How Linux Page Cache Bugs Keep Happening

[00:00:01]Mind-blown.

[00:00:02]For the second time in a week, Linux kernel showed a universal LP.

[00:00:14]Local privilege escalation. Anyone, any user on your system can become root just by issuing one line of command.

[00:00:26]See?

[00:00:28]I have this only one line. If you're a professional or no wise, you will see that this is not one line. Technically, I'm fetching one project from the Git, going into it, compile it, run it, and I am root. And this is the second time that this happened. And I'm sure more cases will happen soon. This is called dirty frag frag.

[00:01:00]Frag, like fragmentation.

[00:01:02]Not like exactly fragmentation.

[00:01:05]After we had dirty cow, dirty pipe, then we had copy fail. I covered copy fail.

[00:01:12]Now we have this dirty frag inspired by copy fail, a security researcher have shown this. It's here. Let's me show it to you.

[00:01:25]Uh Hyunwoon Kim uh Rebel or Rebel showed this and said after seeing the copy fail he started researching this one and we will have more and more of this.

[00:01:44]Second time in a week. Very strange.

[00:01:47]Uh in this video, I will show you on technical level. We will check the code, what is happening there. This is more complicated than dirty uh copy fail. Also, I'm going to the hike without electricity, water, and it I have water, anything other things network off the grid off the grid is the correct word for a few days, so I'm at here, so I've thought it's better to cover this before leaving.

[00:02:17]I will show you what's going on on the code level and we have some chat on to stand the behind the scene environment. This is happening because of five different things hand to hand.

[00:02:31]Also, he's very cleverly using two different uh CVEs, two different exploits to get this root access.

[00:02:41]Technically, these are not chained as I understand, these are two different directions. On some systems, one work, on some systems, the other one work. And this looks like a new trend. People just show that this can be used on the all different systems at the same time, same code. In my case, you saw this is my own daily driver computer.

[00:03:05]And this works. I haven't updated it.

[00:03:08]Maybe after update, I hopefully it should stop working. I will tell you here.

[00:03:16]No, there.

[00:03:18]Maybe there.

[00:03:20]Anyway.

[00:03:21]So, what's going on?

[00:03:29]As I've told you, this is the combination of uh five different things. The first one is page cache structure in the Linux kernel world. I've talked about this on the previous video, copy fail, in more depth, but in general, it's very direct.

[00:03:49]Whatever you do in Linux, for example, when you read something from a disk, it goes into a page cache in your memory.

[00:03:57]And whenever other people or the same process or other processes needs the same data, this will be used as the source of truth. This is very good because you are not going directly to the disk all the time.

[00:04:12]safe enough. The second one is pipes in Linux. In many cases, when you want to do something, you create pipes. The command is splice. Again, we had this in the copy file video in a little bit more detail. But what this does is it creates buffers from your data. And you have some kind of different access and more access there. In the previous video, so this is not real tree, this is a fake tree, we had some uh cryptographic algorithms working on this buffer and changing them in place. So, technically now tree should be zero copy. Let me show you some code for this and this. That would be more fun. Seeing code is always good and also most of us do not need to understand to the last command in these exploits. But it's good to use them to learn more about the Linux kernel. If you want to check Linux kernel, you can always go to github.com Torvalds Linux. The development doesn't happen here. This is just a mirror of the kernel, but very easy to search or use. So, I wanted to show you the struct of a page.

[00:05:36]When you have a page in the memory, this is not the one. We need the header files.

[00:05:43]Mhm.

[00:05:47]Okay, let's go from here. We will dive into some page.

[00:05:54]Where do we have a page? Struck page, for example.

[00:05:57]This comes from here on MM types header.

[00:06:01]See, this is kind of complicated, more data. You have a struct called page. When you read something, this goes into the memory in this structure. You have some flags, atomic flags. You have a union of different structs, so you can have different things in your page. And also another union of the page type. And also you have some ref counts. When you are creating a page there, you say, "Okay, this is my page.

