theo543/osds_paper_cve-2016-5195
This repository contains my paper and presentation slides on CVE-2016-5195, a Linux privilege escalation vulnerability, written for the Operating Systems: Design And Security course at FMI, University of Bucharest.
In my paper I claimed that you can use Dirty COW to silently backdoor binaries without immediately escalating to root to make it harder to detect.
This is not actually true because when trying to writeback the modified page the kernel notices that the page is dirty (which it should never be) and panics, crashing the system.
To prevent that you have to immediately escalate to root and disable automatic writeback by "echo 0 > /proc/sys/vm/dirty_writeback_centisecs". My proof of concept doesn't do that, so it quickly crashes when testing in a VM, after successfully modifying /etc/passwd (which doesn't get persisted to disk).
https://www.exploit-db.com/exploits/40847 is an example of exploit code which overwrites /etc/passwd and then disables writeback to prevent crashing.
Other methods include patching vDSO (https://github.com/scumjr/dirtycow-vdso) instead of a file-backed page, which affects all processes on the system and doesn't crash, and has other advantages like also escaping containers and is not affected by SELinux restrictions which could prevent even opening /etc/passwd read-only for the attack.
While you indeed can backdoor the system after escalating to root (same as for any other privilege escalation method), that would involve ordinary filesystem operations and could be detected by intrusion detection systems, whereas if writeback had worked as I originally thought, it might bypass monitoring of write operations, since the kernel would just writeback the page with no write system call involved, but it actually just panics instead.
