Linux管道竞争漏洞分析与利用<\/h1>

管道(Pipe)基础<\/h2>

管道概述<\/h3>
管道是Linux系统中一种单向的进程间通信(IPC)机制，具有读端和写端。数据从写端写入，可以从读端读出。<\/p>

管道类型<\/h3>

无名管道(Anonymous Pipes)<\/h4>

创建：使用pipe(2)<\/code>系统调用<\/li>

特点：

返回两个文件描述符：pipefd[0]<\/code>(读端)和pipefd[1]<\/code>(写端)<\/li>
通常用于父子进程间通信<\/li>
<\/ul>
<\/li>
<\/ul>
示例代码：<\/p>
#include<\/span> <unistd.h><\/span>
<\/span><\/span><\/span>#include<\/span> <stdio.h><\/span>
<\/span><\/span><\/span><\/span>
<\/span><\/span>int<\/span> main<\/span>() {
<\/span><\/span>    int<\/span> pipefd[2<\/span>];
<\/span><\/span>    char<\/span> buf[100<\/span>] =<\/span> "Hello, pipe!"<\/span>;
<\/span><\/span>    
<\/span><\/span>    if<\/span>(pipe(pipefd) ==<\/span> -<\/span>1<\/span>) {
<\/span><\/span>        perror("pipe"<\/span>);
<\/span><\/span>        return<\/span> 1<\/span>;
<\/span><\/span>    }
<\/span><\/span>    
<\/span><\/span>    \/\/ 写入数据
<\/span><\/span><\/span><\/span>    write(pipefd[1<\/span>], buf, sizeof<\/span>(buf));
<\/span><\/span>    
<\/span><\/span>    \/\/ 读取数据
<\/span><\/span><\/span><\/span>    char<\/span> read_buf[100<\/span>];
<\/span><\/span>    ssize_t n =<\/span> read(pipefd[0<\/span>], read_buf, sizeof<\/span>(read_buf));
<\/span><\/span>    if<\/span>(n ==<\/span> -<\/span>1<\/span>) {
<\/span><\/span>        perror("read"<\/span>);
<\/span><\/span>        return<\/span> 1<\/span>;
<\/span><\/span>    }
<\/span><\/span>    read_buf[n] =<\/span> '\0'<\/span>;
<\/span><\/span>    printf("Read: %s<\/span>\n<\/span>"<\/span>, read_buf);
<\/span><\/span>    
<\/span><\/span>    \/\/ 关闭文件描述符
<\/span><\/span><\/span><\/span>    close(pipefd[0<\/span>]);
<\/span><\/span>    close(pipefd[1<\/span>]);
<\/span><\/span>    return<\/span> 0<\/span>;
<\/span><\/span>}
<\/span><\/span><\/code><\/pre>命名管道(FIFOs)<\/h4>

创建：使用mkfifo(3)<\/code>函数<\/li>
特点：

具有文件系统中的名称<\/li>
任何进程都可以打开FIFO（权限允许时）<\/li>
<\/ul>
<\/li>
<\/ul>
示例代码：<\/p>
#include<\/span> <sys\/types.h><\/span>
<\/span><\/span><\/span>#include<\/span> <sys\/stat.h><\/span>
<\/span><\/span><\/span>#include<\/span> <fcntl.h><\/span>
<\/span><\/span><\/span>#include<\/span> <unistd.h><\/span>
<\/span><\/span><\/span>#include<\/span> <stdio.h><\/span>
<\/span><\/span><\/span><\/span>
<\/span><\/span>int<\/span> main<\/span>() {
<\/span><\/span>    const<\/span> char<\/span> *<\/span>fifo_path =<\/span> "\/tmp\/myfifo"<\/span>;
<\/span><\/span>    
<\/span><\/span>    \/\/ 创建FIFO
<\/span><\/span><\/span><\/span>    if<\/span>(mkfifo(fifo_path, 0666<\/span>) ==<\/span> -<\/span>1<\/span>) {
<\/span><\/span>        perror("mkfifo"<\/span>);
<\/span><\/span>        return<\/span> 1<\/span>;
<\/span><\/span>    }
<\/span><\/span>    
<\/span><\/span>    \/\/ 打开FIFO用于写入
<\/span><\/span><\/span><\/span>    int<\/span> fd =<\/span> open(fifo_path, O_WRONLY);
<\/span><\/span>    if<\/span>(fd ==<\/span> -<\/span>1<\/span>) {
<\/span><\/span>        perror("open"<\/span>);
<\/span><\/span>        return<\/span> 1<\/span>;
<\/span><\/span>    }
<\/span><\/span>    
<\/span><\/span>    \/\/ 写入数据
<\/span><\/span><\/span><\/span>    const<\/span> char<\/span> *<\/span>msg =<\/span> "Hello, FIFO!"<\/span>;
<\/span><\/span>    write(fd, msg, strlen(msg));
<\/span><\/span>    
<\/span><\/span>    \/\/ 关闭文件描述符
<\/span><\/span><\/span><\/span>    close(fd);
<\/span><\/span>    
<\/span><\/span>    \/\/ 删除FIFO
<\/span><\/span><\/span><\/span>    unlink(fifo_path);
<\/span><\/span>    return<\/span> 0<\/span>;
<\/span><\/span>}
<\/span><\/span><\/code><\/pre>I\/O操作特性<\/h3>


