0sec-cli 0.15.0 → 0.17.0

package/chunks/chunk-HE7LCA7G.js

@@ -0,0 +1,381 @@
+#!/usr/bin/env node
+import { createRequire as __0secCreateRequire } from "node:module";
+const require = __0secCreateRequire(import.meta.url);
+import {
+  severityRank
+} from "./chunk-KKGE5RQE.js";
+
+// packages/core/dist/triage/kernel-primitive.js
+function maxSeverity(a, b) {
+  return severityRank(a) >= severityRank(b) ? a : b;
+}
+var WRITE_PRIMITIVE_KINDS = /* @__PURE__ */ new Set([
+  "use-after-free",
+  "out-of-bounds-write"
+]);
+var CONTROL_FLOW_CALL_SITES = /^(call_timer_fn|run_timer_softirq|__run_timers?|__run_timer_base|expire_timers|__hrtimer_run_queues|__run_hrtimer|hrtimer_interrupt|__do_softirq|tasklet_action|tasklet_hi_action|process_one_work)$/;
+function isControlFlowCallSite(faultingPc) {
+  if (!faultingPc)
+    return false;
+  const sym = faultingPc.match(/^([A-Za-z_][\w.$]*)/)?.[1];
+  if (!sym)
+    return false;
+  if (CONTROL_FLOW_CALL_SITES.test(sym))
+    return true;
+  return /(?:_timer_fn|_timeout|_callback|_cb)$/.test(sym);
+}
+function classifyKernelPrimitive(report) {
+  const rationale = [];
+  const hasAlloc = Boolean(report.allocSite);
+  const hasFree = Boolean(report.freeSite);
+  const isWrite = report.accessType === "write";
+  const isRead = report.accessType === "read";
+  let kind;
+  let control;
+  let exploitability;
+  let confidence;
+  switch (report.crashType) {
+    case "kasan-uaf":
+    case "kasan-wild": {
+      kind = "use-after-free";
+      control = isWrite ? "write" : isRead ? "read" : "write";
+      exploitability = control === "write" ? 0.85 : 0.55;
+      confidence = report.crashType === "kasan-wild" ? 0.5 : 0.8;
+      rationale.push(`Use-after-free grants an attacker a dangling reference; a ${control} after free is the lever.`);
+      if (hasAlloc && hasFree) {
+        exploitability = Math.min(1, exploitability + 0.05);
+        confidence = Math.min(1, confidence + 0.1);
+        rationale.push("Both KASAN allocation and free sites are known \u2014 the object lifecycle is pinned, so a reclaim window can be targeted.");
+      }
+      break;
+    }
+    case "kasan-oob": {
+      kind = isWrite ? "out-of-bounds-write" : "out-of-bounds-read";
+      control = isWrite ? "write" : "read";
+      exploitability = isWrite ? 0.8 : 0.45;
+      confidence = 0.8;
+      rationale.push(isWrite ? "Heap out-of-bounds write corrupts an adjacent allocation \u2014 a write-what-where candidate." : "Heap out-of-bounds read leaks adjacent allocation contents \u2014 an info-leak candidate.");
+      break;
+    }
+    case "kasan-stack-oob": {
+      kind = isWrite ? "out-of-bounds-write" : "out-of-bounds-read";
+      control = isWrite ? "write" : "read";
+      exploitability = isWrite ? 0.7 : 0.4;
+      confidence = 0.75;
+      rationale.push("Stack out-of-bounds access; write variants can target saved registers / return addresses subject to canary mitigation.");
+      break;
+    }
+    case "kasan-double-free": {
+      kind = "double-free";
+      control = "free";
+      exploitability = 0.6;
+      confidence = 0.8;
+      rationale.push("Double-free confuses the slab allocator freelist, enabling cache poisoning toward an overlapping allocation.");
+      if (hasFree) {
+        confidence = Math.min(1, confidence + 0.1);
+        rationale.push("KASAN free site is known \u2014 the double-free path is pinned.");
+      }
+      break;
+    }
+    case "kasan-invalid-free": {
+      kind = "invalid-free";
+      control = "free";
+      exploitability = 0.5;
+      confidence = 0.75;
+      rationale.push("Invalid-free passes an attacker-influenced pointer to the freer, a potential arbitrary-free primitive.");
+      break;
+    }
+    case "kasan-null":
