安全研究
CVE-2016-3053 IBM AIX 提权漏洞：底层 libc 系统调用的信任缺失
Thinking
2016-11-15
2 分钟阅读
研究档案
#漏洞分析#代码审计#横向移动
IBM AIX 的 libc 在处理某些系统调用时，对调用者的身份校验存在缝隙——本地普通账户只要拿到这个缝隙，就能直接获得 root shell。
Unlock to view this content.
ad8d9422966c73fee42096dad808c6448a272095349f41facc28f3d18d1ee66a0726fb5aaffd9271b6702e0ae53f6961031443030e63d37842b7356b4a67d1f44b648f709f84d99b1640e6f7a87a3d44129b61502fc0c5c728a88c67798e6cfb7bcb30fe880464fad1a2cf9635735fbd6e964b402ea4ed27e494f7c87c72f1c586b333a47062292625ea7240d146fb061f3975a6253d117e97272d7df5aa897fb9fe2c09034f658aae2645a68076992d7d9de07ae63e2fac88f85e475412988dfbca217686cf8f2978cabe69247bf5904a483d846c56d2d17f07c8eaaf27ab80ee4fb68932893be188c9d76dde587158a343cf1042db648c573cd7d659e035717fa8ef6e6f780bdfec4f7a227002e10f45f4ffb8efafcca20ba82fb9d969c84a7f267dae1ff9b059f32fb0abbb9cf9fc826095a7e650959d828046bda0016b2cd9b23d7760e3d719c64727228d7ca54e5d233b6bbe4984ddd75758933e9f4ec982e313d1d3aac84fdd4557972d433a1011305d72b0b8df94a062f38ecc1b2b9f95af4e6e5a9941bb8d6ac175169ed046a1e2a20cae51d6242f3cdfb822df4b3ca9c2ff2e69dbc127f88159f82cf531d067fdf44122957da83ce7faaec8f4fcf0a1c6724f0ec3a0b2d40d2972d99ef3a0c957978e622166f0946bb837a6c7ed7f147a76f6ff2c448fc7df4bc8251face3db014e55748c9b24cea0ea3d73fdab60f70a0a7885e093691050a2a5f1c33d5c24612f7c92df29dee5f671d8acbfd99083f3e7fa3b17066d8b6e7bee087bdec85042866a74c0567936ddb006d92e127afdad8c9d050c321021445e8b73fe1eb6f4d109d6634af1a0f97b604b40373c9aea940ce2cc670f5ec58950ceaf0cd466d8f89610d9cd4a287309d2cba4db905318698b5ee92799f154da8f12994fab0486d5f7518377267da6f6a9ac66c7fabf2f0731a13908d8515a7cfa080b0f63cddb52b37f3b257c07143a20670fba9e9677cee44a7ee0e9dc3cf4683dff8e2ebcd6398c68aa75f59be8ba08ef9fe58548e6a51c3916429e61244509c66a320a8ab156d4da21fd2558b073eaf9857a517c1013b94877544964b6dfe9fb0d3925206c89421a6b4c1acfef33584ab81069d0973a284e6df014251c6c9204bf151d1a22688a2edc66d8dc1eb69614ff7df088d7dcc712176d1268a601a58bd467968290456f42d2fec7815081a2a6c3230b0ab745795d0e8551193d5b0f2e1dec97f3dc4d660118d2652e99dd98154060aaf063001ef7383333b6cd0fe101ee626564a15e508f36ef85f3bbf3e45a1182afd17039bcfb5b77de82d6583a21d3561c7c9ff8eaf9666f35ab6ec969d2baa5ea0987ed762b19c06a4550d5ae1a0cf19fc94c357eba9534343866a4ed58cbc975b416547e2507da1d93719f9056152d00fccb8fa50773745316e2ccd921779aa4cc073c5c0fa4df555f281179252e630b0f4b38095b8834849b3c2894b09109ea4bae47fe2f9cad609c520f40630ffddaa701765ed00f6eacd7c16b63076ce54ccba8dfd7d4b7ddb20a0e92b916f61