Exploiting the Linux kernel via packet sockets

https://googleprojectzero.blogspot.com/2017/05/exploiting-linux-kernel-via-packet.html

by jgrahamc • 9 years ago

197 38 9 years ago

googleprojectzero.blogspot.com

googsh0tz• 9 years ago

You know, like I said the intel thing.

I don't think this is related to the Intel thing at all. It's not technically related, and it's not related in terms of severity.

dom0• 9 years ago

Either has headlines made of words, so that's something.

lowbloodsugar• 9 years ago

Such great education material.

tener• 9 years ago

Great read as usual. They are doing a big service to the people out there by hunting bugs like this one and putting the pressure on the vendors to fix their products.

Achshar2• 9 years ago

I wish I was smart enough for the article. 8 years of web dev doesn't make the cut unfortunately.

tyingq3• 9 years ago

It's just domain knowledge and terminology. "Packet sockets" is shorthand for the AF_PACKET type sockets in Linux that let you construct network packets from the ground up, including the ethernet header, if you so wish.

That's as opposed to a regular socket, which is higher level and restricts you to a much smaller subset of things you can change/set.

The article just shows how they uncovered an exploit by "fuzzing" input to packet sockets. Where "fuzzing" just means using a tool that creates random inputs/values.

Achshar2• 9 years ago

The concept I think I can still get my head around. It's all the stuff that surrounds it that eludes me. I have done some work in C but that C is unlike any of the C I wrote in college (duh, it's the kernel code)

_jordan2• 9 years ago

yeah webapps in general are the most simple aspect of programming that you can get paid to do. Not knocking it though

yeukhon• 9 years ago

(and I can't do any frontend work). Every job has its own difficulties and its own obstacles.

off-topic, btw, I read tpacket == tptacek. He can easily hide in Linux kernel. No one noticed, until now.

BenjiWiebe• 9 years ago

I personally find embedded programming easier than web development...

nine_k• 9 years ago

Webapps use some of the highest-level tools, quite abstracted from most actual hardware.

This does not make webapps necessarily simple: complex UI logic, asynchronous everything often constant two-way communication with a server, maybe with conflict resolution, etc.

fencepost2• 9 years ago

Someone correct me if I'm wrong:

This is a locally exploitable privilege escalation involving creation of the socket, triggerable from user level, so exploitable by local users or as a followup after another exploit is used to get some level of local access, correct?

eyalm2• 9 years ago

Not really. Requires to have the CAP_NET_RAW capability, which is pretty rare. (This capability allows you raw access to the network interface, which is usually only given to the root user)

fencepost2• 9 years ago

Thanks, I was a bit concerned at first when I saw the 4 words "Exploiting Linux kernel packet" on one line, but as a privilege escalation after a first exploit I won't worry as much about it.

scarybeast2• 9 years ago

No. It's exploitable by a normal unprivileged user on modern Ubuntu. From the article, "Let’s see how we can exploit this vulnerability. I’m going to be targeting x86-64 Ubuntu 16.04.2 with 4.8.0-41-generic kernel version with KASLR, SMEP and SMAP enabled. Ubuntu kernel has user namespaces available to unprivileged users (CONFIG_USER_NS=y and no restrictions on it’s usage), so the bug can be exploited to gain root privileges by an unprivileged user."

eyalm2• 9 years ago

Bottom line - locally exploitable vulnerability in the linux kernel, in case you have the CAP_NET_RAW capability which never really happens. Not a real security threat for your standard linux distro.

On the other hand, this is a great technical write-up that describes thoroughly the internals of some of the linux kernel subsystems. Probably the best documentation you can find for some subsystems. Also shows how they bypassed exploit mitigations technics such as KASLR, SMAP&SMEP.

dohqu8Zi4• 9 years ago

No.

Create a new user namespace and you have CAP_NET_RAW within your shiny new namespace.

d33• 9 years ago

That's pretty interesting. Does it mean it allows escaping Docker containers if you compromise a service ran as root in it?

glandium• 9 years ago

But you need capabilities to create that new user namespace (CAP_SYS_ADMIN, I think)

caf• 9 years ago

You also need to create a network namespace, because to create an AF_PACKET socket you need to have CAP_NET_RAW in the user namespace that owns your network namespace, not the user namespace you're in.

ploxiln• 9 years ago

Right, but "unprivileged user namespaces" are disabled in many contexts, because they've been a source of many vulnerabilities due to code originally thought to only be reachable by root anyway.

Archlinux has user namespaces disabled, docker does not use them by default and does not allow them inside containers by default, on Ubuntu I make sure to disable kernel.unprivileged_userns_clone on all the servers I deploy to, etc.

thesz• 9 years ago

Is is only me who remembered that [1] piece of parody?

[1] http://web.mit.edu/adorai/www/seuss-technical-writing.html

est• 9 years ago

So are there any Android binaries have CAP_NET_RAW so I can root the device?

yjftsjthsd-h• 9 years ago

Ping?

Exploiting the Linux kernel via packet sockets

Related Stories