+    case "kernel-oops":
+    case "kernel-panic":
+    case "kernel-bug":
+    case "general-protection": {
+      kind = "null-deref";
+      control = "none";
+      exploitability = 0.1;
+      confidence = 0.6;
+      rationale.push("Null / faulting dereference is typically a denial-of-service unless low-address mmap is permitted (mmap_min_addr=0).");
+      break;
+    }
+    case "ubsan":
+    case "ubsan-shift":
+    case "ubsan-overflow":
+    case "ubsan-bounds":
+    case "ubsan-alignment": {
+      kind = "uninitialized-access";
+      control = "none";
+      exploitability = 0.15;
+      confidence = 0.5;
+      rationale.push("UBSAN undefined behaviour rarely yields a direct memory primitive on its own; treat as a building block pending further analysis.");
+      break;
+    }
+    default: {
+      kind = "unknown";
+      control = "none";
+      exploitability = 0.1;
+      confidence = 0.3;
+      rationale.push(`Crash type ${report.crashType} does not map to a known memory primitive.`);
+    }
+  }
+  if (report.accessSize && (control === "write" || control === "read")) {
+    rationale.push(`Access width ${report.accessSize} byte(s) bounds the per-step control.`);
+    if (report.accessSize >= 8) {
+      exploitability = Math.min(1, exploitability + 0.05);
+    }
+  }
+  const objectHint = report.allocSite ?? report.freeSite ?? void 0;
+  const faultingPc = report.faultingPc ?? parseFaultingPc(report.rawText);
+  const slabCache = report.slabCache ?? parseSlabCache(report.rawText);
+  if ((kind === "use-after-free" || kind === "double-free") && isControlFlowCallSite(faultingPc)) {
+    control = "call";
+    exploitability = Math.max(exploitability, 0.9);
+    confidence = Math.min(1, confidence + 0.05);
+    rationale.push("Faulting site is a timer/ops indirect-call dispatch frame: the freed object owns a function pointer the kernel calls after the free, so reclaiming it with a forged `.function` hijacks control flow (fake-cred one-shot: `.function=commit_creds`, `rdi=&obj`).");
+  }
+  return {
+    kind,
+    control,
+    exploitability: Number(exploitability.toFixed(2)),
+    confidence: Number(confidence.toFixed(2)),
+    controlDemo: buildControlDemo(kind, control, report),
+    rationale,
+    objectHint,
+    ...faultingPc ? { faultingPc } : {},
+    ...slabCache ? { slabCache } : {}
+  };
+}
+function parseFaultingPc(dmesg) {
+  if (!dmesg)
+    return void 0;
+  const m = dmesg.match(/BUG:\s*KASAN:[^\n]*?\bin\s+([A-Za-z_][\w.$]*\+0x[0-9a-fA-F]+(?:\/0x[0-9a-fA-F]+)?)/);
+  return m ? m[1] : void 0;
+}
+function parseSlabCache(dmesg) {
+  if (!dmesg)
+    return void 0;
+  const cacheTok = dmesg.match(/\bcache\s+([A-Za-z][\w-]*-\d+|[A-Za-z][\w-]*)\b/);
+  if (cacheTok && /\d/.test(cacheTok[1]))
+    return cacheTok[1];
+  const kmallocTok = dmesg.match(/\b((?:dma-|cg-)?kmalloc(?:-cg)?-\d+)\b/);
+  if (kmallocTok)
+    return kmallocTok[1];
+  return cacheTok ? cacheTok[1] : void 0;
+}
+function buildControlDemo(kind, control, report) {
+  const sizeHint = report.accessSize ? `${report.accessSize}-byte` : "controlled-width";
+  const objectHint = report.allocSite ?? report.faultingFunction;
+  if (control === "call") {
+    return {
+      kind: "object-overwrite",
+      description: `After the free in ${report.freeSite ?? "the freed path"}, spray the victim cache to reclaim the freed object with a forged embedded callback (timer_list.function / ops slot), then let the kernel's timer/softirq dispatch (${objectHint}) fire and confirm the indirect call lands on the attacker-chosen target.`,
+      controlledInput: "reclaiming-object bytes at the callback-pointer offset",
+      demonstrated: false
+    };
+  }
+  switch (kind) {
+    case "use-after-free":
+      if (control === "write") {
