Vulnerability Description

Ubuntu is an open-source GNU/Linux operating system primarily used on desktops, based on Debian GNU/Linux. Recently, a white-hat hacker disclosed a local privilege escalation vulnerability in the latest version of Ubuntu (Ubuntu 16.04), assigned CVE-2017-16995. This vulnerability exists in the Linux kernel system that calls eBPF bpf(2). When a user provides a malicious BPF program, the eBPF validator module produces a calculation error, leading to arbitrary memory read/write issues. Low-privileged users can exploit this vulnerability to gain administrative privileges. This vulnerability was fixed in older versions, but it can still be exploited in the latest version. The official patch has not yet been released, and the vulnerability is in a 0day state.

Affected Versions

Linux Kernel Version 4.14-4.4 Only affects Ubuntu/Debian distributions

Vulnerability Severity

High

Demonstration

bearcat@ubuntu:/opt$ lsb_release -a
<br>No LSB modules are available.
<br>Distributor ID: Ubuntu
<br>Description:    Ubuntu 16.04.4 LTS
<br>Release:        16.04
<br>Codename:       xenial
<br>bearcat@ubuntu:/opt$ uname -a
<br>Linux ubuntu 4.4.0-116-generic #140-Ubuntu SMP Mon Feb 12 21:23:04 UTC 2018 x86_64 x86_64 x86_64 GNU/Linux
<br>bearcat@ubuntu:/opt$ id
<br>uid=1000(bearcat) gid=1000(bearcat) <br>groups=1000(bearcat),4(adm),24(cdrom),27(sudo),30(dip),46(plugdev),110(lxd),115(lpadmin),116(sambashare)
<br>bearcat@ubuntu:/opt$ ls
<br>exploit.c
<br>bearcat@ubuntu:/opt$ gcc exploit.c -o exploit
<br>bearcat@ubuntu:/opt$ ./exploit
<br>task_struct = ffff88003a0db800
<br>uidptr = ffff8800374b76c4
<br>spawning root shell
<br>root@ubuntu:/opt# id
<br>uid=0(root) gid=0(root) groups=0(root),4(adm),24(cdrom),27(sudo),30(dip),46(plugdev),110(lxd),115(lpadmin),116(sambashare),1000(bearcat)
<br>root@ubuntu:/opt#

Vulnerability Fix

Method 1:

Currently, no clear patch upgrade plan has been proposed. However, it is recommended that users mitigate the issue by modifying kernel parameters to restrict normal users from using the bpf(2) system call: Set the parameter "kernel.unprivileged_bpf_disabled = 1" to prevent this privilege escalation by restricting access to the bpf(2) system call.
root@Ubuntu# echo 1 > /proc/sys/kernel/unprivileged_bpf_disabled

Method 2:

Upgrade the Linux kernel version, which requires rebooting the server to take effect: This step has already been described in detail during the environment setup process; users only need to modify the kernel version!

Method 3:

Code patch https://github.com/torvalds/linux/commit/95a762e2c8c942780948091f8f2a4f32fce1ac6f