a8eb6d8c48c633f68e9909c079508a0cb45a32932d9d99c88f37a6058857d5f5f75fff4b4fe0f1950e48f50ef263de683268a11c99624eade83d95600b0f7b58a2feb954e6b757828b32386ee7ef16c0e08fedb307090eb96baa8fc183540e3865393c13b278e9d20113e9b51b57ccdcdbaba0d2c8378537cc066597ff51872999f3d22c127701f371be890621d8f6ec8483afc816f11f6f117e534e3ddb5a335d0ddee677e48737b879d3bf3f69e7a1528770947ce43d0cc5771c7686644a0bee333c289aa6093b831a2f305e6fd2a01c45d960499f04f057b0595adf70376998f34f5b6e9f0c71dbc5766dce832a13fe4869c8a105daf084eafa03118d903a77599c25aa458b908f4389acc6003919f1146200b3b26ebd528f33de806b34d3cd13b1cd7c691a20d31407c7799601f39f59a289afc1565dd8bb6f3f68e1d402957fa3797d00923af7fc27979ccd2b704e50402e08931f2069c817ccb1a2b901e6759565ed4bbcf57a2734b5e0e761961d7a50a322b37aac89fa5af733477c1fd99643ad14a986415bc1ab3ff8dc1a79419a9042a10db5840b38d181a086ca8e451e84776525a0738b2d652d45041b9aa257463e95dcb918d2b9b9cb157972db877d7f49c3a3035aa88dfe2115138de95c602683242f0db729922c54b14cdde4b3a895335ae6997bdcd7b7a5a2be9552f5f5f6670d4f1ca7a43547f4a6c476398de51407a169f899e77f27c340577ca4f33fd93577aed2e6b22168b0a0c575281e7f6f367161dd81e1b94e73f311c424259b1ffc89c44e5014cf8b91aec5d1745c5cc489b667bfdc887c0ff44e6b780f449ba0e66fd032d388e1f243bba484d8ed1eec1087ad2b1d8b4e2a08b05e8fc7e19095c13e505ce6223533ce14fb4a5805bbde10f6395debc8fe84ef72ed8ff243ad7ef606a077db5ccf1a3059f5c51a381fcd1dbe25565e7f70f68ec127bcd41eee3b2fdb967c17574e868de19c83f33179168f54d71bc85faaae5417599aa2f537ab42b1d50d439b0b9c6e16b8fc74011f6c580c10dedb6b609df66d9daa1ae2703743243f59e8af38b4d2544345fe45446e62bd9166601c13bf222aeef9941946a5a92b7bd56491f987fa680eee1bfd8509b0c2e8370c7dde0e271af4de589d17d23118400ed87ca1fc5ffccbf1b5d9d8f77a9ee4ae7e7ab4478242734de18dd0fcb19a80dc8d7c255fd19876e19610bed1dfc8be772c8936731869c2c8ec9753bdf86e5fce4096a3ad87cf77b5de8fc92eb072271eddfe5d37ca791616bd4fb23949f5d4df4c966ba485fb5a2b2464105077566042d54bd011044e2ff9f7b01c07fd97cec6887008218ee9a6608041b493ffaaf7a229fb85d768993eef461e5cdf02491ff10203ba69b8fa0c32109d4451a79ee74bf349f0982d1e8f19444ab1f8a8716d6b84b1cb6dad112a0e38411aea84149fba65ac09a2dd43fe82d3cd7a3e21b215d7d3379e49d7e84e3a06ba3c10898818eb27e21eeace51ae086709d5505ff03d718f712c0371bcb31e7d51df0ad832eca5c620f905d28d0874cc3c62c35688727d81ef944836816268a101f95738e777f0cdca1885ea88573e8c37550fd5b2e915a2589fbb3645f4a87999b31e37266dcd9283d8bc7ea8d90fc2e407938cd809db023c48e69b065b0fd2937ed553c76be8a25229b3984f8a8d980a