Full Report
A CLOCK_THREAD_CPUTIME_ID timer is used for measuring the amount of CPU time consumed by a thread. A timer will be armed once timer_settime is called. After the set amount of time, a signal is sent to the thread, indicating that time is up. The Linux kernel implements this feature by tiking a k_itimer structure into a doubly-linked list of all the timers. The elements in the list are constantly checked to see if it's time to expire, firing the signal. When calling execve, the kernel will free all of the timers associated with a process, except the global structure of posix_cputimers. Practically, this means that if the timer is already armed before execve the kernel will free the timer while still maintaining the reference in the doubly linked list. This creates a dangling pointer situation. Later, when the timer is set to go off, it will trigger a use after free situation on the object, then free it, creating a double free. The author includes a full exploit in their code. From reading the code, it appears that they are spraying objects to go into the place of the timer to trigger a free on the target object. By doing a page spray (lower level than a heap allocator) with sockets. By freeing this, they are able to get a two leaks. After knowing this information, they leak a msg_msg object with the same strategy as before but only with msgq objects. Finally, they use this to get a KASLR leak. Once they know where everything is located, they trigger the bug again but keep a reference to the timer object with a separate allocation - use after free. They write to the timer with a separate and improper allocation to get an arbitrary write primitive. They use this to overwrite the modprobe path to allow for the loading of arbitrary kernel modules. Code execution gained! Overall, a good description of the bug but nothing on the POC. The POC does have good comments though, which makes it possible to read.
Analysis Summary
# Vulnerability: Linux Kernel CLOCK_THREAD_CPUTIME_ID Local Privilege Escalation
## CVE Details
- **CVE ID:** CVE-2022-2585
- **CVSS Score:** 7.8 (High)
- **CWE:** CWE-416 (Use After Free), CWE-667 (Improper Locking / Race Condition)
## Affected Systems
- **Products:** Linux Kernel
- **Versions:** Vulnerable up to version 5.19 (specifically identified in 5.15.0-37/39/40-generic).
- **Configurations:** Systems utilizing POSIX CPU timers where a process creates a `CLOCK_THREAD_CPUTIME_ID` timer and subsequently calls `execve`.
## Vulnerability Description
The vulnerability is a Use-After-Free (UAF) flaw located in the POSIX CPU timer component. When a thread creates a `CLOCK_THREAD_CPUTIME_ID` timer and arms it via `timer_settime`, the kernel links a `k_itimer` structure into a doubly-linked list within `struct posix_cputimers`.
If the thread calls `execve`, the kernel executes `exit_itimers`, which frees the timer structures. However, it fails to remove the references from the `posix_cputimers` doubly-linked list. This results in a dangling pointer. When the timer eventually expires, the kernel traverses the list and attempts to access/operate on the freed object, leading to a UAF and a subsequent double-free condition.
## Exploitation
- **Status:** PoC Available (Full exploit code published).
- **Complexity:** Medium to High (Requires sophisticated heap grooming and spraying).
- **Attack Vector:** Local.
The exploit uses a multi-stage approach:
1. **Race/Trigger:** Arms a timer and calls `execve` to create the dangling pointer.
2. **Memory Spraying:** Uses a low-level "page spray" with sockets to occupy the freed memory.
3. **Information Leak:** Leverages `msg_msg` objects and `msgq` to bypass KASLR and leak kernel addresses.
4. **Arbitrary Write:** Triggers the bug again, using a separate allocation to gain a write primitive.
5. **Root Escalation:** Overwrites the `modprobe_path` to point to a malicious binary, allowing execution of arbitrary kernel modules with root privileges.
## Impact
- **Confidentiality:** High (Ability to read kernel memory).
- **Integrity:** High (Arbitrary kernel write and root access).
- **Availability:** High (Kernel panic/System crash potential).
## Remediation
### Patches
- The Linux Kernel team has released patches addressing the reference counting and cleanup logic in POSIX timers.
- **Reference:** [https://seclists.org/oss-sec/2022/q3/116](https://seclists.org/oss-sec/2022/q3/116)
### Workarounds
- No specific software workarounds are provided; users are encouraged to update to a patched kernel version immediately.
## Detection
- **Indicators of Compromise:** Presence of unexpected binaries being triggered via `modprobe`, or crashes (Kernel Oops) related to `check_thread_timers` or `collect_posix_cputimers`.
- **Detection methods:** Monitoring for unusual `execve` calls following `timer_settime` operations using auditd or eBPF-based security tools.
## References
- **SSD Advisory:** [https://ssd-disclosure.com/ssd-advisory-linux-clock_thread_cputime_id-lpe/](https://ssd-disclosure.com/ssd-advisory-linux-clock_thread_cputime_id-lpe/)
- **Exploit Video:** [https://www.youtube.com/watch?v=e1kb2u4SlvM](https://www.youtube.com/watch?v=e1kb2u4SlvM)