来源

关联漏洞

描述

https://www.qualys.com/2023/10/03/cve-2023-4911/looney-tunables-local-privilege-escalation-glibc-ld-so.txt

介绍

# CVE-2023-4911

https://www.qualys.com/2023/10/03/cve-2023-4911/looney-tunables-local-privilege-escalation-glibc-ld-so.txt

Proof-of-Concept

Developed for:

- Ubuntu 22.04
- Ubuntu GLIBC 2.35-0ubuntu3.1
- su from util-linux 2.37.2
- ASLR ON

Dockerfile included.

## Debug

Disable ASLR

```
$ echo 0 | sudo tee /proc/sys/kernel/randomize_va_space
```

Compile with `NO_ASLR`

```
$ python3 patch.py
$ gcc poc.c -o poc_debug -DNO_ASLR
```

Run gdbscript

```
gdb -ix gdbscript
```

## Build

```
$ python3 patch.py
$ gcc poc.c -o poc
```

## Usage

```
./poc; while [ $? -ne 0 ]; do ./poc; done
```

文件快照

 [4.0K]  /data/pocs/95475cfda740f5b01dd7edc5ef2e3e6d6feee5c8
├── [ 499]  Dockerfile
├── [ 344]  gdbscript
├── [ 715]  patch.py
├── [1.5K]  poc.c
└── [ 601]  README.md

0 directories, 5 files

备注