{"id":562,"date":"2012-01-22T15:22:47","date_gmt":"2012-01-22T23:22:47","guid":{"rendered":"http:\/\/www.outflux.net\/blog\/?p=562"},"modified":"2012-01-24T11:34:14","modified_gmt":"2012-01-24T19:34:14","slug":"fixing-vulnerabilities-with-systemtap","status":"publish","type":"post","link":"https:\/\/outflux.net\/blog\/archives\/2012\/01\/22\/fixing-vulnerabilities-with-systemtap\/","title":{"rendered":"fixing vulnerabilities with systemtap"},"content":{"rendered":"<p>Recently the upstream Linux kernel released a <a href=\"http:\/\/git.kernel.org\/linus\/e268337dfe26dfc7efd422a804dbb27977a3cccc\">fix for a serious security vulnerability<\/a> (CVE-2012-0056) without <a href=\"http:\/\/oss-security.openwall.org\/wiki\/mailing-lists\/distros\">coordinating with Linux distributions<\/a>, leaving a window of vulnerability open for end users. Luckily:<\/p>\n<ul>\n<li>it is only a serious issue in 2.6.39 and later (e.g. Ubuntu 11.10 Oneiric)<\/li>\n<li>it is &#8220;only&#8221; local<\/li>\n<li>it requires execute access to a setuid program that generates output<\/li>\n<\/ul>\n<p>Still, it&#8217;s a cross-architecture local root escalation on most common installations. Don&#8217;t stop reading just because you don&#8217;t have a local user base &#8212; attackers can use this to elevate privileges from your user, or from the web server&#8217;s user, etc.<\/p>\n<p>Since there is now a <a href=\"http:\/\/blog.zx2c4.com\/749\">nearly-complete walk-through<\/a>, the urgency for fixing this is higher. While you&#8217;re waiting for your distribution&#8217;s kernel update, you can use <a href=\"http:\/\/sourceware.org\/systemtap\/\">systemtap<\/a> to change your kernel&#8217;s running behavior. <a href=\"https:\/\/access.redhat.com\/kb\/docs\/DOC-69129\">RedHat suggested this<\/a>, and here&#8217;s how to do it in Debian and Ubuntu:<\/p>\n<ul>\n<li>Download the &#8220;am I vulnerable?&#8221; tool, either from RedHat (above), or a <a href=\"http:\/\/grsecurity.net\/~spender\/correct_proc_mem_reproducer.c\">more correct version<\/a> from Brad Spengler.<\/li>\n<li>Check if you&#8217;re vulnerable:\n<pre class=\"brush:shell\">\r\n$ make correct_proc_mem_reproducer\r\n...\r\n$ .\/correct_proc_mem_reproducer\r\nvulnerable\r\n<\/pre>\n<\/li>\n<li>Install the kernel debugging symbols (this is big &#8212; over 2G installed on Ubuntu) and systemtap:\n<ul>\n<li>Debian:\n<pre class=\"brush:shell\">\r\n# apt-get install -y systemtap linux-image-$(uname -r)-dbg\r\n<\/pre>\n<\/li>\n<li>Ubuntu:\n<ul>\n<li>Add the <a href=\"https:\/\/lists.ubuntu.com\/archives\/ubuntu-users\/2010-October\/229714.html\">debug package repository<\/a> and key for your Ubuntu release:\n<pre class=\"brush:shell\">\r\n$ sudo apt-get install -y lsb-release\r\n$ echo \"deb http:\/\/ddebs.ubuntu.com\/ $(lsb_release -cs) main restricted universe multiverse\" | \\\r\n      sudo tee -a \/etc\/apt\/sources.list.d\/ddebs.list\r\n$ sudo apt-key adv --keyserver keyserver.ubuntu.com --recv-keys ECDCAD72428D7C01\r\n$ sudo apt-get update\r\n<\/pre>\n<\/li>\n<li>(This step does not work since the repository metadata isn&#8217;t updating correctly at the moment &#8212; see the next step for how to do this manually.) Install the debug symbols for the kernel and install systemtap:\n<pre class=\"brush:shell\">\r\nsudo apt-get install -y systemtap linux-image-$(uname -r)-dbgsym\r\n<\/pre>\n<\/li>\n<li>(Manual version of the above, skip if the above works for you. Note that this has no integrity checking, etc.)\n<pre class=\"brush:shell\">\r\n$ sudo apt-get install -y systemtap dpkg-dev\r\n$ wget http:\/\/ddebs.ubuntu.com\/pool\/main\/l\/linux\/$(dpkg -l linux-image-$(uname -r) | grep ^ii | awk '{print $2 \"-dbgsym_\" $3}' | tail -n1)_$(dpkg-architecture -qDEB_HOST_ARCH).ddeb\r\n$ sudo dpkg -i linux-image-$(uname -r)-dbgsym.ddeb\r\n<\/pre>\n<\/li>\n<\/ul>\n<\/li>\n<\/ul>\n<\/li>\n<li>Create a systemtap script to block the mem_write function, and install it:\n<pre class=\"brush:shell\">\r\n$ cat > proc-pid-mem.stp &lt;&lt;'EOM'\r\nprobe kernel.function(\"mem_write@fs\/proc\/base.c\").call {\r\n        $count = 0\r\n}\r\nEOM\r\n$ sudo stap -Fg proc-pid-mem.stp\r\n<\/pre>\n<\/li>\n<li>Check that you&#8217;re no longer vulnerable (until the next reboot):\n<pre class=\"brush:shell\">\r\n$ .\/correct_proc_mem_reproducer\r\nnot vulnerable\r\n<\/pre>\n<\/li>\n<\/ul>\n<p>In this case, the systemtap script is changing the <a href=\"http:\/\/lxr.linux.no\/linux+v3.0\/fs\/proc\/base.c#L887\">argument containing the size of the write<\/a> to zero bytes (<code>$count = 0<\/code>), which effectively closes this vulnerability.<\/p>\n<p><strong>UPDATE:<\/strong> here&#8217;s a systemtap script from Soren that doesn&#8217;t require the full debug symbols. <a href=\"http:\/\/outflux.net\/software\/shorts\/stp\/proc_pid_mem.stp\">Sneaky<\/a>, put can be rather slow since it hooks all writes in the system. :)<\/p>\n<p style='text-align:left'>&copy; 2012, <a href=\"https:\/\/outflux.net\/blog\/\">Kees Cook<\/a>. This work is licensed under a <a rel=\"license\" href=\"http:\/\/creativecommons.org\/licenses\/by-sa\/4.0\/\">Creative Commons Attribution-ShareAlike 4.0 License<\/a>.<br \/><a rel=\"license\" href=\"http:\/\/creativecommons.org\/licenses\/by-sa\/4.0\/\"><img decoding=\"async\" alt=\"CC BY-SA 4.0\" style=\"border-width:0\" src=\"https:\/\/i.creativecommons.org\/l\/by-sa\/4.0\/88x31.png\" \/><\/a> <\/p>\n","protected":false},"excerpt":{"rendered":"<p>Recently the upstream Linux kernel released a fix for a serious security vulnerability (CVE-2012-0056) without coordinating with Linux distributions, leaving a window of vulnerability open for end users. Luckily: it is only a serious issue in 2.6.39 and later (e.g. Ubuntu 11.10 Oneiric) it is &#8220;only&#8221; local it requires execute access to a setuid program [&hellip;]<\/p>\n","protected":false},"author":2,"featured_media":0,"comment_status":"open","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[5,18,6,14,19,12],"tags":[],"_links":{"self":[{"href":"https:\/\/outflux.net\/blog\/wp-json\/wp\/v2\/posts\/562"}],"collection":[{"href":"https:\/\/outflux.net\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/outflux.net\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/outflux.net\/blog\/wp-json\/wp\/v2\/users\/2"}],"replies":[{"embeddable":true,"href":"https:\/\/outflux.net\/blog\/wp-json\/wp\/v2\/comments?post=562"}],"version-history":[{"count":14,"href":"https:\/\/outflux.net\/blog\/wp-json\/wp\/v2\/posts\/562\/revisions"}],"predecessor-version":[{"id":576,"href":"https:\/\/outflux.net\/blog\/wp-json\/wp\/v2\/posts\/562\/revisions\/576"}],"wp:attachment":[{"href":"https:\/\/outflux.net\/blog\/wp-json\/wp\/v2\/media?parent=562"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/outflux.net\/blog\/wp-json\/wp\/v2\/categories?post=562"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/outflux.net\/blog\/wp-json\/wp\/v2\/tags?post=562"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}