8c79ef285360613887b5fe1240eba4ab6268d3dd36f518b133d461deab4de99b42accb2d951462b89d23c16cd24f8760a12f925aa14a7d46262279368358d2279971fcce4f19344f0adf6a5c0612d1fbcfc738a6dd3acc28f70d9f1e5df612feb0ae0601d2726d7fa7f10eeab2cfea561f24dd4c50d7fe1c73ea0a1cbe9161e0a3acef7b3fa40cf86e900d7b2066607b3db2e7fb81e984f8d82e0d678c97cfabaeace737fa4ca40ad8387a946a4d2240ec21b822afb64b7ebb42c7b4ce4f1961d029a803f474266b7f0eb911bf06d4ecdb9046ea035ffa99d3799f7e8c78a8688d1e48005b09350694914b6a7f88a27106931fae6faa197e8731e62a4cd854d867d114fb837a62e68df7a401c376db853454a4da5469c167261872a4e139342a6f16a6aac8c210948b0a879db7d46082ee92cc8df09898d79fe79bb60a12ad5f62634753ccfe5fb07b61b155ed76d539e8b8b732a4c3e3bbcbd7fa2550733d9c973039b92af805161dd978b1c273477efe684b1f1c0c80ceeff86a1a58e2fec5cab815ca1c31dff5f02972f1a482262a97275cb0c20c589537710aa9798903a1a0bc1bc399465700ceda0e10524de947661121993afa57808474be7ccf5bd7f998983919f73b668a31a215217c2e9bdad660594b9d8de02c69ae8fbb920f3107064103f460ead61a871557b9bebef1d7a78182eba687c433c0e8756f913776dc81225959d16da4a978b6a2fcf589b76919cefc498fe3f4c7be5d6738df2e9cb352db687464ed185dac18379b86102252e73e853e31bf05a44b50f2ca8d0ecfdf1afc76dde3e9476885c2bc009fecd1f4f572eae821cfd24b2ef74783e9877a8e1310a62a1bc3e60f497c871c6b4fd32a3b5a7cfba46f9393b5fc86f5d488e56b50d28d58b27ac1ddb3508cb24b8276bedc3364fc0d6ee735f7be05eb4a783bd8ef64b1400f7bcf941941cdf37003f9a22e09cbc758d0192a338480032e2af7f250829d1032440392d04be5e052ebeb816cd2b7ec95464f60ed1708c7f2fa196cdbe6f4d0d14b98fe80b6e4f90fe26a1ef6dd599d3503beec0ce91360b523f3b508fcd9d7acd94f95f50d148b1f051d2c0bf5deb076ac2a3c1e195dbaedaf808f1cda2fb51d712929330fbaf0a367533730aabb5c7b93ac69349b16315dd5de96c4041cd6977a36db6023f4a914fa2f94b80b60a8175225a74242cfae0b7c332677bd5344f30264c3db4444d4ec5134801b4dab9354427d4db4b639772b77ceb7d49d0e95fc47e55b53577047c576637a5a77afd5234d917c66c3f340de57ab1e85e7e180e96fe473bc430822be3a8c962ec2cd45f004718979c31182e1a36d5b0a9efe3d35b7a50f3483b154004c199b7600bb50f50d3855e0101970e0f75c2ef2e53ecb3b5a0fc5bd547bdd71285ff9e5a46939bd5fac4f06fb7c8346eaa13548c0240f2ab7241386830e40b7488bd9fadc46d900d002c75128b68baee54302457297709ea15945347853649a6eef5c163163bc5d122beb16457223e59f40ddf090041aa7f373d4be267c42641617f9596f2c7c4094db34c98f7976613e3988d2dc563384486e92445cc8f0fb6aa4a89181e66fba7842d6200c7b1e9c11bb497a9a16a133297086edb411c11d4bd11c25776ac3d81a468d70cdb63a29fee5e4d43fb718eabbd0222dba187db9e83af632c