PTRACE_TRACEME CVE-2019-13272 本地提权漏洞解析

    1118                 ret = ptrace_traceme(); //
    1119                 if (!ret)
    1120                         arch_ptrace_attach(current);
    1121                 goto out;
    1122         }
    1123
    1124         child = find_get_task_by_vpid(pid);
    1125         if (!child) {
    1126                 ret = -ESRCH;
    1127                 goto out;
    1128         }
    1129
    1130         if (request == PTRACE_ATTACH || request == PTRACE_SEIZE) {
    1131                 ret = ptrace_attach(child, request, addr, data); //
    1132                 /*
    1133                  * Some architectures need to do book-keeping after
    1134                  * a ptrace attach.
    1135                  */
    1136                 if (!ret)
    1137                         arch_ptrace_attach(child);
    1138                 goto out_put_task_struct;
    1139         }
    1140
    1141         ret = ptrace_check_attach(child, request == PTRACE_KILL ||
    1142                                   request == PTRACE_INTERRUPT);
    1143         if (ret 0)
    1144                 goto out_put_task_struct;
    1145
    1146         ret = arch_ptrace(child, request, addr, data); //
    1147         if (ret || request != PTRACE_DETACH)
    1148                 ptrace_unfreeze_traced(child);
    1149
    1150  out_put_task_struct:
    1151         put_task_struct(child);
    1152  out:
    1153         return ret;
    1154 }
如上， 由于 task B 和 task C 此时已经存在 trace link， 所以通过 B 向 C 可以直接发送 ptrace request， 将进入函数 arch_ptrace
arch/x86/kernel/ptrace.c
arch_ptrace
    -> ptrace_request
        -> generic_ptrace_peekdata
           generic_ptrace_pokedata
            -> ptrace_access_vm
                -> ptracer_capable
 kernel/ptrace.c
 884 int ptrace_request(struct task_struct *child, long request,
 885                    unsigned long addr, unsigned long data)

上一页  [1] [2] [3] [4] [5] [6] [7] [8] [9] [10] [11]  下一页

 6/12   首页 上一页 4 5 6 7 8 9 下一页 尾页