CVE-2021-42008

环境搭建

version: v5.10

commit:2c85ebc57b3e1817b6ce1a6b703928e113a90442

config:

defconfig+

CONFIG_USER_NS=y
CONFIG_SECURITY_SELINUX_DISABLE=y
# for debug
CONFIG_KALLSYMS=y
CONFIG_KALLSYMS_ALL=y
CONFIG_DEBUG_INFO_DWARF4=y
# for msg_msg copy
CONFIG_CHECKPOINT_RESTORE=y
# for syzkaller image
CONFIG_CONFIGFS_FS=y
CONFIG_SECURITYFS=y

CONFIG_SLAB_FREELIST_RANDOM=n
CONFIG_SLAB_FREELIST_HARDENED=n
CONFIG_SHUFFLE_PAGE_ALLOCATOR=n
CONFIG_HARDENED_USERCOPY=n
CONFIG_FORTIFY_SOURCE=n
CONFIG_STATIC_USERMODEHELPER=n
CONFIG_DEBUG_INFO_NONE=n
CONFIG_RANDOMIZE_BASE=n

CONFIG_DEBUG_INFO=y  #调试

CONFIG_6PACK=y #漏洞
CONFIG_AX25=y  #漏洞


CONFIG_E1000=y
CONFIG_E1000E=y

漏洞分析

源码位置：https://elixir.bootlin.com/linux/v5.10/source/drivers/net/hamradio/6pack.c#L832

在5.14内核中的对应修改后的代码如下：

关键结构体定义如下：https://elixir.bootlin.com/linux/v5.10/source/drivers/net/hamradio/6pack.c#L85

参考

https://bsauce.github.io/2021/12/09/CVE-2021-42008/#kernel-exploitcve-2021-42008-6pack%E5%8D%8F%E8%AE%AE%E8%A7%A3%E7%A0%81%E6%BA%A2%E5%87%BA%E6%BC%8F%E6%B4%9E%E5%88%A9%E7%94%A8