crazy4linux / codeql-uboot Goto Github PK
View Code? Open in Web Editor NEWHome Page: https://lab.github.com/githubtraining/codeql-u-boot-challenge-(cc++)
License: MIT License
Home Page: https://lab.github.com/githubtraining/codeql-u-boot-challenge-(cc++)
License: MIT License
We will use the CodeQL extension for Visual Studio Code. You will take advantage of IDE features like auto-complete, contextual help and jump-to-definition.
Don't worry, you'll do this setup only once, and you'll be able to use it for future CodeQL development.
Follow the instructions below.
Now let's analyze what you have written. A CodeQL query has the following basic structure:
import /* ... path to some CodeQL libraries ... */
from /* ... variable declarations ... */
where /* ... logical formulas that say something about the variables ... */
select /* ... expressions to output ... */
The from
/where
/select
part is the query clause: it describes what we are trying to find in the source code.
Let's look closer at the query we wrote in the previous step.
import cpp
from Function f
where f.getName() = "strlen"
select f, "a function named strlen"
At the top of the query is import cpp
. This is an import statement . It brings into scope the standard CodeQL library that models C/C++ code, allowing us to use its features in our query. We'll use this library in every query, and in later steps we'll also use some more specialized libraries.
In the from
section, there is a declaration Function f
. Here we declare a variable named f
which has the type Function
. Function
is a class declared in the standard library (you can jump to the definition using F12
). A class represents a collection of values, in this case the collection of all C/C++ functions in the source code.
Now look at the expression f.getName()
in the where
section. Here we call the predicate getName
on the variable f
of type Function
. Predicates are the building blocks of a query: they express logical properties that we want to hold. Some predicates return results (like getName
) , and some predicates do not (they just assert that a property must be true).
So far your query finds all functions with the name strlen
. It does this by asserting that the result of f.getName()
is equal to the string "strlen"
.
We want to identify integer values that are supplied from network data. A good way to spot those is to look for use of network ordering conversion macros such as ntohl
, ntohll
, and ntohs
.
In the from
section of the query, you declare some variables, and state the types of those variables. The type tells us what the possible values are for the variable.
In the previous query you were querying for values in the class Function
to find functions in the source code. We have to query a different type to find macros in the source code instead. Can you guess its name?
NOTE: These Network ordering conversion utilities can be macros or functions depending on the platform. In this course, we are looking at a Linux database, where they are macros.
We created this course to help you quickly learn CodeQL, our query language and engine for code analysis. The goal is to find several remote code execution (RCE) vulnerabilities in the open-source software known as U-Boot, using CodeQL and its libraries for analyzing C/C++ code. To find the real vulnerabilities, you'll need to write a sequence of queries, making them more precise at each step of the course.
The goal is to find a set of 9 remote-code-execution vulnerabilities in the U-Boot boot loader. These vulnerabilities were originally discovered by GitHub Security Lab researchers and have since been fixed. An attacker with positioning on the local network, or control of a malicious NFS server, could potentially achieve remote code execution on the U-Boot powered device. This was possible because the code read data from the network (that could be attacker-controlled) and passed it to the length parameter of a call to the memcpy
function. When such a length parameter is not properly validated before use, it may lead to exploitable memory corruption vulnerabilities.
U-Boot contains hundreds of calls to both memcpy
and libc functions that read data from the network. You can often recognize network data being acted upon through use of the ntohs
(network to host short) and ntohl
(network to host long) functions or macros. These swap the byte ordering for integer values that are received in network ordering to the host's native byte ordering (which is architecture dependent).
In this course, you will use CodeQL to find such calls. Many of those calls may actually be safe, so throughout this course you will refine your query to reduce the number of false positives, and finally track down the unsafe calls to memcpy
that are influenced by remote input.
Upon completion of the course, you will have created a CodeQL query that is able to find variants of this common vulnerability pattern.
Bookmark these useful documentation links:
If you get stuck during this course and need some help, the best place to ask for help is on the GitHub Security Lab Slack. Request an invitation from the Security Lab Get Involved page and ask in the channel #codeql-writing
. There are also sample solutions in the course repository, but please try to solve the tasks on your own first!
Hope this is exciting! Please close this issue now, then wait for the next set of instructions to appear in a comment below.
A declarative, efficient, and flexible JavaScript library for building user interfaces.
๐ Vue.js is a progressive, incrementally-adoptable JavaScript framework for building UI on the web.
TypeScript is a superset of JavaScript that compiles to clean JavaScript output.
An Open Source Machine Learning Framework for Everyone
The Web framework for perfectionists with deadlines.
A PHP framework for web artisans
Bring data to life with SVG, Canvas and HTML. ๐๐๐
JavaScript (JS) is a lightweight interpreted programming language with first-class functions.
Some thing interesting about web. New door for the world.
A server is a program made to process requests and deliver data to clients.
Machine learning is a way of modeling and interpreting data that allows a piece of software to respond intelligently.
Some thing interesting about visualization, use data art
Some thing interesting about game, make everyone happy.
We are working to build community through open source technology. NB: members must have two-factor auth.
Open source projects and samples from Microsoft.
Google โค๏ธ Open Source for everyone.
Alibaba Open Source for everyone
Data-Driven Documents codes.
China tencent open source team.