DASICS CVE-2021-3156

Version Requirements

sudo: 1.8.31

glibc: 2.31

Linux: 4.18 or 5.10.167-gee203559bc0b-dirty

Usage

For convenience, when compiling Linux, do not use the initramfs method. Instead, use the rootfs.img provided in this repository as the root filesystem to boot. It contains the necessary configuration files to support sudo and nss services, making it a very simple distribution.

Use the qemu provided by DASICS_QEMU to boot bbl with rootfs.img as the root filesystem. Alternatively, you can use OpenSBI to boot linux. Example command:

#!/bin/sh
qemu-system-riscv64 -M virt -m 1G \
        -cpu rv64 \
        -nographic \
        -kernel bbl \
        -drive file=rootfs.img,format=raw,id=hd0 \
        -device virtio-blk-device,drive=hd0 \
        -append "console=ttyS0 rw root=/dev/vda" \
        -bios none  -s

After entering the busybox command line interface, execute the following commands:

$ su wanghan
$ cd
$ whoami
$ ./expolit
$ whoami

Since the system boots directly into the command line interface with root privileges, you can easily change the password using passwd.

Demo

As shown, expolit achieves privilege escalation and can be reliably reproduced.