Security Research
CVE-2016-3053 IBM AIX Privilege Escalation: A Missing Trust Check in libc System Calls
Thinking
2016-11-15
4 min read
Research Dossier
#Vulnerability Analysis#Code Audit#Lateral Movement
A missing identity check on a libc system call in IBM AIX gives any local unprivileged account a direct path to a root shell.
Unlock to view this content.
ad8d9422966c73fee42096dad808c6448a272095349f41facc28f3d18d1ee66a0726fb5aaffd9271b6702e0ae53f6961031443030e63d37842b7356b4a67d1f44b648f709f84d99b1640e6f7a87a3d44129b61502fc0c5c728a88c67798e6cfb7bcb30fe880464fad1a2cf9635735fbd6e964b402ea4ed27e494f7c87c72f1c586b333a4d4b6d4ade7253d06d61bf923572a6b8c253d117e8b63642be9ad8c68eaee7d4a02592bcdbd3155abcc6a953135deec61ed6729ad92ae056a76758bfc9dbe3a6985ce8c376b1c13f52453cfe80b5e7edc3012958e371085b9ed7be0c0e3d8497f7f8c21f082865cd11510675ebc02d50a0acb6ec9586fc0d74bf0337670ea28ecc6edcd176e868aa1e0f27fe899752a126a520a2bfd0da35f7fce21b3b6badf77804d79fc74f01e1c733154273b9c1379099829704770993858c3a2d92d2afbb8f0020c992e8da68273f96b85c0c3f8ae63bfca8fd45d5ad6aa63aa453b1a847125f9c74cd55a07bd7f0c75441f2c4e39bda797a0bc26bad8cc587bd182b5057214985ba8cc7bce7c48838210b6aab305a040de6e3c5890ec67d20970e681a86464f1826bb9d20ae52ea768cb31bce54e2bcb60fa6af0b2b1ccf7ebffebd5fa96f343025452d4c8fa40168ce0cc14c6ea276f32a38864f024a4a9a42914393ab7ac7f45c9dccc18ce280cbcf8cb4d534462c49939c3bca23d68abf004d628444da9d6c77d0028cfdfffb35b332a652f7d93dae85351ad3688e1af122709373138bcceb5f15f947aee183ac7d55a5485377f8e056f21c6ba534af5cdff6940115ee399c9d3ee8bbc1e9b37960a2758d11cf6f9662438bce988e1b0ca49636ccc73569599aa2fd011deaf198b1891b7d8109d8c02667501d790b683d641517cd935ba7484f3069fc0589c54be5297dff153c6392870bae6ffac2aa8a9fa6e5572e934468b4d0c71fb08051f7bd2c72af62c7e642e445c37726048ffd09677dff21b7eac692aea7c8ef0b7ea0f909e73c937f51db0d7eaa463aac6e5f063cca000751210d31839475b8339774bd8ee5a90c26eea2c14a06fb9af9271563b4f228c6577081621e5dfb9a4567eaff283ea35011d3f19ccf0354056a41772d1822a4735da6cb9e2b0dd409236d28db0f8f21ce666ea1d20ea2a42d66c8f10ca8bcbc600076b1567e45dae8dd36789cd9804e49d1a391570ce5e4a2433ab86cf0c5c784b1c9c10056f531a241efc9ee28f13350e16dd6536d0c2845cd09d7d7083ded905deb8ed634ffb0a52af267860fe3715dc38f38ab7eeaabe39479cb395396fa0b7537fdbcfd71e21328050116f8fe3fab57b7e23e36dd765d9fce9bb77c2e034675683214752b7bd1a4fbdde9a1f2860a0c367323575b4f64887d464a25e596d240a9b51c2e0470cdfe7c28c0d4b8dc302302b3a42fec3913269b0a4d043750a0fe7930848325a7b3427711d1d04791313953e918c7223d6b08a18e112ef1676c75526880e8ada81e9ee0b1266c9e0a40e918977571899275562e95b843b2c204e0e2a3cdffb574ec17cf03e7330071a93f3ef1d1f0ad342805502cb6cbd7bdd9c9fc6a07369468c3cdcbcdc78265768e0f5d4146c15fc6333a9139f52852857ab092b0221f5925d25b58d33e19381b29df3d045a47918f51ada9fe26f4de5b4017e093b63379bca93647d890f51fba3654ca0eee007bb3cf6236ff0fc1b31802735359a231d7fa64c3c8f932f31952c6a1d371dea87781cdd22d74827ed93334eb1b810fc7e8cd0f7ef7a9396f076100125659bd972