读写操作<\/strong>：<\/p>

读操作：

空管道：read(2)<\/code>会阻塞，直到有数据可读<\/li>
所有写端关闭：read(2)<\/code>返回0（EOF）<\/li>
<\/ul>
<\/li>
写操作：

管道已满：write(2)<\/code>会阻塞，直到有空间<\/li>
所有读端关闭：生成SIGPIPE<\/code>信号，返回-1（EPIPE<\/code>）<\/li>
<\/ul>
<\/li>
<\/ul>
<\/li>

非阻塞I\/O<\/strong>：<\/p>

通过fcntl(2)<\/code>的F_SETFL<\/code>操作启用O_NONBLOCK<\/code>标志<\/li>
<\/ul>
<\/li>

原子性<\/strong>：<\/p>

写入≤PIPE_BUF<\/code>字节的数据是原子的<\/li>
写入>PIPE_BUF<\/code>字节的数据可能是非原子的<\/li>
Linux中PIPE_BUF<\/code>通常为4096字节<\/li>
<\/ul>
<\/li>
<\/ol>
相关系统调用<\/h3>



类别<\/th>
系统调用<\/th>
<\/tr>
<\/thead>


创建和管理<\/td>
pipe(2)<\/code>, mkfifo(3)<\/code>, open(2)<\/code>, fcntl(2)<\/code>, dup(2)<\/code>, close(2)<\/code><\/td>
<\/tr>

I\/O操作<\/td>
read(2)<\/code>, write(2)<\/code>, poll(2)<\/code>, select(2)<\/code>, splice(2)<\/code>, tee(2)<\/code>, vmsplice(2)<\/code><\/td>
<\/tr>

其他<\/td>
stat(2)<\/code>, unlink(2)<\/code>, epoll(7)<\/code><\/td>
<\/tr>
<\/tbody>
<\/table>
管道竞争漏洞分析<\/h2>
竞争条件原理<\/h3>


初始状态<\/strong>：<\/p>

多个进程同时尝试写入管道<\/li>
由于互斥锁，只有一个进程能获得锁并开始写入<\/li>
<\/ul>
<\/li>

管道满时<\/strong>：<\/p>

第一个进程写满管道后释放锁<\/li>
其他进程获得锁，但也会因为管道满而阻塞<\/li>
第一个进程唤醒读进程<\/li>
<\/ul>
<\/li>

读进程唤醒<\/strong>：<\/p>

读进程尝试获取锁，但被放入互斥等待队列<\/li>
读进程位于写进程之后<\/li>
<\/ul>
<\/li>

竞争点<\/strong>：<\/p>

当管道有空间可写时，从wait_event_interruptible_exclusive<\/code>退出的进程会尝试获取锁<\/li>
哪个进程先获取锁取决于从等待状态退出到上锁的速度<\/li>
<\/ul>
<\/li>
<\/ol>
关键函数分析<\/h3>
pipe_write<\/code>流程<\/h4>

获取互斥锁mutex_lock(&pipe->mutex)<\/code><\/li>
检查管道状态：

如果管道有空间，直接写入<\/li>
如果管道满，进入等待状态<\/li>
<\/ul>
<\/li>
释放锁mutex_unlock(&pipe->mutex)<\/code><\/li>
唤醒读进程wake_up_interruptible_sync_poll(&pipe->rd_wait, EPOLLIN | EPOLLRDNORM)<\/code><\/li>
等待可写状态wait_event_interruptible_exclusive(pipe->wr_wait, pipe_writable(pipe))<\/code><\/li>
重新获取锁mutex_lock(&pipe->mutex)<\/code><\/li>
<\/ol>
pipe_read<\/code>流程<\/h4>

