Add kernelCTF CVE-2023-4147_mitigation #111
Conversation
|
|
||
| The KASLR address and heap address are leaked through `nft_rule` allocated in `kmalloc-cg-192`. The leak process is as follows: | ||
|
|
||
| - Create four chains, `Base`, `Vulnerable`, `Chain_Victim`, and `Target`. Set `NFT_CHAIN_BINDING` flag for `Vulnerable`. |
There was a problem hiding this comment.
Could you elaborate more please on why do we put those chains in different tables? Could we put them in one?
There was a problem hiding this comment.
There's no particular reason for using three different tables. We can put everything in table1 and it will work, we just need to change the rule_handle value in the exploit.c.
| - Create a rule `R1` in `Base` with an `immediate expr` referencing the `Vulnerable`. | ||
| - Create a rule `R2` in `Vulnerable` with an `lookup expr` referencing the `Victim`. | ||
| - Delete the `R1`. This results in `Victim` being free from the destroy phase [3]. | ||
| - Delete the set element in `Victim`. This results in a UAF that references `Victim` that was freed in previous step [4]. |
There was a problem hiding this comment.
Could you elaborate more on how does this happen? What is the call chain, which functions are involved on kernel level? Why is it important to have the operations in batch?
Is this somewhat similar to https://github.com/oferchen/POC-CVE-2023-32233?
There was a problem hiding this comment.
By deleting the lookup expr using vulnerability, we can make similar situation to CVE-2023-32233.
I added some details to the exploit.md.
| memset(rule_data, 'b', 0x100); | ||
|
|
||
| nftnl_rule_set_str(rules_victim2[i], NFTNL_RULE_TABLE, table2_name); | ||
| nftnl_rule_set_str(rules_victim2[i], NFTNL_RULE_CHAIN, chain_victim2_name); |
There was a problem hiding this comment.
How do we add rule to the chain with NFT_CHAIN_BINDING flag without using chain ID (like in vulnerability) or like in rule_lookup_set1 and chain2_name?
There was a problem hiding this comment.
We can add a rule to the chain with NFT_CHAIN_BINDING set before it is bound by an immediate expr.
koczkatamas
force-pushed
the
master
branch
2 times, most recently
from
b2e2b9f
to
43a5a81
Compare
No description provided.