a5f6c17e477b675804cf559e8b4466d7652a58aca2ab70cf91a02e94fb6dcdbf07f838aea503c00489116ac4c7b44ac9f8e64f19caca75a7f5a1fd894eac5b3d90ea3ca520b585ff9b0147a50700e3a02f48bc57e278da8d14f01deb18bf705f01858a41690c2d102368a6243fad0da96ec862cca933743bf59bc7e01e39293d24a4574b6de3e25df7f35a4aeddaedaca6dad28cc0c515d6d2e26032d9a073c7ae665e7d8b15b7804c50bc4cc90f3ad33ea2f5398a7f561b47d6e0df5aa4621943152f7749fae1152379ad462a16312fbbc8a252296933699b5b8d724ea71bb2aa1718500aa26097d8c047cc803a778f86d183200cbb659c919a9fe7b14209c66d96c1644fb8848775fb5d2571f6066e42dc57ab2d97057f6a9e7c29a584ddae57d9d3450515e7f9dbb6a5987397319f61558e9d046fc71b69ea698fa39f707d016ef94a2b42583233cab4ca7c47487d5028467fc28753467f0fc2e89c69d87c34056bc50b7aab91032da43b27200999445d181580e7e4e4650c53de5c019ebe367d1c4b4118e435501783479850f7f109f26b5f56c58f04da3528fc8e9cd3ac42eba490ef59f61377eb4b202b8f126577eb6849c8d7e0d81d6680ea92b9b0c3c946e83ac696ccfb8f65d536a4c9bfbb0eb56c3d66d95a2c87924b522f7c6f8f04e42114aff42764a5cadcab4f412e0f8851fad52d6e743c726983a86520b0ec35f3ee389b726d4f705dbb04bab96da90c847de5a3ee7cf97787e473547b6e02d79c62268fa3fb7cce95a30139b3be88a2291d29e458f1d3d4d301eaaab706dd77cdc5a8fc3b0d37af8e050d42680282eac9fbc26a89c762d32d9f86cd47d53da86b40128d77fe957d3e4996c28d34cd5b512a347a9574bc202e05ca2f57020db65281666f12f2d7e94ff00f0032e8463a0834f1f617618e292c9d631a6080aecbafd17c57971fc31ae26f8c95cd07a84ade3312635da04aba9ffd2497b90e7ac0dfa2275ad0c80981df9ede41441fe556884971c2605e02252327fcd4f4db71f4ab6670dfa92f988f5157b18a6c8e415db0a5be430ad69498e9eabc7ed4637d44254527b0d928ed5fda24b64956e95cade165cff6c2c1f111608fec3620a7d777180c02b958717045a5e6062b2ae3acd69ad93001d5049f910ae750b51fc84f56250f1eb24c77e3b645c0df387ea687c058f9b9d34deef41a1a7a3e866a6bdf1f960daac9152a0793b6adbbba800913d97a651eb62f36ec0d35682fb2f4637e06d20346e77eb69016a911ee2a850cdd901dd8226992280538e440feb0ac029697515dcb3257e8c1ed20c058ce11827ae7457dc0404bd9f317b0f1e7052d3485213f836502cfd72a83ad2d94b566223b8ebcdf7f695de20ab4b52e51d0d8035f370c581ca5ac8bfd115f1c03da487fae308a5fd74c79a8c3e68c3766e0e825dc0e24024979514d020a05ecbf9845b3d65bd48b778c37e945f502b0966dfaa394c7636e741054e649655cc7bfc41933c0902acd3e8fd59404f923d4685d84f5710482c9c83c719715806a3641c638127a7c30e5d5d82a28958ae63b1ed057ef4b374054b99a0f8408ee8cefc04106d5940c7c62784281ab85082b85a73d4bd54a640c0a80c48bbd14227018a80a6e028a1363c9b3f3230980ff4ae803f66e1e3100ed7beb7e062e4684b62e629b24742b31844e43d9ca870f827efb72a0eca5202f89051806ffcb175dbbdc8893323d151dc719abac2576cb912fcd152913fd193c69434566053b2011e9521a8ab80608f9abe3c4bbd2b7a0555f62757764a7beab5c3b40b96debf8b733912f7d72c57c490a7869f6daa0c2c95cca0df8abee4eebd4dd70cb7942ed95151bcbc3d9363dbd14aec5e28178e7164ab541d378f464a02b66c43e33d3d5f1fd3d2134c721d3d9de198111899097202a4d6ba14d10fc5daf0779979b7382747b322eaee10e6a44d0cabb994f68514dbe92d00becb684e1b28a2fa258aad5d0392a990db38656fd96c286e606b1bf02c0aa3b4ec4ac95fa849e8d2b5ec32668a860f5e6e