WEBDIENSTE/volatility3
1
0
Fork 0
mirror of https://github.com/volatilityfoundation/volatility3.git synced 2026-08-17 20:35:40 +02:00
Code Issues Packages Projects Releases Wiki Activity

Add needed checks to prevent backtraces in ELF parsing

Browse Source
This commit is contained in:
Andrew Case
2025-03-17 17:46:25 -05:00
parent 1eacddc79c
commit e48d2972a6
1 changed files with 15 additions and 5 deletions
Download Patch File Download Diff File Expand all files Collapse all files
volatility3/framework/symbols/linux/extensions/__init__.py
+15 -5
View File
@@ -343,7 +343,9 @@ class module(generic.GenericIntelProcess):
elif self.has_member("symtab"):
return self.symtab
except exceptions.InvalidAddressException:
vollog.debug(f"Page fault encountered when accessing symtab of ELF at {self.vol.offset:#x} in {self.vol.layer_name}")
vollog.debug(
f"Page fault encountered when accessing symtab of ELF at {self.vol.offset:#x} in {self.vol.layer_name}"
)
return None
raise AttributeError("Unable to get symtab")
@@ -356,7 +358,9 @@ class module(generic.GenericIntelProcess):
elif self.has_member("num_symtab"):
return int(self.member("num_symtab"))
except exceptions.InvalidAddressException:
vollog.debug(f"Page fault encountered when accessing num_symtab of ELF at {self.vol.offset:#x} in {self.vol.layer_name}")
vollog.debug(
f"Page fault encountered when accessing num_symtab of ELF at {self.vol.offset:#x} in {self.vol.layer_name}"
)
return None
raise AttributeError("Unable to determine number of symbols")
@@ -371,7 +375,9 @@ class module(generic.GenericIntelProcess):
elif self.has_member("strtab"):
return self.strtab
except exceptions.InvalidAddressException:
vollog.debug(f"Page fault encountered when accessing strtab of ELF at {self.vol.offset:#x} in {self.vol.layer_name}")
vollog.debug(
f"Page fault encountered when accessing strtab of ELF at {self.vol.offset:#x} in {self.vol.layer_name}"
)
return None
raise AttributeError("Unable to get strtab")
@@ -384,7 +390,9 @@ class module(generic.GenericIntelProcess):
# kernels >= 5.2 1c7651f43777cdd59c1aaa82c87324d3e7438c7b: types have its own array
return self.kallsyms.typetab
except exceptions.InvalidAddressException:
vollog.debug(f"Page fault encountered when accessing typetab of ELF at {self.vol.offset:#x} in {self.vol.layer_name}")
vollog.debug(
f"Page fault encountered when accessing typetab of ELF at {self.vol.offset:#x} in {self.vol.layer_name}"
)
return None
raise AttributeError("Unable to get typetab section, it needs a kernel >= 5.2")
@@ -411,7 +419,9 @@ class module(generic.GenericIntelProcess):
# kernels < 5.2 the type was stored in the st_info
sym_type = chr(symbol.st_info)
except exceptions.InvalidAddressException:
vollog.debug(f"Page fault encountered when accessing symbol type of index {symbol_index} of ELF at {self.vol.offset:#x} in {self.vol.layer_name}")
vollog.debug(
f"Page fault encountered when accessing symbol type of index {symbol_index} of ELF at {self.vol.offset:#x} in {self.vol.layer_name}"
)
return None
return sym_type