[PPT] - Exploiting Uses of Uninitialized Stack Variables in Linux Kernels PowerPoint Presentation

SLIDE 1

Exploiting Uses of Uninitialized Stack Variables in Linux Kernels to Leak Kernel Pointers

Haehyun Cho, Jinbum Park, Joonwon Kang, Tiffany Bao Ruoyu Wang, Yan Shoshitaishvili, Adam Doupé, Gail-Joon Ahn

SLIDE 2

Uninitialized variables in the stack

2

void func () { int num; int ret; … } Kernel Stack

Base Base – 8n SP

SLIDE 3

0x 1111 2222 3333 4444 0x aaaa bbbb cccc dddd … … … … Kernel Stack

Base Base – 8n SP

Uninitialized variables in the stack

3

void func () { int num; int ret; … }

SLIDE 4

Uninitialized variables in the stack

4

void func () { int num = 0; int ret = 0; struct data_struct = {0,}; … } 0x 0000 0000 0000 0000 0x 0000 0000 0000 0000 0x 0000 0000 0000 0000 0x 0000 0000 0000 0000 0x 0000 0000 0000 0000 0x dead beef 0000 0000 0x 0000 0000 0000 0000 0x 0000 0000 0000 0000 0x 0000 0000 0000 0000 Kernel Stack

Base Base – 8n SP

SLIDE 5

Unexpected information leaks

5

void func () { int num = 0; int ret = 0; struct data_struct = {0,}; … } 0x 0000 0000 0000 0000 0x 0000 0000 0000 0000 0x 0000 0000 0000 0000 0x 0000 0000 0000 0000 0x 0000 0000 0000 0000 0x dead beef 0000 0000 0x 0000 0000 0000 0000 0x 0000 0000 0000 0000 0x 0000 0000 0000 0000 Kernel Stack

Base Base – 8n SP

If uninitialized data can be copied to

the user-space…

SLIDE 6

Real-world example (CVE-2016-4486)

6

/* file: net/core/rtnetlink.c */ static int rtnl_fill_link_ifmap(struct sk_buff *skb, struct net_device *dev) { //all fields in the map object are initialized struct rtnl_link_ifmap map = { .mem_start = dev->mem_start, .mem_end = dev->mem_end, .base_addr = dev->base_addr, .irq = dev->irq, .dma = dev->dma, .port = dev->if_port, }; //kernel data leak to the user-space if(nla_put(skb, IFLA_MAP, sizeof(map), &map)) return -EMSGSIZE; return 0; }

SLIDE 7

Real-world example (CVE-2016-4486)

7

/* file: net/core/rtnetlink.c */ static int rtnl_fill_link_ifmap(struct sk_buff *skb, struct net_device *dev) { //all fields in the map object are initialized struct rtnl_link_ifmap map = { .mem_start = dev->mem_start, .mem_end = dev->mem_end, .base_addr = dev->base_addr, .irq = dev->irq, .dma = dev->dma, .port = dev->if_port, }; //kernel data leak to the user-space if(nla_put(skb, IFLA_MAP, sizeof(map), &map)) return -EMSGSIZE; return 0; } + 4 padding bytes

SLIDE 8

Basic security principle of the OS kernels

Applications are not allowed to

access the kernel memory

Restricted Kernel data must not

leave the kernel memory

8

Kernel Applications X X

SLIDE 9

Information leaks are not rare

In Linux kernel,

Information leak vulnerabilities are the most prevalent type [1].
Kernel Memory Sanitizer (KMSAN) discovered more than a hundred

uninitialized data use bugs [2].

9

[1] Haogang Chen, Yandong Mao, Xi Wang, Dong Zhou, Nickolai Zeldovich, and M Frans Kaashoek. Linux kernel vulnerabilities: State-of-the-art defenses and open problems. In Proceedings of the 2nd Asia-Pacific Work- shop on Systems (APSys), Shanghai, China, July 2011. [2] KernelMemorySanitizer, a detector of uses of uninitialized memory in the Linux kernel. https://github.com/google/kmsan. [3] Kangjie Lu, Marie-Therese Walter, David Pfaff, Ste- fan Nümberger, Wenke Lee, and Michael Backes. Un- leashing Use-Before-Initialization Vulnerabilities in the Linux Kernel Using Targeted Stack Spraying. In Proceedings of the 2017 Annual Network and Distributed System Security Symposium (NDSS), San Diego, CA, February–March 2017.