3859f2fdb18b82b4ded0b6800848ec65d3b3be7d7acf92d62ac0a70cb70e46e51ef7fcd8fce2feeabfef7c3974a6ae1c5a788b5586cae4b57935987f91f640ad04453e070ffa3a74ad3bea17c6b2fdce4b60f6d2ae4b42ec46c4e303f8476d8a84c09e354ab0928c770135a8bc958286de4313043cde93fea2f85b4fb687de152d92d3b22d42cecf8bb2d35c5117746af6cd2a9d402f12c16bee02c6c8289a510fff4374f76a6d5775402d9364e78a5179f9dc460599e90c409cc2e96ebf133c0fb535c78ebe2cc88f7e831e0360fe038202e3b262171a005e6d9288259ef7dec31570c6ba446c7b72b2876efb0e4ceb1ec22711d968c338d4ccb3da7646b9570589b3cb739599eecbaa15e59bcbaa33a2ee034ad22cd67c31c89c434be995ff5602f727628180908d21462c25767112becf911c2edafab74341a02e042921423b3295051bec4509fa9d353fd85c4c44a81fd5d259496fb08e0b6d1a3c707c90410b98170f36eff42c263e28f5fe5f980557fc50eea48441ba64b955f7f91ffc60c86808075f5eada589eb9fb16169e2ab7ac9adc0bfeaf18ea4d9ccec149cfc1784496d9bf6558993dac532b52c798919baa2b58fc7e5f2b00adce2819f3328280201c45f291e946ca02b3fa6cc444cde42cebb9d69a6701500afc62b60a1a775b0abd95144c8d8415c85c6847d7d6f4e0aba133d93e8a791d1b89a035b29cdf9def9c87351e85201a82df0245a5b6877d57d07fab2e996e14b5684da2ced5ed708dec3511c9dbaf1b02d7158aa48f5cbee9a95842e79e9c5af3f3765fd2b5169f1f58c0b80462cf8815544aad9a6f2cf8c617904fc351635ac880ce75fcc271f456a7696e6e8cfd512ea0155b6cb8e4fafbd89594ba1f61edc5329a7b690e9c614f04c0a8bbfe5ce1b7ed095d275b49b5b81fb8b9a9c1706b8a9304150eeee4d60bd302c30289c96a571d016987335d437ec3987c4d7b6f3ab9589489b1b4894e35d2a8cc4e8ecd27fc34fd95064620ba16f0fbb04a277cce742b89f0901223bc579e2ccb4dab8bba2a165f65cbab8f22ec4cf1aadba92ee2282254a3e7147b685b5da7a11db9baf7a93b79b9a7fb518871058d80483312a811ccb0a5d3d9f333d2e9898e6ed0a86c38e363f724b1d4591c2c576cde715ad51ae1ee7111a4cdb79ddafbb2d0a094c99a41cc9fe6f571693b8f55864802059a1497d3d59ea2131824d97fd7809eaa40c6d5018c76ed2ded3024c18239923d1651c51750443a3c8787a6152b895fba9903702e13b7a37faf512e90f260fcd03d0091b3109e2991f426227220e209419f4db2cf47f7b896e348726102b5244776e77bf42c20d09242c3bc351c89fd0f7bc8a8a126600058635a32905c7e1bb655175abf9d66c4dde6181556d260f041ac8512d87068eb53e16e9bad0f7da11b11b65f67e852197af861e02fb8aae6471208aa6ec93da9b77c79f332edccf6e7ad3510ec9fa5760ece97f9aedb042a895505cb430037d393082f9e74ae1dd82fc7d81c3c29a0af22b1b04658ac7be287be0daa5729f4dc1840809d9ce1aaf7174309570b4b733bfed50222ad6ec2f4e04dafb3e2a54b08cb5c1edd51ff7698aca5f9959d0a937f0dd9d14bc5ee259d9a05e63a04aeb30fe28d1a38d9bfc0369550bf4a194ad727cc5641779bf41b5427ed139087e729ea3d7af