[00:06:37]It has some different kind of data into it." You saw the unions. And also you have a ref counts. How many references I have to this one? If you have this and someone wants to use it, you add one.

[00:06:51]You add one. You add one. Then this one says, "Okay, I'm done. I don't need it anymore." You say, "Okay, I'll remove one." So you have two references. This says, "Okay, I'm finished." You remove another one. So you have only one reference. When your reference is zero, it means you can just omit this one. You nobody needs it anymore. This is fun and cool. Still it's cache. It's not very clear, but this is how reference counting works. So, what we had uh we had the page cache, we had the pipes using the supplies, we had the zero copy concept.

[00:07:36]Now, the here many of the fails are happening because of this. When you have this memory here, read something, it's in memory, and you want to do something on it.

[00:07:47]Normal, old school, non-optimized people may copy the data here and just do whatever they want with this. This is very safe because you are not touching the original data, but it's very slow because this is very expensive.

[00:08:04]So, or expensive if you are in Europe.

[00:08:08]So, what happens is many optimization procedures try to do zero copies. They use the same memory slot to do what they want to do, especially on the cryptographic. If you have a list of numbers, 1 2 3 4 1, and want to add to what add two to each of them, a normal non-optimized person would copy everything there, would use double the memory, would pay for one whole copy of the memory, then go through and add to this. But, a zero copy would just go one by one and add directly here.

[00:08:54]This is a zero copy method.

[00:08:57]You can see it starts to be a little bit frightening. What happened in copy fail was we were doing a zero copy encryption on the su command. Now, that part is fixed. This guy tried to find a new method and find an amazing method. So, uh page cache pipe zero copy, he started using or abusing fragment pages, which is called frags. [snorts] That's why the whole thing is called a dirty frag.

[00:09:45]As you remember, we previously had dirty cow. Cow is copy on right. It used to be used to be a group of hacks we seen some time ago. Uh you know the idea. I have the copy. Everyone is using this. No problem. Everyone, you don't need to copy it somewhere to use it. Zero copy.

[00:10:05]As soon as you want to write on it, you copy it. Copy on right.

[00:10:12]So, this is now safe. As soon as you want to edit, you copy it.

[00:10:17]But, what happens with fragments? These pages are huge. They are not huge. I think in modern kernel they are 4K, which is still large. If you're reading a file, this is not super large. But, you're if you're working with a network interface, 4K is large. When you're reading data from network, your chunks are much smaller. So, what Linux does is when you request for some data, instead of the whole page, it gives you a fragment of the page. How?

[00:10:52]It creates a page.

[00:10:55]Some data is here. Another data is here.

[00:10:58]Another data is here. And now, if you ask for a page frag, it will tell you, "Okay, page frag, I'm giving you this page, but you will start from this. So, this is called offset.

[00:11:19]And this is your size. So, I created a fragment here. Let's have a look to the page and page fragments structures in Linux kernel.

[00:11:33]You just saw the page.

[00:11:39]Right?

[00:11:40]And you see page had some flags, had some complicated structures, had things like uh reference counts, and those kind of stuff. Also, you have the type. You will keep if this page is writable for this user. But, if you go to the struct uh page frag uh and types Yeah, it's good enough.

[00:12:16]Here you can see, it's much more simple.

[00:12:20]A page frag points to a page, has an offset, and has a size. This is also cool how kernel will uh programmers to write code. If you are on a U32 or if you are U blah blah, you're you have that kind of offset based on your bits per long or page size size.

[00:12:43]So, what happened is now you can see the problem.

[00:12:49]You have a page with lots of information about how people can access if it's writable or not, but you have fragments which are very simple.

[00:13:00]Only points to one specific page, points to an offset, and points to a size.

[00:13:09]The attacker started thinking, "What happens if I create a Sorry, I'm not very good with this screen writer I'm using. I tried to update to something which works on Wayland.

[00:13:29]Uh so, what happens? The hacker started thinking.