SLIDE 10

Information leaks are not rare

In Linux kernel,

Information leak vulnerabilities are the most prevalent type [1].
Kernel Memory Sanitizer (KMSAN) discovered more than a hundred

uninitialized data use bugs [2]. However, these vulnerabilities are commonly believed to be of low risks [3]. à not assigned any CVE entries and not patched in some cases

10

[1] Haogang Chen, Yandong Mao, Xi Wang, Dong Zhou, Nickolai Zeldovich, and M Frans Kaashoek. Linux kernel vulnerabilities: State-of-the-art defenses and open problems. In Proceedings of the 2nd Asia-Pacific Work- shop on Systems (APSys), Shanghai, China, July 2011. [2] KernelMemorySanitizer, a detector of uses of uninitialized memory in the Linux kernel. https://github.com/google/kmsan. [3] Kangjie Lu, Marie-Therese Walter, David Pfaff, Ste- fan Nümberger, Wenke Lee, and Michael Backes. Un- leashing Use-Before-Initialization Vulnerabilities in the Linux Kernel Using Targeted Stack Spraying. In Proceedings of the 2017 Annual Network and Distributed System Security Symposium (NDSS), San Diego, CA, February–March 2017.

SLIDE 11

Survey result on information leak CVEs

Total Stack-base Heap-base # of exploits # of CVEs 87 76 11

11

The majority of these CVES are stack-based information leaks.
0 public exploit and 0 proof-of-vulnerability (PoV)
Even with a PoV, it is difficult to evaluate the exploitability
Only once CVE (CVE-2017-1000410) mentions that

“Potential of leaking kernel pointers and bypassing KASLR”

The number of information leak CVEs related to uses of uninitialized data between 2010 and 2019.

SLIDE 12

Our Goal

Reveal the actual exploitability and severity of information leak bugs
Converts stack-based information leaks in Linux kernels into

vulnerabilities that leak kernel pointer values.

We focus on leaking pointer values that are pointing to

(1) kernel functions or (2) the kernel stack.

12

SLIDE 13

Challenges in Exploitation

Computing the offset to uninitialized

data from the kernel stack base.

13

0x ???? ???? ???? ???? 0x ???? ???? ???? ???? 0x ???? ???? ???? ???? 0x ???? ???? ???? ???? 0x ???? ???? ???? ???? 0x dead beef ???? ???? 0x ???? ???? ???? ???? 0x ???? ???? ???? ???? 0x ???? ???? ???? ???? Kernel Stack

Base Base – 8n

SLIDE 14

Challenges in Exploitation

Computing the offset to uninitialized

data from the kernel stack base.

Storing kernel pointer values at a leak
ffset.

14

0x ???? ???? ???? ???? 0x ???? ???? ???? ???? 0x ???? ???? ???? ???? 0x ???? ???? ???? ???? 0x ???? ???? ???? ???? 0x ffff ff04 ???? ???? 0x ???? ???? ???? ???? 0x ???? ???? ???? ???? 0x ???? ???? ???? ???? Kernel Stack

Base Base – 8n

SLIDE 15

Challenges in Exploitation

Computing the offset to uninitialized

data from the kernel stack base.

Storing kernel pointer values at a leak
ffset.
Handling data leaks that are less than

8 bytes.

15

0x ???? ???? ???? ???? 0x ???? ???? ???? ???? 0x ???? ???? ???? ???? 0x ???? ???? ???? ???? 0x ???? ???? ???? ???? 0x ffff ff04 ???? ???? 0x ???? ???? ???? ???? 0x ???? ???? ???? ???? 0x ???? ???? ???? ???? Kernel Stack

Base Base – 8n

SLIDE 16

Our Approach

16

PoVs Analysis Exploitability and exploits

SLIDE 17

Computing the Leak Offset

Stack footprinting

1. Fill the kernel stack

17

0x 0101 0101 0101 0101 0x 0202 0202 0202 0202 0x 0303 0303 0303 0303 0x 0404 0404 0404 0404 0x 0505 0505 0505 0505 0x 0606 0606 0606 0606 0x 0707 0707 0707 0707 0x 0808 0808 0808 0808 0x 0909 0909 0909 0909 0x 0a0a 0a0a 0a0a 0a0a … … … … Kernel Stack

Base Base – 8n

SLIDE 18

Computing the Leak Offset

Stack footprinting

1. Fill the kernel stack
2. Trigger a vulnerability
3. Check the footprint

18

0x ???? ???? ???? ???? 0x ???? ???? ???? ???? 0x ???? ???? ???? ???? 0x 0404 0404 ???? ???? 0x ???? ???? ???? ???? 0x ???? ???? ???? ???? 0x ???? ???? ???? ???? 0x ???? ???? ???? ???? 0x ???? ???? ???? ???? 0x ???? ???? ???? ???? … … … … Kernel Stack

Base Base – 8n

0x 0404 0404 ???? ????

