FM / security-band-aids

/usr/share/systemtap/examples/security-band-aids/

/usr/share/systemtap/examples/security-band-aids

Name	Size	Mode	Actions
cve-2008-0600.meta	209	0644	edit dl rm
cve-2008-0600.stp	144	0644	edit dl rm
cve-2008-0600.txt	345	0644	edit dl rm
cve-2011-4127.meta	209	0644	edit dl rm
cve-2011-4127.stp	296	0644	edit dl rm
cve-2012-0056.meta	209	0644	edit dl rm
cve-2012-0056.stp	75	0644	edit dl rm
cve-2013-2094.meta	209	0644	edit dl rm
cve-2013-2094.stp	418	0644	edit dl rm
cve-2014-7169.meta	209	0644	edit dl rm
cve-2014-7169.stp	82	0644	edit dl rm
cve-2015-0235.meta	209	0644	edit dl rm
cve-2015-0235.stp	2221	0644	edit dl rm
cve-2015-3456.meta	209	0644	edit dl rm
cve-2015-3456.stp	234	0644	edit dl rm
cve-2015-7547.meta	209	0644	edit dl rm
cve-2015-7547.stp	153	0644	edit dl rm
cve-2016-0728-templatized.stp	2552	0644	edit dl rm
cve-2016-0728.meta	209	0644	edit dl rm
cve-2016-0728.stp	2619	0644	edit dl rm
cve-2016-5195.meta	209	0644	edit dl rm
cve-2016-5195.stp	371	0644	edit dl rm
cve-2017-6074.meta	209	0644	edit dl rm
cve-2017-6074.stp	264	0644	edit dl rm
cve-2018-6485-templatized.stp	1521	0644	edit dl rm
cve-2018-6485.meta	209	0644	edit dl rm
cve-2018-6485.stp	1377	0644	edit dl rm
cve-2018-14634.meta	212	0644	edit dl rm
cve-2018-14634.stp	1190	0644	edit dl rm
cve-2018-1000001.meta	218	0644	edit dl rm
cve-2018-1000001.stp	1054	0644	edit dl rm
cve-2021-4034.meta	209	0644	edit dl rm
cve-2021-4034.stp	209	0644	edit dl rm
cve-2021-4155.meta	209	0644	edit dl rm
cve-2021-4155.stp	314	0644	edit dl rm
security-bandaid-template.stp	1968	0644	edit dl rm

Edit: /usr/share/systemtap/examples/security-band-aids/security-bandaid-template.stp (1968B)

#!/usr/bin/stap -g -m CVE_YYYY_ABCD

/* The following is a template for security bandaids for use
 * in live patching CVEs with systemtap
 * See: https://securityblog.redhat.com/2015/06/03/emergency-security-band-aids-with-systemtap/
 *
 * The template will define global variables
 *      cve_notify_p: Nonzero int if the user wants notifications on the loading(begin)/unloading(end) of the patch. O otherwise
 *      cve_fix_p: Nonzero int if the user wants their CVE to run the fix payload. 0 otherwise
 *      cve_trace_p: Nonzero int if the user wants their CVE to trace the issue. 0 otherwise
 *      cve_enabled_p: Nonzero int if the user's patch code should be run. 0 otherwise
 *          When disabled, there is minimal overhead for the patch and all probes which should be
 *          toggleable should have `if(cve_enabled_p)` before the probe body.
 *      cve_tmpdisabled_s: A countdown timer for temporary disabling of probes by setting
 *          cve_enabled_p to 0 until this number of seconds decreases to <0.
 *
 * It is assumed that the user's probes will utilize the above for these purposes
 * These can be changed within the user's probes at runtime using procfs (/proc/systemtap/CVE_YYYY_ABCD/*)
 * For example see cve-2016-0728-templatized.stp or cve-2018-6485-templatized.stp
 *
 * The user can also track metrics using cve_count_metric(key:string) and cve_record_metric(key:string, value:long)
 * Where cve_count_metric increments a counter each time called and cve_record_metric can store any long value
 * These are visable along with some buildin metrics at /proc/systemtap/CVE_YYYY_ABCD/__prometheus
 *
 * The patch can also be fully disabled programatically using cve_tmpdisable(duration:long), where
 * a non-negative duration is the number of seconds to disable the patch, and negative is disabled until reenabled
 * via procfs
 */

// User Action Item: Add fix payload here using defined globals
probe X.Y.Z if(cve_enabled_p) {...}

cmd: