BlackSnufkin
32 lines
1.1 KiB
Plaintext
32 lines
1.1 KiB
Plaintext
rule Linux_Exploit_CVE_2021_3490_d369d615 {
|
|
meta:
|
|
author = "Elastic Security"
|
|
id = "d369d615-d2a3-4f9d-b5c7-eb0fac5d43e7"
|
|
fingerprint = "4f8f4c7fabe32a023f8aafb817e2c27c5a5e0e9246ddccacf99a47f2ab850014"
|
|
creation_date = "2021-11-12"
|
|
last_modified = "2022-01-26"
|
|
threat_name = "Linux.Exploit.CVE-2021-3490"
|
|
reference_sample = "e65ba616942fd1e893e10898d546fe54458debbc42e0d6826aff7a4bb4b2cf19"
|
|
severity = 100
|
|
arch_context = "x86"
|
|
scan_context = "file, memory"
|
|
license = "Elastic License v2"
|
|
os = "linux"
|
|
strings:
|
|
$c1 = "frame_dummy_init_array_entry"
|
|
$c2 = "leak_oob_map_ptr"
|
|
$c3 = "overwrite_cred"
|
|
$c4 = "obj_get_info_by_fd"
|
|
$c5 = "kernel_write_uint"
|
|
$c6 = "search_init_pid_ns_kstrtab"
|
|
$c7 = "search_init_pid_ns_ksymtab"
|
|
$msg1 = "failed to leak ptr to BPF map"
|
|
$msg2 = "preparing to overwrite creds..."
|
|
$msg3 = "success! enjoy r00t"
|
|
$msg4 = "Useage: %s <path to program to execute as root>"
|
|
$msg5 = "searching for init_pid_ns in ksymtab"
|
|
condition:
|
|
4 of them
|
|
}
|
|
|