#ifdef __CHECKER__
# define __user __attribute__((noderef, address_space(1)))
# define __kernel /* default address space */
#else
# define __user
# define __kernel
#endifphp

noderef告訴編譯器，不該該解除該指針的引用，由於在當前地址空間中它是沒有意義的。node

這裏的CHECKER表示是否使用了Sprase（就是一種靜態分析工具，用來分析內核源碼中的BUG）。是否是想研究一下了？呵呵。能夠參見http://sparse.wiki.kernel.org/index.php/Main_Pagelinux

因此對於這種變量，在kernel中使用要用到copy_to_user和copy_from_user。less

  • 在Linux中的實例:(net/rds/page.c)
  • int rds_page_copy_user(struct page *page, unsigned long offset,
               void __user *ptr, unsigned long bytes,
               int to_user)
{
    unsigned long ret;
    void *addr;

    if (to_user)
        rds_stats_add(s_copy_to_user, bytes);
    else
        rds_stats_add(s_copy_from_user, bytes);

    addr = kmap_atomic(page, KM_USER0);
    if (to_user)
        ret = __copy_to_user_inatomic(ptr, addr + offset, bytes);
    else
        ret = __copy_from_user_inatomic(addr + offset, ptr, bytes);
    kunmap_atomic(addr, KM_USER0);

    if (ret) {
        addr = kmap(page);
        if (to_user)
            ret = copy_to_user(ptr, addr + offset, bytes);
        else
            ret = copy_from_user(addr + offset, ptr, bytes);
        kunmap(page);
        if (ret)
            return -EFAULT;
    }

    return 0;

     

  • Vulnerability Details

    On Linux, recvmsg() style socket calls are performed using iovec structs, which allow a user to specify a base address and size for a buffer used to receive socket data. Each packet family is responsible for defining functions that copy socket data, which is received by the kernel, back to user space to allow user programs to process and handle received network data.dom

    When performing this copying of data to user space, the RDS protocol failed to verify that the base address of a user-provided iovec struct pointed to a valid userspace address before using the__copy_to_user_inatomic() function to copy the data. As a result, by providing a kernel address as an iovec base and issuing a recvmsg() style socket call, a local user could write arbitrary data into kernel memory. This can be leveraged to escalate privileges to root.socket

    Proof-of-Concept Exploit

    VSR has developed a proof-of-concept exploit [4] to both demonstrate the severity of this issue as well as allow users and administrators to verify the existence of the vulnerability. The exploit leverages the ability to write into kernel memory to reset the kernel's security operations structure and gain root privileges. The exploit requires that kernel symbol resolution is available to unprivileged users, via /proc/kallsyms or similar, as is the case on most stock distributions. It has been tested on both 32-bit and 64-bit x86 platforms. While this exploit has been reliable during testing, it is not advised to run kernel exploits on production systems, as there is a risk of causing system instability and crashing the affected machine.ide