41c6201bae26040b2aed1936377218dd787fa654b3373b748480e707ff770d328ddcdc98d00632666ece43928343d8d01502f205da930e5e3f7dcb189f9219451b2b4d70c370d89b68b8dd321eea9b3bae8269e03d5f1cd329ef2701dab2cd87f46ecfe7bce7e801f7a26473207aaa8a6716c830d3e354980c3364ea4c2307b93c8993baf2986cda6e72c9072cf1493a04789c13b500f3a7b6d15ee42c518a9670e4efa37d4cd9e8e82a224ec73d588262795fdc344e11806b2d4a1316dc3f059245581117326f83e5e7f496c847fc8c3d21f819b9b42d15dd4bd3342af3cbd59dbeee15af3616b651acdde1b3a63cf89f10f81d08db099a4af16475eadb128f1350f86b7c58112f10c1c1b8ac10e99b26bdb9ee56c7a85edfdff7fd3acc6e0ca8e48dc8bc71a3dc515bcac1ad5e8779414dc1fabf064411d308ae09cfb541e4ddfeb87707d9b7475ab04054fbe5981cd81852d0b547e3a5388899333da90e64959de18330ad9570911cf06ece0610b236c121355337bbd0c4e4c3dd503e80546b01554d795ce864916bdf886fc7c90c14fa96b1c920cf0291341d17775f171a1022312d84ea8bc5ac4f31b9f26265c7d30647854734eea8ab20cc1d4ebc2c9a24bc28a8d0dcb8f9e591f7d83cb913418cd8f70f37aa5618d9c0f7fe50cdbb823ff85829098ebee52851e7a92f215cf5ef9cbd89c00a73023f5e2cff2522796ab14ff04ef092c3cbe60f92e97cb8384507fb6dac91a27d5b1a9aa7d3ad2bee903d5f2eac1cb28d2a92655e94c52c2d91c5f56cb4b5222902494a2bfbaaeeebf09459a4642b555f5c2d9865b1b2016526ca23a25f6e06ce192728718bd2eadb6badcf96fe89edd96bec4e9f10ce088fa948376a37e2180f4f5ada8cbcc61a948d49042bcad6826322bf0eafc550b813b2ab8dfd2f0c90fe05d9682e0458955171ba92854c28ca699580e1410bc660da14383e6cf626bbbc0c4a734bfb8b01121c6b55d18c93844d500f9cc259a87b22db39d4d796570cd0124610fe8c68015c0f057c3fbc34821f7c14c21b9218ebdf508e0f130acdc6fbbb4c06499c0d89c2303db254e3c175c52a2d78e3cc2cc85cdc7f18a833124f3c009e9576c5efb8247d3c62cdbb317b74641e65032173e76037c76792ef9b6902572ea333fcc030626027ef9969b2ec4c05daf0741779aeb03b68b4bff15d54e5b3323db84b69ca84655eb3886ed0c995b769893d8d5221bad9a8977868343374d550f50bc97e9e34e78076738b38b7d4e5f8ed7d1bfbc7edc2913cead9f1b5a116d35f0c130da2f691c06a52981680cec72a166c90c6bf125edbcafc8b0691cf2c109e11b04cacf2eba1d5d9ac6bd3da3197000de39cbcec7439fcd2b12d2eae550d204d16c24abfa64690763c605c738730f3099e8223f88a7fdae4f04f94bc9f538991be39e3fba0cf629dfb7dc6d4cfa4b098fbb04ae3cf5b397ed951d13c5b92fb9fc14529771d6f3c43f0d9ed36b7f24dac942a48376000b436e066334767704bcd9d183f333e9eb0c18a4485274728bcfda08c9e800ed8b3f54f6bc77bec6b64c56de855d406cb79f90f1e6b6d5bc1a9aabd1294014bc3ce0cab4f84f758a6388932ed9183f9103f341bf01302b8469b438f498f7d0af69c3b7a5dfb1190faeef33f5e8dca2e6f497afc2d6f75abb9a06d806529df3050d6c0c00dc3aa6815ed165563b592f61284c8a7926e8f67d06161962ccdac0c307996b1d72e49e4023941c82978678e9741e47e7ec416df0effe7c714f95e9450eefda4d210db9b5003600e9d6d87b627816505958467914faab90edda332e844a41449648e2959de8bb2a1258fa232f7a2984bac6f04ed30741d22348e7c614773874e399d636b39cf1b9c1c2d938e62724ef786aef26c7928c03dfbb5fd90474a000c9a9e587fb721a71a2d1f5c0014264f9d54d28823271581be4a87389e5bf5ee92dc7a3724912bd256f44d296556bae46828f31307b2b40f303ca9e41360e18908c3bc6d53dfc9b17d3737d55198af6355dd4d69f4e7cb4bbf53e