5 ms·
How does this use-after-free turn into an arbitrary code execution vuln? I don't see any jmp to the pointer?
by sargun 8y ago
How does this use-after-free turn into an arbitrary code execution vuln? I don't see any jmp to the pointer?
- deleted 8y ago[deleted]
- 0x0 8y agoMaybe it can be used to write a "0" into a useful kernel structure such as a forked process' effective uid (thus escalating to uid0)
- Sohcahtoa82 8y agoWouldn't that just be a privilege escalation though, not arbitrary code execution?
- 0x0 8y agoWell if you are root then you can usually load random kernel modules and in general do whatever you want on the system.
- prudhvis 8y agoDoes that mean then, that every privilege escalation be arbitrary code execution?
- darawk 8y agoI'd say so, yes, assuming that you can then execute arbitrary code with the elevated privileges.
- Sohcahtoa82 8y agoI'd say no, because to be able to make a privilege escalation attack useful, you'd have to already have arbitrary code execution.
- darawk 8y agoNot necessarily. You could, for instance, elevate the privileges of a process you can't completely control, which might allow you to read sensitive files or disrupt a system, but not perform arbitrary actions with those privileges.
- Sohcahtoa82 8y agoI concede that privesc without code execution can be useful, but my original claim that privesc is not necessarily code execution still stands.
- darawk 8y agoI think we agree then? I said "assuming you can execute arbitrary code with the elevated privileges".
- SahAssar 8y agoNo, in some cases code execution is not the goal at all. A privesc can mean admin access to a system you didn't previously have access to, it can mean access to logs or a direct tap into network data in some systems. You often don't need arbitrary code exec for that since its features built into the apps or the systems hosting them.
- SahAssar 8y agoNo, since privilege escalation can also mean that you are able to take specific actions that you wouldn't otherwise be able to take. It does not always mean code execution.
- Sohcahtoa82 8y agoRight...but that doesn't mean it's correct to refer to a privesc exploit as arbitrary code execution. For a privesc exploit to be valuable, you typically need to already have code execution. EDIT: I concede in another comment that privesc without code execution can still be useful, but my original claim that privesc does not imply arbitrary code execution still stands.
- 0x0 8y agoMaybe it's shorthand for "arbitrary code execution in the kernel mode context".
- SahAssar 8y agoThat is not true for all systems, a lot of attacks in most systems do not need code execution but do need privilege escalation. Getting privilege escalation by definition means that _you are allowed to do stuff you couldn't_ which in itself is an attack vector.
- zAy0LfpBZLC8mAC 8y agoBut privilege escalation does not imply "being root", it only means "ability to perform operation as root" (or whatever the role is can can be compromised). If your distribution accidentally packaged a suid root /bin/cat, that would allow a normal user to perform (read) operations on all files on the system, so it would be a privilege escalation, but it would not necessarily lead to arbitrary code execution as root (unless that allowed you to read a file with the root password, say).
- Sohcahtoa82 8y agoGoing off topic, but did you use a password generator to create your username or something? Or does it have a meaning?
- Y_Y 8y agoIt's the payload for a browser exploit
- muricula 8y agoOverwrite the return address or a function pointer instead. Then when the address/pointer is used you can execute whatever you want. Loop up Return Oriented Programming.
- altmind 8y agoI urge the mods to correct the title. Maybe: Linux<4.20.10 af_alg_release use-after-free vulnerability[CVE-2019-8912]
- cmurf 8y agohttps://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/tree/crypto/af_alg.c?h=v4.20.11 https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux... See line 126-127 and compared to the patch at the bottom of: http://patchwork.ozlabs.org/patch/1042902/ http://patchwork.ozlabs.org/patch/1042902/ Patch is not yet merged into 5.0.0rc7 either. Whereas it is in linux-next. https://git.kernel.org/pub/scm/linux/kernel/git/next/linux-next.git/tree/crypto/af_alg.c?h=next-20190220 https://git.kernel.org/pub/scm/linux/kernel/git/next/linux-n... Update: I expect all of the longterm kernels listed on kernel.org will get a backport.
- dang 8y agoThat's too complicated. If someone can distill this to a simple, clear, neutral title, we'll happily change it.
- viraptor 8y agoIt depends on manipulating/knowing what gets allocated in the same region. If you know what gets written to the freed space or you can try to force the right allocations to happen, you get almost-arbitrary write. For a made up example, imagine something allocates a structure with a pointer to a function struct->foo, then frees it, but still holds a reference. Now you call a function which allocates a buffer in the same place and copies your arguments into it. When you make the original code try to call struct->foo again, you can any function you want.
- kanox 8y agoAre there practical attacks for write-after-free? Controlling where the OS allocates an important structure seems very difficult and mistakes would likely result in corrupting unrelated data and a crash later on.
- viraptor 8y agoSure there are. Kernel makes this a bit easier since you have heaps for objects of a given size (which means it's much easier to overlap old structure when you know the size). Browsers (for JS -> native escape) make it a bit easier by allowing you to allocate lots of objects and having pointers everywhere. In many cases you can also spam all over the heap and hope for the best, since allocations are almost always aligned. I think most browser exploits are actually use-after-free. Check out how simple they can be: https://www.exploit-db.com/exploits/40946 https://www.exploit-db.com/exploits/40946
- mediocrejoker 8y agoWhat is the kernel-space equivalent of a root shell? presumably you wouldn't try to load your full payload into the kernel space, just try to give yourself root access somehow?
- monocasa 8y agocurrent->cred->uid = 0;