Main ideas:

• Use simple range analysis on argc.
• Limit rhs / lhs of expressions to those involving argc.

Versions to check:

• All Polkit versions from 2009 onwards are vulnerable; first version in May 2009 (commit c8c3d83, “Add a pkexec(1) command”).

• we can get /a/ database [[https://lgtm.com/projects/g/freedesktop/polkit/ci/#ql][from lgtm]], the current one <2022-02-11 Fri> is =...srcVersion_a6bedfd...= but this one is already past the polkit patch: #+BEGIN_SRC text commit a6bedfd09b7bba753de7a107dc471da0db801858 (origin/master, origin/HEAD, master) Author: Xi Ruoyao [email protected] Date: Thu Jan 27 10:16:32 2022 +0000

  root@kitploit:~

    jsauthority: port to mozjs-91
  

  commit a2bf5c9c83b6ae46cbd5c779d3055bff81ded683 Author: Jan Rybar [email protected] Date: Tue Jan 25 17:21:46 2022 +0000

  root@kitploit:~

    pkexec: local privilege escalation (CVE-2021-4034)
  

  #+END_SRC And we can see that the problem is fixed: #+BEGIN_SRC text commit a2bf5c9c83b6ae46cbd5c779d3055bff81ded683 Author: Jan Rybar [email protected] Date: Tue Jan 25 17:21:46 2022 +0000

  root@kitploit:~

    pkexec: local privilege escalation (CVE-2021-4034)
  

  diff --git a/src/programs/pkcheck.c b/src/programs/pkcheck.c index f1bb4e1..768525c 100644 --- a/src/programs/pkcheck.c +++ b/src/programs/pkcheck.c @@ -363,6 +363,11 @@ main (int argc, char *argv[]) local_agent_handle = NULL; ret = 126;

  • if (argc < 1)
  • {
  • root@kitploit:~

     exit(126);
    

  • }
  • /* Disable remote file access from GIO. */ setenv ("GIO_USE_VFS", "local", 1); #+END_SRC

• So we need the [[https://gitlab.freedesktop.org/polkit/polkit.git][source code]] and build our own databases, one pre-patch, one post.

The next section goes through the build steps, using a Docker container.

** Build polkit and CodeQL DB We need the build setup for polkit before we can get a codeql database.

Operating system options for building:

• macOS is worth a try, but this becomes tricky early on. Using =brew= to get dependencies works to a point, but the =mozjs-78= dependency is a specific version of spidermonkey and building /that/ is not practical. #+BEGIN_SRC sh # autoconf... a little tricky on a mac brew install autoconf automake libtool gtk-doc export PATH="/usr/local/opt/libtool/libexec/gnubin:$PATH" ./autogen.sh

  root@kitploit:~

  # Use meson?
  brew install meson ninja intltool glib gobject-introspection 
  

  #+END_SRC

• Linux is the native environment for polkit, but which one? The mozjs-78 dependency is a specific version of spidermonkey; also, polkit it not used by all distributions:

  • Debian uses PolicyKit, not polkit.
  • Ubuntu:
    • 18.04 is also missing mozjs78 (only mozjs52)
    • 22.04 has mozjs78

Ubuntu 22.04 can be run in a number of ways, on hardware, a VM (vmware, virtualbox, multipass, etc.), or a docker container on another host. For this problem, we can use a Docker container and include the codeql command-line tools as well.

The definition of the container is in the ./Dockerfiles, here is the build sequence: #+BEGIN_SRC shell # Base image for setting up the qlbuild container docker pull ubuntu:jammy docker images docker run --cpus 4 -m 8GB -ti ubuntu:jammy

#+END_SRC Note: when using docker desktop on windows and mac, memory and cpu limits must be raised there. Once set, the container running sequence is simply #+BEGIN_SRC sh # Run as daemon so it stays around even when disconnecting. docker run -d -p 127.0.0.1:2020:22 --cpus 8 -m 16GB qlbuild

#+END_SRC

Building on Ubuntu 22.04 #+BEGIN_SRC sh # --------------------------------- # System setup/install, as root: echo "deb-src http://archive.ubuntu.com/ubuntu/ jammy main restricted" >> /etc/apt/sources.list apt-get update apt-get install -y zile build-essential git cmake
meson ninja-build
libmozjs-78-0 libmozjs-78-dev
libdbus-1-3 libdbus-1-dev apt-get build-dep -y policykit-1 apt install unzip

#+END_SRC

Copy the db to a permanent place on the host #+BEGIN_SRC sh # Copy from the container mkdir -p ~/local/polkit && cd ~/local/polkit scp -rq -P 2020 test@localhost:/tmp/polkit/polkit-0.119.db . scp -rq -P 2020 test@localhost:/tmp/polkit/polkit-a2bf5c9c.db .

