Metasploit Module: AF_PACKET chocobo_root Privilege Escalation
Type: exploit
Path: modules/exploits/linux/local/af_packet_chocobo_root_priv_esc.rb
Disclosure date: 2016-08-12
References: EDB-40871, CVE-2016-8655, BID-94692, URL-https://seclists.org/oss-sec/2016/q4/607, URL-https://seclists.org/oss-sec/2016/q4/att-621/chocobo_root_c.bin, URL-https://github.com/bcoles/kernel-exploits/blob/master/CVE-2016-8655/chocobo_root.c, URL-https://bitbucket.org/externalist/1day_exploits/src/master/CVE-2016-8655/CVE-2016-8655_chocobo_root_commented.c, URL-https://usn.ubuntu.com/3151-1/, URL-https://www.securitytracker.com/id/1037403, URL-https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=84ac7260236a49c79eede[PII_REDACTED]4c2c19b0c

Description:
This module exploits a race condition and use-after-free in the
          packet_set_ring function in net/packet/af_packet.c (AF_PACKET) in
          the Linux kernel to execute code as root (CVE-2016-8655).

          The bug was initially introduced in 2011 and patched in 2016 in version
          4.4.0-53.74, potentially affecting a large number of kernels; however
          this exploit targets only systems using Ubuntu (Trusty / Xenial) kernels
          4.4.0 < 4.4.0-53, including Linux distros based on Ubuntu, such as
          Linux Mint.

          The target system must have unprivileged user namespaces enabled,
          two or more CPU cores, and SMAP must be disabled.

          Bypasses for SMEP and KASLR are included. Failed exploitation
          may crash the kernel.

          This module has been tested successfully on

          Linux Mint 17.3 (x86_64);
          Linux Mint 18 (x86_64);
          Ubuntu 16.04 (x86_64); and
          Ubuntu 16.04.2 (x86_64).

Check method (fingerprinting):
arch = kernel_hardware
    unless arch.include? 'x86_64'
      return CheckCode::Safe("System architecture #{arch} is not supported")
    end

    vprint_good "System architecture #{arch} is supported"

    offsets = strip_comments(exploit_data('CVE-2016-8655', 'chocobo_root.c')).scan(/kernels\[\] = \{(.+?)\};/m).flatten.first
    kernels = offsets.scan(/"(.+?)"/).flatten

    version = "#{kernel_release} #{kernel_version.split(' ').first}"
    unless kernels.include? version
      return CheckCode::Safe("Linux kernel #{version} is not vulnerable")
    end

    vprint_good "Linux kernel #{version} is vulnerable"

    if smap_enabled?
      return CheckCode::Safe('SMAP is enabled')
    end

    vprint_good 'SMAP is not enabled'

    if lkrg_installed?
      return CheckCode::Safe('LKRG is installed')
    end

    vprint_good 'LKRG is not installed'

    if grsec_installed?
      return CheckCode::Safe('grsecurity is in use')
    end

    vprint_good 'grsecurity is not in use'

    cores = get_cpu_info[:cores].to_i
    min_required_cores = 2
    unless cores >= min_required_cores
      return CheckCode::Safe("System has less than #{min_required_cores} CPU cores")
    end

    vprint_good "System has #{cores} CPU cores"

    config = kernel_config
    if config.nil?
      return CheckCode::Unknown('Could not retrieve kernel config')
    end

    unless config.include? 'CONFIG_USER_NS=y'
      return CheckCode::Safe('Kernel config does not include CONFIG_USER_NS')
    end

    vp