Bug Hunter Diary

I now had a list of IOCTL names supported by the Solaris kernel.To find the source files that actually process these IOCTLs, I searchedthe whole kernel source for each IOCTL name on the list. Here is anexample search for the SIOCTONLINK IOCTL:solaris$ grep --include=*.c -rn SIOCTONLINK *common/inet/ip/ip.c:1267: /* 145 */ { SIOCTONLINK, sizeof (struct sioc_add rreq), →IPI_GET_CMD,Step 2: Identify the Input DataThe Solaris kernel provides different interfaces for IOCTL processing.The interface that is relevant for the vulnerability I found is aprogramming model called STREAMS. 4 Intuitively, the fundamentalSTREAMS unit is called a Stream, which is a data transfer path betweena process in user space and the kernel. All kernel-level input and outputunder STREAMS are based on STREAMS messages, which usuallycontain the following elements: a data buffer, a data block, and a messageblock. The data buffer is the location in memory where the actualdata of the message is stored. The data block (struct datab) describesthe data buffer. The message block (struct msgb) describes the datablock and how the data is used.The message block structure has the following public elements.Source code file uts/common/sys/stream.h 5[..]367 /*368 * Message block descriptor369 */370 typedef struct msgb {371 struct msgb *b_next;372 struct msgb *b_prev;373 struct msgb *b_cont;374 unsigned char *b_rptr;375 unsigned char *b_wptr;376 struct datab *b_datap;377 unsigned char b_band;378 unsigned char b_tag;379 unsigned short b_flag;380 queue_t *b_queue; /* for sync queues */381 } mblk_t;[..]The structure elements b_rptr and b_wptr specify the currentread and write pointers in the data buffer pointed to by b_datap(see Figure 3-1).Escape from the WWW Zone 27