Information has been revealed about the sixth vulnerability (1, 2-3, 4, 5) that allows an unprivileged local user to gain root privileges by overwriting data in the page cache. This vulnerability has been code-named PinTheft. A prototype exploit is available. The CVE identifier has not yet been assigned. A fix is currently available only as a patch, which was published on May 5 and accepted into the netdev branch on May 11, but has not been included in kernel patch releases.
The vulnerability exists in the implementation of the RDS (Reliable Datagram Sockets) network protocol, intended for high-speed message exchange between nodes in a cluster, with minimal delay and guaranteed delivery. An attack is possible on systems with the io_uring subsystem enabled (io_uring_disabled=0) and a kernel compiled with the CONFIG_RDS, CONFIG_RDS_TCP, and CONFIG_IO_URING options. For the exploit to work, a readable executable file with the SUID-root flag must be available in the system.
To automatically load the rds_tcp kernel module, the exploit requests data transmission over RDS using the transport SO_RDS_TRANSPORT=2. It is noted that among the tested Linux distributions, the rds kernel module is only provided in Arch Linux by default. To block the vulnerability in a workaround, you can prevent the automatic loading of the rds and rds_tcp kernel modules: rmmod rds_tcp rds printf 'install rds /bin/false\ninstall rds_tcp /bin/false\n' > /etc/modprobe.d/pintheft.conf
The vulnerability is caused by an error in the implementation of the zerocopy mechanism in the function rds_message_zcopy_from_user(), which performs direct modification of data in the page cache to eliminate unnecessary buffering. In the case of failure, the field rm->data.op_nents was not cleared, resulting in double freeing of the buffer. The occurrence of an incorrect value in the reference counter could be exploited to overwrite data in the page cache by manipulating the pointer to a fixed io_uring buffer.
In other respects, the exploitation mechanism is typical for all vulnerabilities of this class — the attacker manages to get a program file with the suid root flag settled in the page cache, after which they insert code to launch /usr/bin/sh into the ELF header. After this manipulation, launching the program loads into memory not the original executable file from the storage, but a modified copy from the page cache. Unlike previous exploits, the new variant is adapted specifically for attacking the 'su' utility, but it can also be used when there are such suid programs in the system as mount, passwd, chsh, newgrp, umount, and pkexec.
Source: opennet.ru