SLIDE 19

Computing the Leak Offset

Stack footprinting

1. Fill the kernel stack
2. Trigger a vulnerability
3. Check the footprint
4. Compute the offset

à Leak offset = Base - 24

19

0x ???? ???? ???? ???? 0x ???? ???? ???? ???? 0x ???? ???? ???? ???? 0x 0404 0404 ???? ???? 0x ???? ???? ???? ???? 0x ???? ???? ???? ???? 0x ???? ???? ???? ???? 0x ???? ???? ???? ???? 0x ???? ???? ???? ???? 0x ???? ???? ???? ???? … … … … Kernel Stack

Base Base – 8n

0x 0404 0404 ???? ????

SLIDE 20

Extensive Syscall Testing with the LTP

Linux Test Project (LTP) provides concrete test cases for system calls.
Three additional steps onto each syscall test case
1. Spraying the kernel stack with a magic value
2. Finding kernel pointer values stored in the stack
3. Recording context information

20

SLIDE 21

Syscall Testing with the LTP

1. Fill the kernel stack

21

0x 1122 3344 5566 7788 0x 1122 3344 5566 7788 0x 1122 3344 5566 7788 0x 1122 3344 5566 7788 0x 1122 3344 5566 7788 0x 1122 3344 5566 7788 0x 1122 3344 5566 7788 0x 1122 3344 5566 7788 0x 1122 3344 5566 7788 0x 1122 3344 5566 7788 … … … … Kernel Stack

Base Base – 8n

SLIDE 22

Syscall Testing with the LTP

1. Fill the kernel stack
2. Execute a syscall using a testcase
3. Inspect the kernel stack

22

0x ???? ???? ???? ???? 0x ???? ???? ???? ???? 0x ???? ???? ???? ???? 0x ???? ???? ???? ???? 0x ???? ???? ???? ???? 0x ???? ???? ???? ???? 0x ???? ???? ???? ???? 0x ???? ???? ???? ???? 0x ???? ???? ???? ???? 0x ???? ???? ???? ???? … … … … Kernel Stack

Base Base – 8n

Kernel pointer to a kernel function Kernel pointer to the kernel stack

SLIDE 23

Syscall Testing with the LTP

1. Fill the kernel stack
2. Execute a syscall using a testcase
3. Inspect the kernel stack
4. Record the context information

23

0x ???? ???? ???? ???? 0x ???? ???? ???? ???? 0x ???? ???? ???? ???? 0x ???? ???? ???? ???? 0x ???? ???? ???? ???? 0x ???? ???? ???? ???? 0x ???? ???? ???? ???? 0x ???? ???? ???? ???? 0x ???? ???? ???? ???? 0x ???? ???? ???? ???? … … … … Kernel Stack

Base Base – 8n

Kernel pointer to a kernel function Kernel pointer to the kernel stack Offset : Base – 24 Type : Kernel code Syscall : mmap Args : 0,8,0,0,-1,0 Offset : Base – 64 Type : Kernel stack Syscall : mmap Args : 0,8,0,0,-1,0

SLIDE 24

Stack Spraying via BPF

The extended Berkeley Packet Filter (BPF)

allows users to make a program and execute it inside the kernel.

BPF program has its own stack (512 bytes)

24

0x ???? ???? ???? ???? 0x ???? ???? ???? ???? 0x ???? ???? ???? ???? 0x ???? ???? ???? ???? 0x ???? ???? ???? ???? 0x ???? ???? ???? ???? 0x ???? ???? ???? ???? 0x ???? ???? ???? ???? 0x ???? ???? ???? ???? 0x ???? ???? ???? ???? Kernel Stack Pointer to the base address

f a BPF program

Spraying the frame pointer by crafting BPF instructions

SLIDE 25

Stack Spraying via BPF

The extended Berkeley Packet Filter (BPF)

allows users to make a program and execute it inside the kernel.

BPF program has its own stack (512 bytes)
If we leak the frame pointer,

we can identify the layout of kernel stack

25

0x ???? ???? ???? ???? 0x ???? ???? ???? ???? 0x ???? ???? ???? ???? 0x ???? ???? ???? ???? 0x ???? ???? ???? ???? 0x ???? ???? ???? ???? 0x ???? ???? ???? ???? 0x ???? ???? ???? ???? 0x ???? ???? ???? ???? 0x ???? ???? ???? ???? Kernel Stack Pointer to the base address

f a BPF program

Spraying the frame pointer by crafting BPF instructions

SLIDE 26

Need the most important 52 bits (7 bytes) of a kernel stack address
the kernel stack is aligned by the size of a page (i.e., 4KB, by default)
If we only know 4 bytes … ?

à Guess and check!

0x ffff ff04 2000 0000

Handling Small Data Leaks

26

SLIDE 27

Handling Small Data Leaks

Need the most important 52 bits (7 bytes) of a kernel stack address
the kernel stack is aligned by the size of a page (i.e., 4KB, by default)
If we only know 4 bytes … ?