+        return {
+          kind: "object-overwrite",
+          description: `After the free in ${report.freeSite ?? "the freed path"}, spray heap objects of the victim cache to reclaim the freed slot, then trigger the dangling ${sizeHint} write and confirm attacker bytes land in the reclaimed object (${objectHint}).`,
+          controlledInput: "heap-spray contents reclaiming the freed object",
+          demonstrated: false
+        };
+      }
+      return {
+        kind: "oob-read-leak",
+        description: `Reclaim the freed object (${objectHint}) with a marker payload, then trigger the dangling read and confirm the marker bytes leak back to userspace.`,
+        controlledInput: "reclaiming object marker bytes",
+        demonstrated: false
+      };
+    case "out-of-bounds-write":
+      return {
+        kind: "write-what-where",
+        description: `Place a target object immediately after the overflowed allocation (${objectHint}) via heap grooming, then drive the ${sizeHint} OOB write and confirm a controlled field of the neighbour is overwritten.`,
+        controlledInput: "overflow payload + neighbouring object layout",
+        demonstrated: false
+      };
+    case "out-of-bounds-read":
+      return {
+        kind: "oob-read-leak",
+        description: `Groom a secret-bearing object after the under-sized allocation (${objectHint}), trigger the ${sizeHint} OOB read, and confirm adjacent bytes are returned to userspace.`,
+        controlledInput: "adjacent object placement",
+        demonstrated: false
+      };
+    case "double-free":
+      return {
+        kind: "free-confusion",
+        description: `Allocate a victim object between the two frees of ${objectHint} so the second free poisons the freelist, then confirm two live allocations alias the same slot.`,
+        controlledInput: "intervening allocation timing",
+        demonstrated: false
+      };
+    case "invalid-free":
+      return {
+        kind: "free-confusion",
+        description: `Influence the pointer passed to the freer in ${report.faultingFunction} and confirm a non-allocated / attacker-chosen address is handed to the slab allocator.`,
+        controlledInput: "the freed pointer value",
+        demonstrated: false
+      };
+    default:
+      return {
+        kind: "none",
+        description: "No bounded control demonstration is proposed for this primitive; it reads as denial-of-service or an undetermined building block.",
+        demonstrated: false
+      };
+  }
+}
+async function attemptControlDemo(primitive, probe) {
+  if (primitive.controlDemo.kind === "none")
+    return primitive;
+  const result = await probe(primitive.controlDemo);
+  if (!result.controlled) {
+    return {
+      ...primitive,
+      controlDemo: {
+        ...primitive.controlDemo,
+        demonstrated: false,
+        evidence: result.evidence
+      }
+    };
+  }
+  return {
+    ...primitive,
+    // A demonstrated control is hard exploitability evidence.
+    exploitability: Math.min(1, primitive.exploitability + 0.1),
+    controlDemo: {
+      ...primitive.controlDemo,
+      demonstrated: true,
+      evidence: result.evidence
+    }
+  };
+}
+function exploitabilityAdjustedSeverity(baseSeverity, primitive) {
+  let floor = "info";
+  if (primitive.controlDemo.demonstrated && WRITE_PRIMITIVE_KINDS.has(primitive.kind)) {
+    floor = "critical";
+  } else if (primitive.exploitability >= 0.8 && primitive.control === "write") {
+    floor = "critical";
+  } else if (primitive.control === "call" && primitive.exploitability >= 0.8) {
+    floor = "critical";
+  } else if (primitive.exploitability >= 0.6) {
+    floor = "high";
+  } else if (primitive.exploitability >= 0.4) {
+    floor = "medium";
+  }
