Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

guard Rex::Version.new against crashes on local modules #19813

Draft
wants to merge 1 commit into
base: master
Choose a base branch
from

Conversation

h00die
Copy link
Contributor

@h00die h00die commented Jan 17, 2025

fixes #19812

Draft for the time being as I think there was another module or two to fix.

@h00die h00die added the bug label Jan 17, 2025
@bcoles
Copy link
Contributor

bcoles commented Jan 18, 2025

All of the existing kernel_release code looks fine to me for the example "funky" version string 5.4.129-72.229.amzn2int.x86_64. Was there another version string causing issues?

This code splits at the first -. Rex::Version receives 5.4.129 which is valid and will not raise.

Edit: modules/exploits/linux/local/vmwgfx_fd_priv_esc.rb does no prior parsing of kernel_release and will raise.

The package parsing code does no prior parsing of the version before passing to Rex::Version and will likely raise.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
Projects
Status: Todo
Development

Successfully merging this pull request may close these issues.

Rex::Version crashes in some local modules with Amazon Linux 2 kernel versions
2 participants