sysfs_memory_blocks.c

// This file is part of KASLD - https://github.com/bcoles/kasld
//
// Enumerate memory block physical addresses from sysfs. The memory
// hotplug subsystem exposes memory blocks at:
//
//   /sys/devices/system/memory/block_size_bytes  (hex, e.g. "8000000")
//   /sys/devices/system/memory/memoryN/phys_index (hex section number)
//   /sys/devices/system/memory/memoryN/state      ("online"/"offline")
//
// All attributes are world-readable (0444). The physical address of
// each block is: phys_index * block_size. By scanning all online memory
// blocks, we derive the lowest and highest physical DRAM addresses.
//
// Leak primitive:
//   Data leaked:      physical DRAM address range (memory block indices)
//   Kernel subsystem: drivers/base/memory —
//   /sys/devices/system/memory/memory*/phys_index Data structure:   struct
//   memory_block → phys_index (section number) Address type:     physical
//   (DRAM) Method:           parsed (sysfs text attribute) Status: unfixed
//   (information exposure by design)
//   Access check:     none (world-readable sysfs attribute, 0444)
//   Source:
//   https://elixir.bootlin.com/linux/v6.12/source/drivers/base/memory.c#L120
//
// Mitigations:
//   CONFIG_MEMORY_HOTPLUG=n removes the memory block sysfs entries.
//   The phys_index attribute is world-readable (0444); no runtime
//   sysctl can restrict access. On decoupled architectures, physical
//   addresses cannot derive the virtual text base.
//
// Requires:
// - CONFIG_MEMORY_HOTPLUG (common on distros)
//
// References:
// https://elixir.bootlin.com/linux/v6.12/source/drivers/base/memory.c#L120
// https://www.kernel.org/doc/Documentation/ABI/testing/sysfs-devices-memory
// ---
// <bcoles@gmail.com>

#include "include/kasld.h"
#include "include/kasld_internal.h"
#include <dirent.h>
#include <errno.h>
#include <stdio.h>
#include <stdlib.h>
#include <string.h>

KASLD_EXPLAIN(
    "Reads physical memory block addresses from "
    "/sys/devices/system/memory/memory*/phys_index. Each world-readable "
    "(0444) entry reports the physical page frame number of a memory "
    "block (typically 128 MiB). Enumerating all blocks maps the "
    "physical DRAM layout. Requires CONFIG_MEMORY_HOTPLUG.");

KASLD_META("method:parsed\n"
           "phase:inference\n"
           "addr:physical\n"
           "config:CONFIG_MEMORY_HOTPLUG\n");

static int read_file_line(const char *path, char *buf, size_t len) {
  FILE *f = fopen(path, "r");
  if (!f)
    return -1;
  if (fgets(buf, (int)len, f) == NULL) {
    fclose(f);
    return -1;
  }
  fclose(f);
  buf[strcspn(buf, "\n")] = '\0';
  return 0;
}

int main(void) {
  const char *base = "/sys/devices/system/memory";
  char path[512];
  char buf[256];
  DIR *d;
  struct dirent *ent;
  unsigned long block_size;
  unsigned long lo = ~0ul, hi = 0;
  int count = 0;

  printf("[.] searching %s for memory block info ...\n", base);

  /* read block size */
  snprintf(path, sizeof(path), "%s/block_size_bytes", base);
  if (read_file_line(path, buf, sizeof(buf)) < 0) {
    perror("[-] cannot read block_size_bytes");
    return (errno == EACCES || errno == EPERM) ? KASLD_EXIT_NOPERM
                                               : KASLD_EXIT_UNAVAILABLE;
  }

  block_size = strtoul(buf, NULL, 16);
  if (!block_size) {
    fprintf(stderr, "[-] invalid block size\n");
    return 0;
  }

  printf("memory block size: %#lx (%lu MB)\n", block_size,
         block_size / (1024 * 1024));

  d = opendir(base);
  if (!d) {
    perror("[-] opendir");
    return (errno == EACCES || errno == EPERM) ? KASLD_EXIT_NOPERM
                                               : KASLD_EXIT_UNAVAILABLE;
  }

  while ((ent = readdir(d)) != NULL) {
    /* memory block directories are named "memoryN" */
    if (strncmp(ent->d_name, "memory", 6) != 0)
      continue;
    /* skip non-numeric suffixes (e.g. "memory" without a number) */
    if (ent->d_name[6] < '0' || ent->d_name[6] > '9')
      continue;

    /* check state — only consider online blocks */
    snprintf(path, sizeof(path), "%s/%s/state", base, ent->d_name);
    if (read_file_line(path, buf, sizeof(buf)) < 0)
      continue;
    if (strcmp(buf, "online") != 0)
      continue;

    /* read phys_index */
    snprintf(path, sizeof(path), "%s/%s/phys_index", base, ent->d_name);
    if (read_file_line(path, buf, sizeof(buf)) < 0)
      continue;

    unsigned long idx = strtoul(buf, NULL, 16);
    unsigned long addr = idx * block_size;
    if (!addr)
      continue;

    if (addr < lo)
      lo = addr;

    unsigned long end = addr + block_size - 1;
    if (end > hi)
      hi = end;

    count++;
  }
  closedir(d);

  if (!count) {
    printf("[-] no online memory blocks found\n");
    return 0;
  }

  printf("memory blocks: %d online\n", count);

  printf("lowest memory block start:  0x%016lx\n", lo);
  kasld_result(KASLD_ADDR_PHYS, KASLD_SECTION_DRAM, lo, KASLD_REGION_RAM_BASE,
               NULL);

  if (hi) {
    printf("highest memory block end:   0x%016lx\n", hi);
    kasld_result(KASLD_ADDR_PHYS, KASLD_SECTION_DRAM, hi, KASLD_REGION_RAM_TOP,
                 NULL);
  }

#if !PHYS_VIRT_DECOUPLED
  unsigned long virt = phys_to_virt(lo);
  printf("possible direct-map virtual address: 0x%016lx\n", virt);
  kasld_result(KASLD_ADDR_VIRT, KASLD_SECTION_DIRECTMAP, virt,
               KASLD_REGION_RAM_BASE, NULL);
#else
  printf("note: phys and virt KASLR are decoupled on this arch; "
         "cannot derive directmap virtual address from physical leak\n");
#endif

  return 0;
}