#+END_SRC

TODO

Push container for reuse, see [[https://docs.github.com/en/packages/working-with-a-github-packages-registry/working-with-the-container-registry#pushing-container-images][documentation]]

#+BEGIN_SRC sh

docker login ghcr.io -u USERNAME

docker push ghcr.io/OWNER/IMAGE_NAME:latest

docker pull ghcr.io/OWNER/IMAGE_NAME

#+END_SRC

Next up, setting up for query development.

** Query development setup Queries can be explored via codeql cli by itself, or using the codeql cli + the VS Code plugin. For both cases, install the cli (see the =grab()= function above), and extract the databases from [[./db]] or build them as done in in [[*Build polkit and codeql db][Build polkit and codeql db]]

In the following, we assume this directory structure for the databases: #+BEGIN_SRC text . ├── polkit-0.119.db │   ├── codeql-database.yml │   ├── db-cpp │   ├── log │   └── src.zip ├── polkit-0.119.zip ├── polkit-a2bf5c9c.db │   ├── codeql-database.yml │   ├── db-cpp │   ├── log │   └── src.zip └── polkit-a2bf5c9c.zip #+END_SRC

** The query The query is developed incrementally in [[./argv-out-of-bounds-*.ql]].

The first steps in [[./argv-out-of-bounds-0.ql]] use the AST and variable references to narrow results to the known parts of the problem, as in the following.

#+BEGIN_SRC text declaration | 435 main (int argc, char *argv[]) | 436 { | ... init other var; | 534 for (n = 1; compare to argc | n < (guint) argc; update other var | n++) | 535 { | ... | 568 } | ... indexed read | 610 path = g_strdup (argv[n]); | ... | 629 if (path[0] != '/') | 630 { | ... | 632 s = g_find_program_in_path (path); | ... indexed write | 639 argv[n] = path = s; | 640 } #+END_SRC

Exploration of values starts in [[./argv-out-of-bounds-1.ql]] with an attempt at using the =SimpleRangeAnalysis= library via #+begin_src javascript lowerBound(cmp.getLeftOperand().getFullyConverted()), "left lower bound", lowerBound(cmp.getRightOperand().getFullyConverted()), "right lower bound" #+end_src The bounds are correct bounds for the types, but too general -- they include the possible results of iteration. We are only interested in initial bounds that are statically determinate, those before any iteration happens.

Put another way, this is not a general data flow problem; we only want to check initial value propagation along certain execution paths. The =for= loop complicates this, as do the operations within it.

We really want to see execution paths that bypass the loop altogether. That is done in the latter parts of [[./argv-out-of-bounds-1.ql]], using a =SsaDefinition=.

The query [[./argv-out-of-bounds-2.ql]] cleans up the exploration from [[./argv-out-of-bounds-1.ql]] and correctly identifies all the locations using =n= with a known index value =n > 0=.

This query reports results on the vulnerable version of the code, =polkit-0.119.db=. Next, it needs to be checked and enhanced so it reports nothing on the patched version, =polkit-a2bf5c9c.db=.

TODO

** Running the query from the command line

#+BEGIN_SRC sh

# Run a query against the database, saving the results to the results/

# subdirectory of the database directory for further processing.

codeql database run-queries -j8 --ram=20000 -- $DB $SRCDIR/example.ql

# Get general info about available results

codeql bqrs info --format=text -- $DB/results/cpp-sample/example.bqrs

# Format results using bqrs decode.

codeql bqrs decode --output=cpp-simple.csv \

--format=csv --entities=all -- \

$DB/results/cpp-sample/example.bqrs

#+END_SRC