资源描述：
《System Kernel Security and Exploitation.pdf》由会员上传分享，免费在线阅读，更多相关内容在学术论文-天天文库。
1、SystemKernelSecurityandExploitationGiovannaJ.LavadoUniversitadegliStudidiMilano,DipartimentodiInformaticaLaboratoriodiLinguaggieCombinatoriaviaComelico39,20135,Milano,Italygiovanna.lavado@unimi.itAbstract.Inthisreportweanalysearealkernelvulnerability.Inpar-ticular,wetreat
2、the64-bitcompatibilitymodestackpointerunder
ow,namelyCVE-2010-3081.Keywords:security,kernel,linux,exploit,CVE-2010-3081ThevulnerabilitywaspresentinasubsystemofLinuxcalledcompatibilitymodeorcompatlayer[1{3],whichisusedon64-bitsystemstomaintaincom-patibilitywith32-bitbinarie
3、sbyprovidingallthesystemcallsin32-bitform.Tomaintainthecompatibilitywith32-bitbinariestheLinuxdevelopersdecidedtocreateawrapperfunctionforcompatmode,whichtakestheargumentsfromuserspacein32-bitformandthenputsthemin64-bitformbeforetoinvokethesystemcall.Ifsomeargumentsarestru
4、ctures(structs),itcreatesanew64-bitstructbasedonthe32-bitstruct.Thecompatsubsystemprovidesafunctionto ndthestructontheuser'saddressspace.ThefollowingistheoriginalCVEadvisory[4]:Thecompatallocuserspace()functionsininclude/asm/compat.h lesintheLinuxkernelbefore2.6.36-rc4-git
5、2on64-bitplatformsdonotproperlyallocatetheuserspacememoryrequiredforthe32-bitcompatibilitylayer,whichallowslocaluserstogainprivilegesbyleveragingtheabilityofthecompatmcgetsockopt()function(akatheMCASTMSFILTERgetsockoptsupport)tocontrolacertainlengthvalue,relatedtoastackpo
6、interunder
ow"issue,asexploitedinthewildinSeptember2010.Ifwecallgetsockopt()in32-bitfashiononasocketthatrepresentsanetworkconnectionoverIP,andpassanoptnameofMCASTMSFILTER,thenina64-bitkernelweendupincompatmcgetsockopt()function(seeListing1.1).1intcompatmcgetsockopt(structs
7、ocksock,intlevel,intoptname,charuseroptval,intuseroptlen,int(getsockopt)(structsock,int,int,charuser,intuser))Listing1.1.compatmcgetsockopt()functionTheproblemstartsinanallocationroutineusedbythecompatibilitylayer,thecompatallocuserspace()function.Thisfunctionalloca
8、tesandreturnsthespaceontheuserspacekernelstackforthekerneltouse.InListing1.2weshowthecomp
