From 84401847ff50009c120dcbbfdf17868b86c2a01b Mon Sep 17 00:00:00 2001 From: Valentin Obst Date: Wed, 20 Dec 2023 18:38:07 +0100 Subject: [PATCH] add sanity check in Linux find_aslr to skip unrelocated init_task --- volatility3/framework/automagic/linux.py | 12 ++++++++++++ 1 file changed, 12 insertions(+) diff --git a/volatility3/framework/automagic/linux.py b/volatility3/framework/automagic/linux.py index 2eebcc2dc..fda71b766 100644 --- a/volatility3/framework/automagic/linux.py +++ b/volatility3/framework/automagic/linux.py @@ -156,6 +156,18 @@ class LinuxIntelStacker(interfaces.automagic.StackerLayerInterface): and init_task.state.cast("unsigned int") != 0 ): continue + elif init_task.active_mm.cast("long unsigned int") == module.get_symbol( + "init_mm" + ).address and init_task.tasks.next.cast( + "long unsigned int" + ) == init_task.tasks.prev.cast( + "long unsigned int" + ): + # The idle task steals `mm` from previously running task, i.e., + # `init_mm` is only used as long as no CPU has ever been idle. + # This catches cases where we found a fragment of the + # unrelocated ELF file instead of the running kernel. + continue # This we get for free aslr_shift = (