diff --git a/CHANGELOG.md b/CHANGELOG.md index 87e2687..bb6fd9d 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -25,6 +25,11 @@ releases are cut by giving that section a version and a date. ### Changed +- The gem no longer carries gadgets for the three glibc 2.26 builds it shipped + (#443). What it carries is the glibc of every Ubuntu LTS in standard support + plus the libcs the specs run against, and 2.26 is neither of those any more; a + lookup by one of those BuildIDs now answers from the remote database. The + entries themselves stay in the repository, as every unshipped build does. - Requires elftools >= 2.1.0 (#442), whose faster symbol-table read takes the search of a libc with no section headers from 1.11s to 0.68s -- the read itself from 0.51s to 0.17s. A libc that still has its sections is unaffected. diff --git a/aletheia/lib/aletheia/transport.rb b/aletheia/lib/aletheia/transport.rb index 4715440..4ce98ef 100644 --- a/aletheia/lib/aletheia/transport.rb +++ b/aletheia/lib/aletheia/transport.rb @@ -136,8 +136,7 @@ module Aletheia # @param [String] file # @return [String?] def package_version(file) - File.binread(file)[/Ubuntu E?GLIBC (\d[^)]*)/, 1] || - NON_UBUNTU_FIXTURE_VERSIONS[File.basename(file, '.so')] + File.binread(file)[/Ubuntu E?GLIBC (\d[^)]*)/, 1] end def stub_built?(dir) @@ -148,16 +147,6 @@ module Aletheia end end - # A few fixtures are plain (non-Ubuntu) glibc builds and carry no "Ubuntu - # GLIBC" banner to parse an exact package version from -- e.g. - # libc-2.26-2104f3d4...'s banner reads "GNU C Library (GNU libc) stable - # release version 2.26", with no Ubuntu package suffix. Recorded by hand - # from a same-major.minor sibling fixture that does carry the banner - # (same glibc release, so ABI-equivalent for sysroot purposes). - NON_UBUNTU_FIXTURE_VERSIONS = { - 'libc-2.26-2104f3d4ad5cf68603afbe7ba1a17f5ac99c5988' => '2.26-0ubuntu2.1' - }.freeze - # Build the per-version sysroot from the fixture's own Ubuntu package version # (Ubuntu-sourced fixtures only). Returns whether its park_stub now exists. def build_sysroot(dir) diff --git a/shipped_builds b/shipped_builds index cbfda18..0db9674 100644 --- a/shipped_builds +++ b/shipped_builds @@ -6,9 +6,6 @@ libc-2.23-926eb99d49cab2e5622af38ab07395f5b32035e9 libc-2.23-991d173c6b9056712812d98507cbe95f937db7cf libc-2.24-8cba3297f538691eb1875be62986993c004f3f4d libc-2.24-fd0655c4d2073eda4235084e1d0e558f0251be8a -libc-2.26-2104f3d4ad5cf68603afbe7ba1a17f5ac99c5988 -libc-2.26-ddcc13122ddbfe5e5ef77d4ebe66d124ae5762c2 -libc-2.26-f65648a832414f2144ce795d75b6045a1ec2e252 libc-2.27-53f40c1d2f3739ae017dcdcef1a17314786e3709 libc-2.27-63b3d43ad45e1b0f601848c65b067f9e9b40528b libc-2.27-8c2d375f8d23a7b58de23a60b37bef2d80b23aef diff --git a/spec/data/libc-2.26-2104f3d4ad5cf68603afbe7ba1a17f5ac99c5988.so b/spec/data/libc-2.26-2104f3d4ad5cf68603afbe7ba1a17f5ac99c5988.so deleted file mode 100755 index 27c5fd5..0000000 Binary files a/spec/data/libc-2.26-2104f3d4ad5cf68603afbe7ba1a17f5ac99c5988.so