获取互斥锁mutex_lock(&pipe->mutex)<\/code><\/li>
检查管道状态：

如果管道为空且无写者，返回<\/li>
如果管道为空但有写者，等待数据<\/li>
<\/ul>
<\/li>
释放锁mutex_unlock(&pipe->mutex)<\/code><\/li>
等待可读状态wait_event_interruptible_exclusive(pipe->rd_wait, pipe_readable(pipe))<\/code><\/li>
读取数据<\/li>
唤醒写进程wake_up_interruptible_sync_poll(&pipe->wr_wait, EPOLLOUT | EPOLLWRNORM)<\/code><\/li>
<\/ol>
互斥锁机制<\/h3>
mutex_init<\/code><\/h4>

初始化互斥锁为未锁定状态<\/li>
设置计数器为1<\/li>
初始化自旋锁和等待队列<\/li>
<\/ul>
mutex_lock<\/code><\/h4>

尝试快速路径：原子地将计数器从1减到0<\/li>
如果失败，进入慢速路径：

将任务加入等待队列<\/li>
使任务进入睡眠状态<\/li>
<\/ul>
<\/li>
<\/ol>
mutex_unlock<\/code><\/h4>

清除所有者信息<\/li>
尝试快速路径：原子地将计数器从0加到1<\/li>
如果失败，进入慢速路径：

验证所有者信息<\/li>
唤醒等待队列中的下一个任务<\/li>
<\/ul>
<\/li>
<\/ol>
漏洞利用<\/h2>
利用思路<\/h3>


触发竞争<\/strong>：<\/p>

多个进程同时写入超过管道缓冲区的数据<\/li>
导致接收流程中断，未完全接收数据<\/li>
唤醒另一个进程写入管道，使剩余接收的数据来自另一个进程<\/li>
<\/ul>
<\/li>

信息泄露<\/strong>：<\/p>

利用残留的next<\/code>指针（包含PIE地址）<\/li>
通过print_messages<\/code>函数泄露地址<\/li>
<\/ul>
<\/li>

任意写<\/strong>：<\/p>

控制message<\/code>结构体的next<\/code>字段<\/li>
指向目标地址（如GOT表）<\/li>
使用redact_message<\/code>修改目标内容<\/li>
<\/ul>
<\/li>
<\/ol>
利用步骤<\/h3>


泄露PIE基址<\/strong>：<\/p>

利用管道竞争使接收的message<\/code>包含残留的NULL_MESSAGE<\/code>地址<\/li>
该地址与PIE基址有固定偏移<\/li>
<\/ul>
<\/li>

泄露libc地址<\/strong>：<\/p>

构造message<\/code>使next<\/code>指向GOT表附近<\/li>
通过print_messages<\/code>读取GOT表内容<\/li>
<\/ul>
<\/li>

劫持控制流<\/strong>：<\/p>

修改GOT表项（如fwrite<\/code>）为system<\/code><\/li>
构造message<\/code>使destory_buf<\/code>为"\/bin\/sh"<\/li>
触发fwrite<\/code>调用执行shell<\/li>
<\/ul>
<\/li>
<\/ol>
利用代码关键部分<\/h3>
def<\/span> leak_text<\/span>(r):
<\/span><\/span>    payload =<\/span> {0<\/span>: command_print()}
<\/span><\/span>    send_stage(payload)
<\/span><\/span>    # 解析泄露的地址计算PIE基址<\/span>
<\/span><\/span>
<\/span><\/span>def<\/span> leak_libc<\/span>(r):
<\/span><\/span>    payload =<\/span> {
<\/span><\/span>        0<\/span>: write_payload(exe.<\/span>got.<\/span>fwrite-<\/span>0x8<\/span>, 0x0<\/span>) +<\/span> read_payload()
<\/span><\/span>    }
<\/span><\/span>    send_stage(payload)
<\/span><\/span>    # 解析泄露的地址计算libc基址<\/span>
<\/span><\/span>
<\/span><\/span>def<\/span> rewrite_got<\/span>(r):
<\/span><\/span>    payload =<\/span> {
<\/span><\/span>        0<\/span>: write_payload(exe.<\/span>got.<\/span>fwrite, libc.<\/span>sym.<\/span>system) +<\/span> 
<\/span><\/span>           build_message(b<\/span>"\/bin\/sh"<\/span>, b<\/span>"Master pwner"<\/span>, 0x0<\/span>)
<\/span><\/span>    }
<\/span><\/span>    send_stage(payload)
<\/span><\/span><\/code><\/pre>防御措施<\/h2>


