Bug Hunter Diary

zero pagenot mappedzero pageis mapped0xFFFFFFFF.FFFFFFFFKernel SpaceKernel Space0xFFFFFD80.00000000(de)reference ==access violationUser Space(de)reference !=access violationUser Space0x00000000.00000000shared zero page(not mapped)shared zero page(mapped)Figure 3-5: Virtual address space of a process (Solaris x86 64-bit) 10By mapping the zero page before triggering the NULL pointerdereference, I was able to prevent the system from crashing. That gotme to the next problem: How to gain control over EIP/RIP? The onlydata that was under my full control was the IOCTL data sent to thekernel and the user-space data of a process, including the zero page.The only way to get control was to make the kernel reference somedata from the zero page that would later be used to control the executionflow of the kernel. I thought that approach would not work, but Iwas wrong.Source code file uts/common/inet/ip/ip_if.cFunction ip_sioctl_tunparam()[..]9401 int9402 ip_sioctl_tunparam(ipif_t *ipif, sin_t *dummy_sin, queue_t *q, mblk_t *mp,9403 ip_ioctl_cmd_t *ipip, void *dummy_ifreq)9404 {[..]9432 ill = ipif->ipif_ill;9433 mutex_enter(&connp->conn_lock);9434 mutex_enter(&ill->ill_lock);9435 if (ipip->ipi_cmd == SIOCSTUNPARAM || ipip->ipi_cmd == OSIOCSTUNPARAM) {9436 success = ipsq_pending_mp_add(connp, ipif, CONNP_TO_WQ(connp),9437 mp, 0);9438 } else {9439 success = ill_pending_mp_add(ill, connp, mp);9440 }9441 mutex_exit(&ill->ill_lock);9442 mutex_exit(&connp->conn_lock);944340 Chapter 3