à Guess and check!

e.g.,

spraying (FP — 0x0000 0000 3000 0000)

27

0x ffff ff04 2000 0000 0x ffff ff03 ???? ???? Hidden data < 0x 3000 0000

SLIDE 28

Handling Small Data Leaks

Need the most important 52 bits (7 bytes) of a kernel stack address
the kernel stack is aligned by the size of a page (i.e., 4KB, by default)
If we only know 4 bytes … ?

à Guess and check!

e.g.,

spraying (FP — 0x0000 0000 3000 0000) spraying (FP — 0x0000 0000 1234 0000)

28

0x ffff ff03 ???? ???? Hidden data < 0x 3000 0000 0x ffff ff04 ???? ???? Hidden data > 0x 1234 0000 0x ffff ff04 2000 0000

SLIDE 29

Evaluation

29

SLIDE 30

Finding pointers with the LTP framework

30

1160 1224 1288 1352 1416 1480 1544 1608 1672 1736 1800 1864 1928 1992 2056 2120 2184 2248 6tacN offsets 10 20 30 40 50 60 70

1uPber of Sossible cases 3ointing to the Nernel stacN 3ointing to the Nernel code

64 128 192 256 320 384 448 512 576 640 704 768 832 896 960 1024 1088 6tacN offsets 10 20 30 40 50 60 70

1uPber of Sossible cases 3ointing to the Nernel stacN 3ointing to the Nernel code

SLIDE 31

Summary of exploitation results

Vulnerability Leak Size CVSS Exploitation Result CVE-2018-11580 4 bytes 2.1 Bypass KASLR CVE-2016-4569 4 bytes 2.1 Bypass KASLR Fixes: 372f525 4 bytes N/A Bypass KASLR CVE-2016-4486 4 bytes 2.1 Reveal the kernel stack base CVE-2016-5244 1 byte 5 Failed

31

SLIDE 32

Summary of exploitation results

Vulnerability Leak Size CVSS Exploitation Result CVE-2018-11580 4 bytes 2.1 Bypass KASLR CVE-2016-4569 4 bytes 2.1 Bypass KASLR CVE-2016-4486 4 bytes 2.1 Reveal the kernel stack base Fixes: 372f525 4 bytes N/A Bypass KASLR CVE-2016-5244 1 byte 5 Failed

32

Vulnerability Leak Size CVSS Exploitation Result CVE-2018-11580 4 bytes 2.1 Bypass KASLR CVE-2016-4569 4 bytes 2.1 Bypass KASLR Fixes: 372f525 4 bytes N/A Bypass KASLR CVE-2016-4486 4 bytes 2.1 Reveal the kernel stack base CVE-2016-5244 1 byte 5 Failed

SLIDE 33

Summary of exploitation results

Vulnerability Leak Size CVSS Exploitation Result CVE-2018-11580 4 bytes 2.1 Bypass KASLR CVE-2016-4569 4 bytes 2.1 Bypass KASLR Fixes: 372f525 4 bytes N/A Bypass KASLR CVE-2016-4486 4 bytes 2.1 Reveal the kernel stack base CVE-2016-5244 1 byte 5 Failed

33

SLIDE 34

Conclusion

Proposed a generic approach to exploit uses of uninitialized stack
Can effectively analyze stack-based information-leak vulnerabilities
Leaked pointer values -> Bypassing KASLR
Can help adjust CVSS scores

34

SLIDE 35

35

Exploiting Uses of Uninitialized Stack Variables in Linux Kernels - - PowerPoint PPT Presentation

Exploiting Uses of Uninitialized Stack Variables in Linux Kernels to Leak Kernel Pointers

Uninitialized variables in the stack

Uninitialized variables in the stack

Uninitialized variables in the stack

Unexpected information leaks

Real-world example (CVE-2016-4486)

Real-world example (CVE-2016-4486)

Basic security principle of the OS kernels

Kernel Applications X X

Information leaks are not rare

Information leaks are not rare

Survey result on information leak CVEs

Our Goal

Challenges in Exploitation

Challenges in Exploitation

Challenges in Exploitation

Our Approach

Computing the Leak Offset

Computing the Leak Offset

Computing the Leak Offset

Extensive Syscall Testing with the LTP

Syscall Testing with the LTP

Syscall Testing with the LTP

Syscall Testing with the LTP

Stack Spraying via BPF

Stack Spraying via BPF

Handling Small Data Leaks

Handling Small Data Leaks

Handling Small Data Leaks

Evaluation

Finding pointers with the LTP framework

Summary of exploitation results

Summary of exploitation results

Summary of exploitation results

Conclusion

Haehyun Cho haehyun@asu.edu https://haehyun.github.io