关联漏洞
标题：
polkit 缓冲区错误漏洞
(CVE-2021-4034)
描述：polkit是一个在类 Unix操作系统中控制系统范围权限的组件。通过定义和审核权限规则，实现不同优先级进程间的通讯。 polkit 的 pkexec application存在缓冲区错误漏洞，攻击者可利用该漏洞通过精心设计环境变量诱导pkexec执行任意代码。成功执行攻击后，如果目标计算机上没有权限的用户拥有管理权限，攻击可能会导致本地权限升级。
描述
LSM BPF module to block pwnkit (CVE-2021-4034) like exploits
介绍
# Check ARGC0 LSM BPF
Simple LSM BPF program to prevent program executions with argc == 0, e.g. pwnkit (CVE-2021-4034).
It does nothing more than a simple check that all exec\*() system calls are called with argc >= 1.
The check is based on Ariadne Conill's [patch](https://lore.kernel.org/all/20220127000724.15106-1-ariadne@dereferenced.org/).
<p align="center">
<a href="https://youtu.be/rRBaurE7rUM">
<img src="https://img.youtube.com/vi/rRBaurE7rUM/0.jpg" alt="LSM BPF demonstration"/>
</a>
</p>
## How to build
```
# On Ubuntu
$ sudo apt-get install libc6-dev-i386 libbpf0 libbpf-dev
# On Fedora 35
$ sudo dnf install clang bpftool libbpf-devel glibc-devel.i686 glibc-devel.x86_64
$ make
```
## How to install
Run:
```
$ sudo make DESTDIR=/usr install
# will execute following commands
# sudo cp src/load_check_argc0_lsm /usr/sbin
# sudo cp share/check_argc0_lsm.service /etc/systemd/system/
# After that you can enable the service with
$ sudo systemctl daemon-reload
$ sudo systemctl enable check_argc0_lsm.service
$ sudo systemctl start check_argc0_lsm.service
```
Test:
```
$ strace ./test/trigger
...
execve("/usr/bin/pkexec", NULL, NULL) = -1 EINVAL (Invalid argument)
$ sudo journalctl -u check_argc0_lsm.service
Feb 10 13:27:08 purple systemd[1]: Started LSM BPF protection for argc == 0 execs.
Feb 10 13:27:13 purple load_check_argc0_lsm[89177]: TIME PID PROCESS CALLING
Feb 10 13:27:13 purple load_check_argc0_lsm[89177]: 13:27:13 89194 trigger /usr/bin/pkexec
```
## How to test
Linux kernel >= 5.8 required for BPF LSM (5.7) and BPF rignbuf (5.8).
```
# The program will start, attach an LSM BPF, and monitor the log
$ sudo ./src/load_check_argc0_lsm
TIME PID PROCESS CALLING
12:59:21 85689 trigger /usr/bin/pkexec
```
One can use the trigger program to test that everything works:
```
$ strace ./test/trigger
...
execve("/usr/bin/pkexec", NULL, NULL) = -1 EINVAL (Invalid argument)
```
文件快照
[4.0K] /data/pocs/f6c19646fa3dd5484188584c1f2320a020d549fd
├── [4.0K] doc
│ └── [104K] ru_LSM_BPF_pwnkit.pdf
├── [ 222] Makefile
├── [2.0K] README.md
├── [4.0K] share
│ ├── [ 182] check_argc0_lsm.service.tmpl
│ └── [ 211] Makefile
├── [4.0K] src
│ ├── [ 862] check_argc0_lsm.c
│ ├── [ 218] common.h
│ ├── [3.1K] load_check_argc0_lsm.c
│ └── [ 540] Makefile
└── [4.0K] test
├── [ 149] Makefile
├── [ 451] test.c
└── [ 210] trigger.c
4 directories, 12 files
备注
1. 建议优先通过来源进行访问。
2. 如果因为来源失效或无法访问，请发送邮箱到 f.jinxu#gmail.com 索取本地快照（把 # 换成 @）。
3. 神龙已为您对POC代码进行快照，为了长期维护，请考虑为本地POC付费，感谢您的支持。