CVE-2018-1000001 PoC — GNU glibc 权限许可和访问控制问题漏洞

Source

https://github.com/usernameid0/tools-for-CVE-2018-1000001

Associated Vulnerability

Title: GNU glibc 权限许可和访问控制问题漏洞 (CVE-2018-1000001)
Description:In glibc 2.26 and earlier there is confusion in the usage of getcwd() by realpath() which can be used to write before the destination buffer leading to a buffer underflow and potential code execution.

Description

Tools for get offsets and adding patch for support i386

Readme

# Tools for CVE-2018-1000001

## Check vulnerability:
```
$ cat /proc/sys/kernel/unprivileged_userns_clone
```
Output:
```
1
```
If file "/proc/sys/kernel/unprivileged_userns_clone" does not exists:
```
$ unshare -mU /bin/sh -c "sleep 5" & /bin/sh -c "sleep 1; cd /proc/$!/cwd; realpath .; kill -9 $!"
```
The output must contain the string "(unreachable)" before '/':
```
[1] 12345
(unreachable)/home/user
```

## tool.so
Options are passed via Environment variables:
```
TRACE_DEBUG=1  - Value for printing debug information (Default: 0)
STACK_SIZE=100 - Size output data of stack (Default: 100)
```
How to run:
```
$ make
$ cp /bin/umount .
$ LD_PRELOAD="$(realpath tool.so)" TRACE_DEBUG=1 STACK_SIZE=100 ./umount /root
```

## More
https://www.halfdog.net/Security/2017/LibcRealpathBufferUnderflow/

File Snapshot

Remarks

1. It is advised to access via the original source first.

2. Local POC snapshots are reserved for subscribers — if the original source is unavailable, the local mirror is part of the paid plan.

View subscription plans →