+  return maxSeverity(baseSeverity, floor);
+}
+function describeKernelPrimitive(primitive) {
+  const lines = [
+    `Primitive: ${primitive.kind} (control=${primitive.control})`,
+    `Exploitability: ${primitive.exploitability.toFixed(2)} (classifier confidence=${primitive.confidence.toFixed(2)})`,
+    `Control demo [${primitive.controlDemo.kind}${primitive.controlDemo.demonstrated ? ", demonstrated" : ", candidate"}]: ${primitive.controlDemo.description}`
+  ];
+  if (primitive.controlDemo.evidence) {
+    lines.push(`Control demo evidence: ${primitive.controlDemo.evidence}`);
+  }
+  if (primitive.objectHint) {
+    lines.push(`Object hint: ${primitive.objectHint}`);
+  }
+  for (const r of primitive.rationale)
+    lines.push(`- ${r}`);
+  return lines;
+}
+function classifyPrimitiveFromDmesg(dmesg, detectedCrashType) {
+  const crashType = detectedCrashType ?? sniffCrashType(dmesg) ?? "unknown";
+  const accessMatch = dmesg.match(/(Read|Write)\s+of\s+size\s+(\d+)/i);
+  const report = {
+    rawText: dmesg,
+    crashType,
+    faultingFunction: "unknown",
+    callStack: [],
+    subsystem: "unknown",
+    accessType: accessMatch ? accessMatch[1].toLowerCase() : void 0,
+    accessSize: accessMatch ? parseInt(accessMatch[2], 10) : void 0,
+    allocSite: /Allocated by task/i.test(dmesg) ? "alloc" : void 0,
+    freeSite: /Freed by task/i.test(dmesg) ? "free" : void 0
+  };
+  return classifyKernelPrimitive(report);
+}
+function sniffCrashType(dmesg) {
+  if (/use-after-free/i.test(dmesg))
+    return "kasan-uaf";
+  if (/out-of-bounds/i.test(dmesg))
+    return "kasan-oob";
+  if (/double-free/i.test(dmesg))
+    return "kasan-double-free";
+  if (/invalid-free/i.test(dmesg))
+    return "kasan-invalid-free";
+  if (/null pointer|null-ptr-deref/i.test(dmesg))
+    return "kasan-null";
+  return void 0;
+}
+var DANGER_LADDER = [
+  "none",
+  "warn",
+  "race",
+  "oob-read",
+  "info-leak",
+  "gpf",
+  "double-free",
+  "oob-write",
+  "uaf-write",
+  "control-flow"
+];
+var BENIGN_MAX_CLASS = "info-leak";
+var UPGRADE_MIN_CLASS = "gpf";
+function rankDanger(cls) {
+  const i = DANGER_LADDER.indexOf(cls);
+  return i < 0 ? 0 : i;
+}
+function maxDangerClass(a, b) {
+  return rankDanger(a) >= rankDanger(b) ? a : b;
+}
+function isDangerUpgrade(baseline, observed) {
+  return rankDanger(baseline) <= rankDanger(BENIGN_MAX_CLASS) && rankDanger(observed) >= rankDanger(UPGRADE_MIN_CLASS);
+}
+function classifyDmesgDanger(dmesg) {
+  if (!dmesg)
+    return "none";
+  const hasWrite = /\bWrite of size\s+\d+/i.test(dmesg);
+  const hasRead = /\bRead of size\s+\d+/i.test(dmesg);
+  const isKasan = /KASAN:/i.test(dmesg);
+  if (/KASAN.*double-free|double free|Object already free/i.test(dmesg))
+    return "double-free";
+  if (/Control flow|CFI failure|kCFI|forward-edge/i.test(dmesg))
+    return "control-flow";
+  if (hasWrite && /use-after-free/i.test(dmesg))
+    return "uaf-write";
+  if (hasWrite && /out-of-bounds|slab-out-of-bounds|global-out-of-bounds/i.test(dmesg))
+    return "oob-write";
+  if (hasWrite && isKasan)
+    return "oob-write";
+  if (/general protection fault/i.test(dmesg))
+    return "gpf";
+  if (hasRead || isKasan)
+    return "oob-read";
+  if (/KCSAN:|data-race/i.test(dmesg))
+    return "race";
+  if (/WARNING:|\bWARN\b|------------\[ cut here \]/i.test(dmesg))
+    return "warn";
+  return "none";
+}
+
+export {
+  maxSeverity,
+  isControlFlowCallSite,
+  classifyKernelPrimitive,
+  parseFaultingPc,
+  parseSlabCache,
+  buildControlDemo,
+  attemptControlDemo,
+  exploitabilityAdjustedSeverity,
+  describeKernelPrimitive,
+  classifyPrimitiveFromDmesg,
+  sniffCrashType,
+  BENIGN_MAX_CLASS,
+  UPGRADE_MIN_CLASS,
+  rankDanger,
+  maxDangerClass,
+  isDangerUpgrade,
+  classifyDmesgDanger
+};