Skip to content

Comments

Add kernel_rex_version for kernel parsing#21008

Open
EclipseAditya wants to merge 1 commit intorapid7:masterfrom
EclipseAditya:feature/19855-kernel-rex-version
Open

Add kernel_rex_version for kernel parsing#21008
EclipseAditya wants to merge 1 commit intorapid7:masterfrom
EclipseAditya:feature/19855-kernel-rex-version

Conversation

@EclipseAditya
Copy link

Adds kernel_rex_version to Msf::Post::Linux::Kernel that extracts the upstream kernel version from uname -r and returns a Rex::Version. This replaces the split('-').first pattern duplicated across 15 modules that crashed with ArgumentError on distro-specific suffixes (Amazon Linux, Fedora, RHEL, SUSE, etc.).

  • Modules now return CheckCode::Unknown instead of CheckCode::Safe when version can't be parsed
  • Removes rescue ArgumentError band-aids added in guard Rex::Version.new against crashes on local modules #19813
  • Fixes vmwgfx_fd_priv_esc boundary (> to >=) that excluded kernel 4.14.0
  • Fixes cve_2021_3490 Fedora dead code (>= to > for 5.11.20)

Fixes #19855

Verification

  • bundle exec rspec spec/lib/msf/core/post/linux/kernel_spec.rb
  • Verify 34 examples, 0 failures
  • bundle exec ruby msftidy.rb vmwgfx_fd_priv_esc.rb docker_cgroup_escape.rb modules/exploits/example_linux_priv_esc.rb
  • Verify no new offenses
  • grep -rn "Rex::Version.new.*kernel_release" modules/exploits/
  • Verify zero matches (no module passes raw kernel_release to Rex::Version)
  • Start msfconsole
  • irb
  • Rex::Version.new("4.14.355-275.572.amzn2.x86_64")
  • Verify it raises ArgumentError (the original bug)
  • Rex::Version.new("4.14.355-275.572.amzn2.x86_64".split('-').first)
  • Verify returns Rex::Version "4.14.355" (what kernel_rex_version does)
  • use exploit/linux/local/vmwgfx_fd_priv_esc
  • Verify module loads without errors

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

enhancement rn-enhancement release notes enhancement

Projects

Status: Todo

Development

Successfully merging this pull request may close these issues.

Create kernel_rex_version to guard against Rex::Version crashes on local modules

2 participants