正确同步<\/strong>：<\/p>

使用适当的同步机制确保读写顺序<\/li>
避免依赖不可控的竞争条件<\/li>
<\/ul>
<\/li>

输入验证<\/strong>：<\/p>

验证从管道读取的数据结构和长度<\/li>
检查指针有效性<\/li>
<\/ul>
<\/li>

权限控制<\/strong>：<\/p>

限制管道访问权限<\/li>
使用命名管道时设置适当的文件权限<\/li>
<\/ul>
<\/li>

资源限制<\/strong>：<\/p>

控制管道缓冲区大小<\/li>
监控管道使用情况<\/li>
<\/ul>
<\/li>
<\/ol>
总结<\/h2>
Linux管道竞争漏洞源于多个进程同时写入管道时的未正确同步问题。通过精心构造的竞争条件，攻击者可以控制管道数据的接收顺序和内容，进而实现信息泄露和任意内存写入。理解管道的工作原理和内核同步机制对于发现和防御此类漏洞至关重要。<\/p>

类别<\/th>	系统调用<\/th> <\/tr> <\/thead>
创建和管理<\/td>	`pipe(2)<\/code>, mkfifo(3)<\/code>, open(2)<\/code>, fcntl(2)<\/code>, dup(2)<\/code>, close(2)<\/code><\/td> <\/tr>`
I\/O操作<\/td>	`read(2)<\/code>, write(2)<\/code>, poll(2)<\/code>, select(2)<\/code>, splice(2)<\/code>, tee(2)<\/code>, vmsplice(2)<\/code><\/td> <\/tr>`
其他<\/td>	stat(2)<\/code>, unlink(2)<\/code>, epoll(7)<\/code><\/td> <\/tr> <\/tbody> <\/table> 管道竞争漏洞分析<\/h2> 竞争条件原理<\/h3> 初始状态<\/strong>：<\/p> 多个进程同时尝试写入管道<\/li> 由于互斥锁，只有一个进程能获得锁并开始写入<\/li> <\/ul> <\/li> 管道满时<\/strong>：<\/p> 第一个进程写满管道后释放锁<\/li> 其他进程获得锁，但也会因为管道满而阻塞<\/li> 第一个进程唤醒读进程<\/li> <\/ul> <\/li> 读进程唤醒<\/strong>：<\/p> 读进程尝试获取锁，但被放入互斥等待队列<\/li> 读进程位于写进程之后<\/li> <\/ul> <\/li> 竞争点<\/strong>：<\/p> 当管道有空间可写时，从wait_event_interruptible_exclusive<\/code>退出的进程会尝试获取锁<\/li> 哪个进程先获取锁取决于从等待状态退出到上锁的速度<\/li> <\/ul> <\/li> <\/ol> 关键函数分析<\/h3> pipe_write<\/code>流程<\/h4> 获取互斥锁mutex_lock(&pipe->mutex)<\/code><\/li> 检查管道状态：如果管道有空间，直接写入<\/li> 如果管道满，进入等待状态<\/li> <\/ul> <\/li> 释放锁mutex_unlock(&pipe->mutex)<\/code><\/li> 唤醒读进程wake_up_interruptible_sync_poll(&pipe->rd_wait, EPOLLIN \| EPOLLRDNORM)<\/code><\/li> 等待可写状态wait_event_interruptible_exclusive(pipe->wr_wait, pipe_writable(pipe))<\/code><\/li> 重新获取锁mutex_lock(&pipe->mutex)<\/code><\/li> <\/ol> pipe_read<\/code>流程<\/h4> 获取互斥锁mutex_lock(&pipe->mutex)<\/code><\/li> 检查管道状态：如果管道为空且无写者，返回<\/li> 如果管道为空但有写者，等待数据<\/li> <\/ul> <\/li> 释放锁mutex_unlock(&pipe->mutex)<\/code><\/li> 等待可读状态wait_event_interruptible_exclusive(pipe->rd_wait, pipe_readable(pipe))<\/code><\/li> 读取数据<\/li> 唤醒写进程wake_up_interruptible_sync_poll(&pipe->wr_wait, EPOLLOUT \| EPOLLWRNORM)<\/code><\/li> <\/ol> 互斥锁机制<\/h3> mutex_init<\/code><\/h4> 初始化互斥锁为未锁定状态<\/li> 设置计数器为1<\/li> 初始化自旋锁和等待队列<\/li> <\/ul> mutex_lock<\/code><\/h4> 尝试快速路径：原子地将计数器从1减到0<\/li> 如果失败，进入慢速路径：将任务加入等待队列<\/li> 使任务进入睡眠状态<\/li> <\/ul> <\/li> <\/ol> mutex_unlock<\/code><\/h4> 清除所有者信息<\/li> 尝试快速路径：原子地将计数器从0加到1<\/li> 如果失败，进入慢速路径：验证所有者信息<\/li> 唤醒等待队列中的下一个任务<\/li> <\/ul> <\/li> <\/ol> 漏洞利用<\/h2> 