Information has been revealed about the sixth vulnerability (1, 2-3, 4, 5), which allows an unprivileged local user to gain root rights by rewriting data in the page cache. The vulnerability is codenamed PinTheft. A prototype exploit is available. A CVE identifier has not yet been assigned. A fix is currently available only as a patch, which was published on May 5 and accepted into the netdev branch on May 11 but has not been included in corrective kernel releases.
The vulnerability exists in the implementation of the RDS (Reliable Datagram Sockets) network protocol, designed for high-speed message exchange between nodes in a cluster, with minimal latency and guaranteed delivery. An attack is possible on systems with the io_uring subsystem enabled (io_uring_disabled=0) and a kernel built with the CONFIG_RDS, CONFIG_RDS_TCP, and CONFIG_IO_URING options. To function, the exploit requires an executable file that is readable and has the SUID-root flag.
To automatically load the rds_tcp kernel module, the exploit requests the transmission of data through RDS using the transport SO_RDS_TRANSPORT=2. It is noted that among the tested Linux distributions, the rds kernel module is provided only in Arch Linux by default. To block the vulnerability workaround, it is recommended to prevent the automatic loading of the rds and rds_tcp kernel modules: rmmod rds_tcp rds printf 'install rds /bin/false\ninstall rds_tcp /bin/false\n' > /etc/modprobe.d/pintheft.conf
The vulnerability is caused by an error in the implementation of the zerocopy mechanism in the function rds_message_zcopy_from_user(), which performs direct modification of data in the page cache to avoid unnecessary buffering. In the event of a failure, the field rm->data.op_nents was not cleared, leading to a double-free buffer situation. The appearance of an incorrect value in the reference counter could be exploited to overwrite data in the page cache by manipulating the pointer to a fixed io_uring buffer.
I övrigt är utnyttjandet av mekanismen typiskt för alla sårbarheter av denna typ — attackern åstadkommer att en programfil med suid root-flaggorna hamnar i sidcacheminnet, varefter denne infogar kod för att köra /usr/bin/sh i ELF-huvudet. Efter denna manipulation leder körningen av programmet till att en modifierad kopia från sidcacheminnet laddas in i minnet istället för den ursprungliga körbara filen från lagringsmediet. Till skillnad från tidigare exploateringar är den nya versionen anpassad för att endast attackera verktyget "su", men den kan även tillämpas om det finns sådana suid-program i systemet som mount, passwd, chsh, newgrp, umount och pkexec.
Källa: opennet.ru
