Note: Must not touch offset 0x10-0x18.

Note: Must not touch offset 0x10-0x18.

Note: Must not touch offset 0x10-0x18.

calc_vuln_expr_params_div() —— 计算可写的范围, 以及是否能将值 desired 写入到 sreg

check_heap_leak() —— read/free all msg to leak `net_device`

6-3. CFH - construct CFH

6-1. CFH initialize

6-2. CFH - setup network interface

6-4. CFH - trigger

提权后执行的 payload: 内核以 root 权限执行 exploit 二进制时调用此函数 通过 pidfd_open + pidfd_getfd 从父进程窃取 stdio fd, 然后执行 cat /flag 读取 flag 并重启系统

子进程函数: 等待 core_pattern 被 ROP 覆写后,触发 crash 实现提权 1. 通过 memfd + sendfile 将 exploit 二进制写入 fd 666 2. 轮询 /proc/sys/kernel/core_pattern 直到检测到覆写成功 3. 触发 NULL

create_br1337() —— test if openswitch enabled

create_dummy_file(): Create a file to trigger call_modprobe in case of execution

create_infoleak_rule() —— create rule to leak and compare with cmp

create_message_thread() —— spray 8 msg_msg and msg_msgseg, which hangs at copy_from_user(), to change modprobe_path

create faultpage handler

create_table(): Register a new table for the inet family

create_xattr(): Add an xattribute to a file with the value "value"

[4] 跨缓存攻击: 将 perf_event slab 页返还 buddy 分配器,然后用 msg_msgseg 回收。注意，`perf_event`和kmalloc-cg-1k`都从order-2 page取内存，而kmalloc-cg-4k从order-3 page取内存 perf_event

4 dccp connect

release all msg_msg in kmalloc-512

do_init() —— bind cpu & set namespace & get flow_family_id & get msg queue & sock_pairs[4][2]

change msg_msg->m_ts to leak seq_operations->stop (510*8-0xfd0 = 0x20)

do_leak() —— leak kernel base

create sub-process to escalate privilege

create sub-process to escalate privilege and check whether the "/etc/passwd" is changed

do_setxattr() —— setxattr() -> block -> place another object -> getxattr() to leak

hijack control-flow: arb free -> hijack pipe_buffer

msg_msg arb write trick by hanging before msgseg on usercopy use FUSE to time the race

exploit_step1() —— leak kmalloc-0x400 (msg_msg->m_list.next / prev)

exploit_step2() —— forge pipe_buffer->flags & overwrite "/usr/bin/mount"

leak `xfrm_policy->timer.function` - 比较n多xfrm_policy成员来确保泄露正确

Main

free_netdevice() —— OOB write 3rd msg_msg->security to free `net_device` 0x18 0x68 0xb8 (0xc0+0x48) (0xc0+0x98) (0xc0+0xc0+0x28)

spray $num_msg msg_msg at page_fault addr ------ use thread ----- trigger page fault at (dst+8)

gather_mqueue() —— read msg_msg to leak kernel_base