利用思路<\/h3> 触发竞争<\/strong>：<\/p> 多个进程同时写入超过管道缓冲区的数据<\/li> 导致接收流程中断，未完全接收数据<\/li> 唤醒另一个进程写入管道，使剩余接收的数据来自另一个进程<\/li> <\/ul> <\/li> 信息泄露<\/strong>：<\/p> 利用残留的next<\/code>指针（包含PIE地址）<\/li> 通过print_messages<\/code>函数泄露地址<\/li> <\/ul> <\/li> 任意写<\/strong>：<\/p> 控制message<\/code>结构体的next<\/code>字段<\/li> 指向目标地址（如GOT表）<\/li> 使用redact_message<\/code>修改目标内容<\/li> <\/ul> <\/li> <\/ol> 利用步骤<\/h3> 泄露PIE基址<\/strong>：<\/p> 利用管道竞争使接收的message<\/code>包含残留的NULL_MESSAGE<\/code>地址<\/li> 该地址与PIE基址有固定偏移<\/li> <\/ul> <\/li> 泄露libc地址<\/strong>：<\/p> 构造message<\/code>使next<\/code>指向GOT表附近<\/li> 通过print_messages<\/code>读取GOT表内容<\/li> <\/ul> <\/li> 劫持控制流<\/strong>：<\/p> 修改GOT表项（如fwrite<\/code>）为system<\/code><\/li> 构造message<\/code>使destory_buf<\/code>为"\/bin\/sh"<\/li> 触发fwrite<\/code>调用执行shell<\/li> <\/ul> <\/li> <\/ol> 利用代码关键部分<\/h3> def<\/span> leak_text<\/span>(r): <\/span><\/span> payload =<\/span> {0<\/span>: command_print()} <\/span><\/span> send_stage(payload) <\/span><\/span> # 解析泄露的地址计算PIE基址<\/span> <\/span><\/span> <\/span><\/span>def<\/span> leak_libc<\/span>(r): <\/span><\/span> payload =<\/span> { <\/span><\/span> 0<\/span>: write_payload(exe.<\/span>got.<\/span>fwrite-<\/span>0x8<\/span>, 0x0<\/span>) +<\/span> read_payload() <\/span><\/span> } <\/span><\/span> send_stage(payload) <\/span><\/span> # 解析泄露的地址计算libc基址<\/span> <\/span><\/span> <\/span><\/span>def<\/span> rewrite_got<\/span>(r): <\/span><\/span> payload =<\/span> { <\/span><\/span> 0<\/span>: write_payload(exe.<\/span>got.<\/span>fwrite, libc.<\/span>sym.<\/span>system) +<\/span> <\/span><\/span> build_message(b<\/span>"\/bin\/sh"<\/span>, b<\/span>"Master pwner"<\/span>, 0x0<\/span>) <\/span><\/span> } <\/span><\/span> send_stage(payload) <\/span><\/span><\/code><\/pre>防御措施<\/h2> 正确同步<\/strong>：<\/p> 使用适当的同步机制确保读写顺序<\/li> 避免依赖不可控的竞争条件<\/li> <\/ul> <\/li> 输入验证<\/strong>：<\/p> 验证从管道读取的数据结构和长度<\/li> 检查指针有效性<\/li> <\/ul> <\/li> 权限控制<\/strong>：<\/p> 限制管道访问权限<\/li> 使用命名管道时设置适当的文件权限<\/li> <\/ul> <\/li> 资源限制<\/strong>：<\/p> 控制管道缓冲区大小<\/li> 监控管道使用情况<\/li> <\/ul> <\/li> <\/ol> 总结<\/h2> Linux管道竞争漏洞源于多个进程同时写入管道时的未正确同步问题。通过精心构造的竞争条件，攻击者可以控制管道数据的接收顺序和内容，进而实现信息泄露和任意内存写入。理解管道的工作原理和内核同步机制对于发现和防御此类漏洞至关重要。<\/p>

Linux管道竞争漏洞分析与利用<\/h1>

管道(Pipe)基础<\/h2>

管道概述<\/h3> 管道是Linux系统中一种单向的进程间通信(IPC)机制，具有读端和写端。数据从写端写入，可以从读端读出。<\/p>

管道类型<\/h3>

管道竞争漏洞分析<\/h2>

关键函数分析<\/h3>

互斥锁机制<\/h3>

漏洞利用<\/h2>

管道概述<\/h3>
管道是Linux系统中一种单向的进程间通信(IPC)机制，具有读端和写端。数据从写端写入，可以从读端读出。<\/p>