- Android Use-after-free Di Shen a.k.a. Retme Keen Lab of Tencent

Size: px

Start display at page:

Download "- Android Use-after-free Di Shen a.k.a. Retme Keen Lab of Tencent"

いおりすすむ
5 years ago
Views:

1 - Android Use-after-free Di Shen a.k.a. Retme Keen Lab of Tencent

2 Di Shen a.k.a. Retme Keen Lab 2014 Android Android root : CVE & CVE (kernel/events/core.c) CVE (fs/pipe.c) CVE ,4422 (Huawei TrustZone) Galaxy S7 KNOX (Black Hat USA 2017) (Black Hat EU 2016)

3 Android root Use-After-Free root Use-After-Free perf CVE CVE

4 Android root Linux Binder, ION, Ashmem Android

5 Android root SELinux ioctl

6 Android root dm-verity

7 Android root Privileged Access Never (PAN) KASLR

8 Use-After-Free Use-After-Free 解放解放

9 Use-After-Free struct socket (freed) ops->ioctl( ) struct socket (refilled) ops->ioctl( ) The image cannot be displayed. Your computer may not have enough memory to open the image, or the image may have been corrupted. Restart your computer, and then open the file again. If the red x still appears, you may have to delete the image and then insert it again. JOP ガジェット解放 ret2dir ROP/JOP ioctl(sockfd, ) kernel_sock_ioctl() JOP ガジェット

10 任意のカーネルコード実プロセスの addr_limit を上書き任意のカーネルメモリの上書き Uid, security id, selinux_enforcing を上書き

11 Use-After-Free Use-After-Free

12 Use-After-Free sys_perf_event_open() Perf perf_event_paranoid

13 Use-After-Free CVE Ever affected all devices shipped with 3.10 or earlier Linux kernel 3.10 Linux KingRoot 1400 root CVE Qualcomm (Qucalcomm enabled perf Qualcomm ) KNOX 2.6

14 sys_perf_event_open() perf_event perf_event_attr group_fd (optional) perf_event perf_event fd

15 perf perf_event perf_event_context 1 perf 2 Perf 1 task_struct perf_sw_context perf_hw_context event_list event (group_leader) event (group_leader) event event event

16 move_group

17 CVE group_leader move_group refcont 1

CVE-2016-6787 move_group Use-After-Free move_group

18 CVE move_group Use-After-Free move_group group_leader-> ctx ref 0 ttask_struct-> perf_event_ctxp [perf_sw_context] 解放

19 解放 perf_event_context (PoC) メインスレッドサブスレッド -1 サブスレッド -2 ソフトウェア group_leader を作成ハードウェア perf_event を作成ハードウェア perf_event を作成 ctx->refcount = 1 ctx->refcount = 2 move_group, put_ctx() move_group, put_ctx() ctx->refcount = 0 kfree_rcu(perf_event_context)

20 直ち perf_event_context 解放直後 L

21 解決策 : 解放後 ( ) The thread will be frozen and kernel won t crash as soon as perf_event_context freed perf_event_contextが解放

22 空間 Sleep()? Use futex_wait_queue_me() 割り込み可能に切り替える freezable_schedule()

$不正な形式の perf_event_context {}$

23 メインスレッドサブスレッド -1 サブスレッド -2 ソフトウェア group_leader を作成フェーズ 1 futex_wake() を使ってメインスレッドを起動フェーズ 3 ハードウェア perf_event を作成 move_group, put_ctx() ハードウェア perf_event を作成 move_group, put_ctx() schedule() finish_task_switch() kfree_rcu(perf_event_context) perf_event_context_sched_in() futext_wait_queue_me() ctx->pmu->pmu_disable() ret2dir トリックを使してヒープをスプレーし不正な形式の perf_event_context {} を 1024 バイトごとに書き込みフェーズ 2 フェーズ 4

24 CVE ( ) ( )

25 perf sibling_list sibling_list perf event (group_leader) task_struct perf_sw_context perf_hw_context event_list event (group_leader) event event event

26 CVE (PoC) perf 'A' perf 'B' 'A' A 解放 sibling B 解放 ß---- Use-after-free

27 A 解放された sibling list sibling s event->group_entry

28 sibling B 解放 list_del_event() list_del_init(&event->group_entry);

29 SLUB 0xfffffc00fc2b1a0 (group_leader+ 0x20)

30 解放 *(size_t*)(freed_object + 0x20) = (freed_object + 0x20)

31 Linux readv() writev() : struct iovec{iov_base,iov_len} readv() struct iovec {}

32 readv() rw_copy_check_uvector() iov_base struct iovec{} readv().. iov_base iov_len iov_base iov_len iov_base iov_len iovec{} iov_base kernel_addr iov_len kernel_addr iov_len kernel_addr iov_len

33 pipe_iov_copy_to_user() iov_base

34 解決策 : Use-After-Free 1 2 解放, A 2 解放, B = A + 0x400 Freed Data Freed Data Freed Freed Data Freed Data iovec base len base len base base len base len 3 Use-After-Free A+0x20 8 A+0x20 base len A + 0x20 A+0x20 base base len base len 4 (A + 0x20) base len KADDR 8 KADDR KADDR 8 KADDR 8 5 KADDR KADDR

35 CVE

36 Use-After-Free, ( CVE )

fx-9860G Manager PLUS_J

fx-9860G Manager PLUS_J fx-9860g J fx-9860g Manager PLUS http://edu.casio.jp k 1 k III 2 3 1. 2. 4 3. 4. 5 1. 2. 3. 4. 5. 1. 6 7 k 8 k 9 k 10 k 11 k k k 12 k k k 1 2 3 4 5 6 1 2 3 4 5 6 13 k 1 2 3 1 2 3 1 2 3 1 2 3 14 k a j.+-(),m1