and /dev/null differ diff --git a/spec/data/libc-2.26-ddcc13122ddbfe5e5ef77d4ebe66d124ae5762c2.so b/spec/data/libc-2.26-ddcc13122ddbfe5e5ef77d4ebe66d124ae5762c2.so deleted file mode 100755 index fcc92d6..0000000 Binary files a/spec/data/libc-2.26-ddcc13122ddbfe5e5ef77d4ebe66d124ae5762c2.so and /dev/null differ diff --git a/spec/data/libc-2.26-f65648a832414f2144ce795d75b6045a1ec2e252.so b/spec/data/libc-2.26-f65648a832414f2144ce795d75b6045a1ec2e252.so deleted file mode 100755 index 19c930f..0000000 Binary files a/spec/data/libc-2.26-f65648a832414f2144ce795d75b6045a1ec2e252.so and /dev/null differ diff --git a/spec/one_gadget_amd64_spec.rb b/spec/one_gadget_amd64_spec.rb index beae97e..74eef95 100644 --- a/spec/one_gadget_amd64_spec.rb +++ b/spec/one_gadget_amd64_spec.rb @@ -73,12 +73,6 @@ describe 'one_gadget_amd64' do expect(one_gadget(path)).to eq OneGadget.gadgets(file: path) end - it 'libc-2.26' do - path = data_path('libc-2.26-ddcc13122ddbfe5e5ef77d4ebe66d124ae5762c2.so') - expect(OneGadget.gadgets(file: path, force_file: true)).to eq [0x47c9a, 0xfccde, 0xfdb8e] - expect(one_gadget(path)).to eq OneGadget.gadgets(file: path) - end - it 'libc-2.27' do path = data_path('libc-2.27-b417c0ba7cc5cf06d1d1bed6652cedb9253c60d0.so') expect(OneGadget.gadgets(file: path, force_file: true)) diff --git a/spec/one_gadget_i386_spec.rb b/spec/one_gadget_i386_spec.rb index 6a99ee2..e5420cf 100644 --- a/spec/one_gadget_i386_spec.rb +++ b/spec/one_gadget_i386_spec.rb @@ -20,12 +20,6 @@ describe 'one_gadget_i386' do expect(OneGadget.gadgets(file: path, force_file: true)).to eq ans end - it 'libc-2.26' do - ans = [0x3cc3c, 0x66e7f, 0x66e80, 0x132fbe, 0x132fbf] - path = data_path('libc-2.26-f65648a832414f2144ce795d75b6045a1ec2e252.so') - expect(OneGadget.gadgets(file: path, force_file: true)).to eq ans - end - it 'libc-2.27' do ans = [0x3cbf7, 0x6729f, 0x672a0, 0x13573e, 0x13573f] path = data_path('libc-2.27-63b3d43ad45e1b0f601848c65b067f9e9b40528b.so') @@ -67,15 +61,15 @@ describe 'one_gadget_i386' do .to include('[[ebp-0x30]] == NULL || [ebp-0x30] == NULL || [ebp-0x30] is a valid envp') end - # 0xbda64's argv pointer is a `lea eax, [ebp-0x28]` alias: the array it builds + # 0xbe804's argv pointer is a `lea eax, [ebp-0x28]` alias: the array it builds # on the stack is {"/bin/sh", eax, NULL}, with eax an untracked incoming # register -- so the same resolve_stack_deref used for envp above applies to # argv too, surfacing `eax == NULL` instead of the opaque "[ebp-0x2c] is a # valid argv" form. it 'resolves argv through a lea-computed alias into the stack frame' do - path = data_path('libc-2.26-f65648a832414f2144ce795d75b6045a1ec2e252.so') + path = data_path('libc-2.27-63b3d43ad45e1b0f601848c65b067f9e9b40528b.so') gadget = OneGadget.gadgets(file: path, force_file: true, details: true, level: 1) - .find { |g| g.offset == 0xbda64 } + .find { |g| g.offset == 0xbe804 } expect(gadget.constraints).to include('eax == NULL || {"/bin/sh", eax, NULL} is a valid argv') end