[00:13:33]What happens if I ask for a fragment of the page, then give it back, then someone else uses the same thing.

[00:13:47]There might be a confusion about right access. And again, if we find something that can change the memory with zero copy, we might be able to write something in memory where, for example, the su command resists.

[00:14:09]exists resides It is there.

[00:14:15]Resist means to resist.

[00:14:17]But there is a word close to this one.

[00:14:19]So, this is how this attack in general works.

[00:14:24]It loads an important binary like su, so kernel knows that su is here, then reuses the same fragment for something writable and asks something which does a zero copy to write whatever I want over the su.

[00:14:42]Very clever and the strange and fun part is he also introduced two different uh methods for that writing. If you go to the assets, there is write-up here which discusses everything in much more detail, even more detail than what I'm discussing. He mentions that this alkif or interface a eid which we were using in copy fail is not valid anymore, so who cares? I added two new CVEs.

[00:15:16]The first one, this is the kernel code, uses ESP input.

[00:15:22]And this is the problematic part, at least for part. It says, "If SKB is non-linear SKB is socket buffer.

[00:15:37]Number of frags is one, skip the call.

[00:15:40]So, if you are doing changes, copy-on-write, skip it. Just do the change in place.

[00:15:48]This is a problem with that reference counting I told you.

[00:15:52]And he created an exploit for this. But this needs user to be able to create namespaces in the kernel. Ubuntu, by default, doesn't allow this. So, he bravely introduced another CV page cache write.

[00:16:17]He found another place with with which can do kind of the same thing, calling a crypto cipher to just do the in-place change. So, if that doesn't work, this will work. He created the exploit, also created a patch, and submitted for both cases. He says the disclosure timeline.

[00:16:40]Both are found on this specific date or day after. I think this is the first one. The second one is on 13th.

[00:16:48]And 13th. And he says, "Inspired by the copy fail, he started finding these." Obviously, he used I don't know what. I guess my guess is he used AI. And this is happening more and more. Now we have very, very, very strong exploit finders using AIs.

[00:17:08]Even many projects and sites which are giving out bounties are saying, "Okay, pause. We are getting too much noise and real data. And I think Anthropic uh introduced a new tool to find bugs. He says this is very dangerous. So, at the moment only companies do have access. After some time, we will see how it works. He disclosed it, provided the patch, and now giving out the code. Also, on the code you can see the actual exploit.

[00:17:46]It's a little bit Not little bit, it's difficult to understand. He says what it does, it's kind of replaces the whole thing with a new shell for the root, which is a nice idea. Replaces the su as I understood it.

[00:18:04]Um if you want to start studying it, do one right. There were some place which was more readable.

[00:18:17]Ah, this is the main place to start. su LPE, local privilege escalation, main.

[00:18:23]And you can go forward from here and see how it works. It starts two different branches based on which works. As soon as it sees that you have the root, starts the root. Also, you can run it with some flags for some more visibility on what is happening. I think it's was in the same place I was.

[00:18:43]Yeah, you can have a verbose mode, or you can set some environment variables like this to make sure that it tells you what it's doing.

[00:18:53]Amazing work.

[00:18:56]And we will see more and more of this.

[00:18:58]Linux kernel exploitation today is more about abusing all these performance optimization we had in previous years. This is not like a hackers doing strange magic or a bad line of code in kernel. This is using some different legit modules combining them in each other and exploiting the functionality. So, it's very difficult by understanding the possibility of such a thing with reading different modules. It's about complexity of the code, zero copies, and this shared memory ownership. It happens because of this complexity complexity in the kernel. For the defense, obviously, we have to update. I will update the my machine just after this video to make sure to will add to the video that if updates works at the moment or not. Also, some other important factor is this can jump out of containers because this is happening in the kernel when you have different contact kind of containers. Beneath your kernel, this can affect all of them. So, whatever you have, update. Maybe in the near future, people will go for less optimization, more security.

[00:20:24]Let's see how this works. Hope you liked it. Try the code for educational purposes.