Bugs

• CVE-2010-4258
  • inproperly handle KERNEL_DS
• CVE-2010-3849
  • NULL dereference
• CVE-2010-3850
  • missing capability check

CVE-2010-4258

CVE-2010-3849

CVE-2010-3849

• lxr@af_econet.c?v=3.1#L745

  static const struct proto_ops econet_ops = {
     .ioctl
     .sendpage = sock_no_sendpage
       -> kernel_sendmsg
          -> set_fs(KERNEL_DS) &
          -> sock_sendmsg(sock, msg, size)
             -> sock->ops->sendmsg()
  }

CVE-2010-3850

Arbitrary NULL write

• CVE-2010-4258 w/
  • set_fs(KERNEL_DS)
  • kernel oops
  • an arbitrary NULL write via clone()
• CVE-2010-3849
  • enable two above conditions
  • but not accessible!
• CVE-2010-3850
  • enable CVE-2010-3849

Exploit strategy

• Arbitrary NULL write -> ret2usr
• Truncate high bits of a kernel func ptr (econet_ioctl)
  • 32bit: 0xffffabcd -> 0x00ffabcd

       +-- func ptr
       V
      [cd ab ff ff AA BB CC DD]
                ^
                +--------->
                overwrite

Gaining a root

  @0x00ffabcd
  commit_creds(prepare_kernel_cred(0));

Two questions

• Do we need sysctl -w vm.mmap_min_addr=0?
• Can we exploit without ret2dir?