From f7d5e722a2ef98370b45c3d3aaa811f13d5de480 Mon Sep 17 00:00:00 2001
From: Eve <eevvee@tuta.io>
Date: Mon, 13 Nov 2023 07:05:30 +0000
Subject: [PATCH] Linux: add member presence checks to linux.checks_afinfo
 _check_afinfo function to stop crashes when none of the required members are
 present

---
 .../framework/plugins/linux/check_afinfo.py   | 28 +++++++++++++++----
 1 file changed, 22 insertions(+), 6 deletions(-)

diff --git a/volatility3/framework/plugins/linux/check_afinfo.py b/volatility3/framework/plugins/linux/check_afinfo.py
index 90e714eaa..61c642f0e 100644
--- a/volatility3/framework/plugins/linux/check_afinfo.py
+++ b/volatility3/framework/plugins/linux/check_afinfo.py
@@ -51,10 +51,24 @@ class Check_afinfo(plugins.PluginInterface):
                 yield check, addr
 
     def _check_afinfo(self, var_name, var, op_members, seq_members):
-        for hooked_member, hook_address in self._check_members(
-            var.seq_fops, var_name, op_members
-        ):
-            yield var_name, hooked_member, hook_address
+        # check if object has a least one of the members used for analysis by this function
+        required_members = ["seq_fops", "seq_ops", "seq_show"]
+        for member in required_members:
+            vollog.debug(f"{var_name}: {member} :{var.has_member(member)}")
+        has_required_member = any(
+            [var.has_member(member) for member in required_members]
+        )
+        if not has_required_member:
+            vollog.warning(
+                f"This plugin requires the seq_fops, seq_ops, or seq_show members to be to check for hooks. These members are not present in the {var_name} object at {hex(var.vol.offset)}. This means you are either analyzing an unsupported kernel version or that your symbol table is corrupt."
+            )
+            return
+
+        if var.has_member("seq_fops"):
+            for hooked_member, hook_address in self._check_members(
+                var.seq_fops, var_name, op_members
+            ):
+                yield var_name, hooked_member, hook_address
 
         # newer kernels
         if var.has_member("seq_ops"):
@@ -64,8 +78,10 @@ class Check_afinfo(plugins.PluginInterface):
                 yield var_name, hooked_member, hook_address
 
         # this is the most commonly hooked member by rootkits, so a force a check on it
-        elif not self._is_known_address(var.seq_show):
-            yield var_name, "show", var.seq_show
+        else:
+            if var.has_member("seq_show"):
+                if not self._is_known_address(var.seq_show):
+                    yield var_name, "show", var.seq_show
 
     def _generator(self):
         vmlinux = self.context.modules[self.config["kernel"]]