ProcessGUIDs are not necessarily unique, especially for non-PIEs

未关闭

#84 创建于 2022年9月27日 0 条评论 0 个 reaction 已指派 0 人在 GitHub 查看

还没有人认领这个 Issue。

评估

难度: 5/5
预计耗时: 一周以上
新手友好度: 30/100

Issue 类型: 缺陷
描述清晰度: 基本清楚
活跃度: 停滞
技术栈: c
领域: operating-systems, security

调研方向

从 ebpfKern/sysmonProcCreate.c 的第 144-147 行附近开始，跟踪机器 ID、进程启动时间和文本段地址如何构成 ProcessGUID。通过在一秒内启动 non-PIE 可执行文件来重现冲突，然后确定并记录一种 ProcessKey 表示形式，以避免不同 ProcessCreate 事件产生重复的 ProcessGUID。

由索引模型根据 Issue 内容生成。

描述

investigate

One can reliably create ProcessGUID collisions from different ProcessCreate events by launching non-Position Independent Executables (PIE) within a second. This has been an issue for me, trying to correlate events.

It looks like ProcessGUIDs are created by combining a few pieces of information:

32 bits for machine ID
32 bits for process start in Unix time in seconds
64 bits for the memory address of the end of the text segment, for a process. https://github.com/Sysinternals/SysmonForLinux/blob/main/ebpfKern/sysmonProcCreate.c#L144-L147

Although most executables on Linux distributions are compiled as PIE, it's not a guaranteed and it's not obvious that Sysmon GUID generation could produce duplicates in this scenario.

Perhaps instead of just using something like the text segment location, other data could be packed into the ProcessKey as well. There's 64 bits to work with and these addresses for PIEs will only have ~28 bits of randomness (measured on default Ubuntu systems with paxtest).

主要语言: C
星标: 2.2k
派生: 220
平均合并: 11 天 22 小时
30 天内合并 PR: 2