Michael Coppola

CSAW CTF 2015 was this past weekend, and like previous years I fielded a Linux kernel exploitation challenge for finalists in NYC. This year, I wrote the challenge StringIPC. Three of the 15 teams solved the challenge. StringIPC is a kernel module providing a terrible IPC interface allowing processes to pass strings to one another. Clients interfac... e with the driver by allocating (or opening an existing IPC) channel. Each channel is associated with a channel ID and buffer in kernel-land. This buffer may be read or written to by clients and is used to pass messages between them. The size of this buffer is chosen by the user at allocation time, and clients may seek, grow, or shrink the buffer at any time. The design of this challenge is in a similar vein to my 2013 challenge Brad Oberberg . Each team was presented with unprivileged access to a Digital Ocean droplet running 64-bit Ubuntu 14.04.3 LTS. The vulnerable kernel module StringIPC.ko was loaded on each system, and successful exploitation would allow for local privilege escalation and subsequent reading of the flag. Clients may create a new channel with the CSAW_ALLOC_CHANNEL ioctl command. When creating a new channel, the size of the allocated buffer is user-controlled and may be of arbitrary size (other than zero): static long csaw_ioctl ( struct file *file, unsigned int cmd, unsigned long arg ) { long ret = 0; unsigned long *argp = (unsigned long *)arg; struct ipc_state *state = file-private_data; switch ( cmd ) { case CSAW_ALLOC_CHANNEL: { struct alloc_channel_args alloc_channel; struct ipc_channel *channel; if ( copy_from_user(&alloc_channel, argp, sizeof(alloc_channel)) ) return -EINVAL; mutex_lock(&state-lock); if ( state-channel ) { ret = -EBUSY; goto RET_UNLOCK; } ret = alloc_new_ipc_channel(alloc_channel.buf_size, &channel); if ( ret 0 ) goto RET_UNLOCK; ... int alloc_new_ipc_channel ( size_t buf_size, struct ipc_channel **out_channel ) { int id; char *data; struct ipc_channel *channel; if ( ! buf_size ) return -EINVAL; channel = ...Read More