Information about the sixth vulnerability (1, 2-3, 4, 5) has been revealed, allowing an unprivileged local user to gain root rights by overwriting data in the page cache. The vulnerability is codenamed PinTheft. A prototype exploit is available. A CVE identifier has not yet been assigned. A fix is currently available only as a patch, which was published on May 5 and accepted into the netdev branch on May 11, but not included in the corrective kernel releases.
The vulnerability is present in the implementation of the RDS (Reliable Datagram Sockets) network protocol, designed for high-speed message exchange between nodes in a cluster, with minimal latency and guaranteed delivery. An attack is possible on systems with the io_uring subsystem enabled (io_uring_disabled=0) and a kernel built with the CONFIG_RDS, CONFIG_RDS_TCP, and CONFIG_IO_URING options. For the exploit to work, there must be a readable executable file with the SUID-root flag in the system.
To automatically load the rds_tcp kernel module, the exploit requests the sending of data via RDS using the transport SO_RDS_TRANSPORT=2. It is noted that among the tested Linux distributions, the rds kernel module is provided only in Arch Linux with the default configuration. To block the vulnerability, one can disable the automatic loading of the rds and rds_tcp kernel modules: rmmod rds_tcp rds printf 'install rds /bin/false\ninstall rds_tcp /bin/false\n' > /etc/modprobe.d/pintheft.conf
The vulnerability is caused by an error in the implementation of the zerocopy mechanism in the function rds_message_zcopy_from_user(), which performs direct data modification in the page cache to avoid unnecessary buffering. In the case of failure, the field rm->data.op_nents was not cleared, leading to a double free of the buffer. The occurrence of an incorrect value in the reference counter could be exploited to overwrite data in the page cache by manipulating the pointer to the fixed io_uring buffer.
Ansonsten ist die Funktionsweise typischerweise für alle Schwachstellen dieser Art – der Angreifer sorgt dafür, dass eine Programmdatei mit dem SUID-Flag root im Seitencache landet, nachdem er dann den Code zum Starten von /usr/bin/sh in den ELF-Header einfügt. Nach dieser Manipulation führt der Start des Programms nicht zur Lade des originalen ausführbaren Files vom Medium, sondern zur veränderten Kopie aus dem Seitencache. Im Gegensatz zu früheren Exploits ist die neue Variante ausschließlich für Angriffe auf das Dienstprogramm „su“ angepasst, kann jedoch auch bei Vorhandensein solcher SUID-Programme wie mount, passwd, chsh, newgrp, umount und pkexec angewendet werden.
Quelle: opennet.ru
