PTRACE_TRACEME CVE-2019-13272 本地提权漏洞解析

    1514         kgid_t gid;
    1515
    1516         /*
    1517          * Since this can be called multiple times (via prepare_binprm),
    1518          * we must clear any previous work done when setting set[ug]id
    1519          * bits from any earlier bprm->file uses (for example when run
    1520          * first for a setuid script then again for its interpreter).
    1521          */
    1522         bprm->cred->euid = current_euid(); //
    1523         bprm->cred->egid = current_egid();
    1524
    1525         if (!mnt_may_suid(bprm->file->f_path.mnt))
    1526                 return;
    1527
    1528         if (task_no_new_privs(current))
    1529                 return;
    1530
    1531         inode = bprm->file->f_path.dentry->d_inode;
    1532         mode = READ_ONCE(inode->i_mode);
    1533         if (!(mode & (S_ISUID|S_ISGID))) //
    1534                 return;
    1535
    1536         /* Be careful if suid/sgid is set */
    1537         inode_lock(inode);
    1538
    1539         /* reload atomically mode/uid/gid now that lock held */
    1540         mode = inode->i_mode;
    1541         uid = inode->i_uid; //
    1542         gid = inode->i_gid;
    1543         inode_unlock(inode);
    1544
    1545         /* We ignore suid/sgid if there are no mappings for them in the ns */
    1546         if (!kuid_has_mapping(bprm->cred->user_ns, uid) ||
    1547                  !kgid_has_mapping(bprm->cred->user_ns, gid))
    1548                 return;
    1549
    1550         if (mode & S_ISUID) {
    1551                 bprm->per_clear |= PER_CLEAR_ON_SETID;
    1552                 bprm->cred->euid = uid; //
    1553         }
    1554
    1555         if ((mode & (S_ISGID | S_IXGRP)) == (S_ISGID | S_IXGRP)) {
    1556                 bprm->per_clear |= PER_CLEAR_ON_SETID;
    1557                 bprm->cred->egid = gid;
    1558         }
    1559 }
如上， 主要看两行
1522 行, 将当前的 euid 赋值新的 euid, 所以大部分执行了 execve 的进程的权限跟原来的一样
1552 行，如果带有 suid bit, 则将可执行文件的所有者的 uid 赋值新的 euid, 这就是所谓 setuid 的实现， 新的 euid 变成了它执行的可执行文件所有者的 uid， 如果所有者是特权用户， 这里就实现了提权

上一页  [1] [2] [3] [4] [5] [6] [7] [8] [9] [10] [11]  下一页

 3/12   首页 上一页 1 2 3 4 5 6 下一页 尾页