2c20618996328b328361bb4dba1cbdef06355b6b521f456b8e7fcc65d0bc07738bd9f9adcc31d705a13f222f582c86e27ef968fe2602875b796c7c124df43cb5dcf195e5e1f1f53af6cb674461d3054fff1b7c7044a664e184ce8ec95a21330781830e66269f75353b6ff978f417ce9d1ef542a3fd6a911dc75d259e347e62166001ed13928a05fccbfda2dddf3c7557a22724e74ac666f47bc7edcc5c94105d5fa7c3e8da48069a2321ff88d3022e46de9060e79e72cbe6d7df3bd7a27e801d36b08e306b8eb5ca8f0cb0457e2d8cb1db6fec1dea5251c5bcb7d07812e5dd8bdb48797d445df1c22abe8cf47401b663d4db811de75ae1cff59c349901446f3062c8a27a9d1013e83e85f870cea768ca84a3b881bd94f16db64998de82c8974e881d17071f2c092a9b9f86821acc33cafa4d2f56e1a8a46e6a6fbad152a80be5bd92b9cdbe4e858543997d40bde64a2721021cdc7e8a920ffe15f31a6a5e96b710017992fec57cc9958d9310f32159e6e3445387f83e8e84162a5923a4877cfbf68d0ffadf0a1d25eedef488b546622ad2280b0624984427025cd00f978396ad185b0dfecce0c6ae21904dd98d5a62818a3ab5edbcdd1da11216ce62259ec86c89a177005fd4ba706919eac921614979e457b83b748f25cb031eae3d4a30bb72c93cfb5372f9f07fe45ffe488c7c492d464fbab6ee8d252f2167f8d3ef3a9261fbcaa002615e19c728a52385c833d1b7bc946e86850a8306a12bb2d299f12794d1d641c69c5307dfc72dd3f87c2bcbbeb6b59be71cb98b155b9c7879560d96f7f6e4d628cfc6535831a4410fd2dff50ac28d1e8678349bafd39cc5c91a0372e1c1a2d1735160a8efeeb8fae1af7b2872ed059aede69127e566072130834e63fdce3c54dcb52aff65926ae78581462527480ceb7c43fd257c322fef9e67a393616ef629b98b25c27b9b707719e364664b60d99bcdc47f109dca1afa7a1b619f5a1f1e1ea50c46bcb48817af7bf0a24ca8ea4047fd35569b9fcaf4106958cee1209e855b42422a4e47eee1259948266fe50f299c264c955339e25be886f85284c29931c9a0b02e96826223fba5dfff65bc1791f45df7520f0cc93b39eabf45c9e51ba3dfc26d1f6ff0be82fb6ac47996d95c5bf459f173d5922c3d5bd81fb03dd5223f7f55dcee367e4f341fbeaac6aa806c00570136d0282b8c2719daeb94594516399e36fa2e102e91a29c4ab7cac87b5bc46740954fbe7e0d04c6a90ef9b4d2b3952a33093de9e3e16c1819e634f95c9e42661e92397f5852235ec7bea5c6dec83c67f22a46af35be3784f4949f7b2f6beb537ce0c989785e2835626f21796d307c6904d18d2f8731e593102a6cbf402ad83c3151074f73768ae2973ebafd6e3c2b045ffe77c077431a8e41fe6f52d3e656c5f973cd655891ba7ac6079b531f09998a1118e9211d057ab7086684049869b15af6a5f3174e72760d838797fe8efb9411d8938298d9cd77c76c6ed80ed6286f40ae33e5c557dc7a84fcc102a825bb2b008c1cbfe9fc11e1e90c17479100ba2d7c7a9361f2a468dc90306c0baaf3dc0eda34f4aec2ee4525831ca43cd98414a769961f0bd261ba831d446362b4d0dcfb57db065bb80cdc2847c2c67c9a6e9a84eb4e0abcb0f0bd85fa225513e3d3c3773c44baf06e2fcb4fb5e36db986099dc30ec851ba82fcb4097fde2e5cafc1aee85091ca470dd888d83a8f0398d0a4a6de7d742eb4757b928b252f56e8bd94dcd4a6109e4d901f182368b6aacb8c6d395d8bf225799d931cdc277e982802e50f6556de1ce60b49ca75a5dc2bb233d832015b2182435f22c9c80fa80ea98b83e2423501f5baab2773f7c43ab1f3af9f6d9d781926af94a50304585f08dd24481983d19950d3cdee41b5846b8c7679af6cfa8fc4e0a9e09f1a0dbc06105b63b05b4e8daf39798bc8334673624087e94a118219f266faf38b328a862580de7e6b4e7f226fb28e3d79c1e2ecd515dec8573b6c257ca39b65bcf17c8051e6957130a637e500dfe3773957a454000f