Method and system for checking encapsulating security payload same address overwrite privilege escalation vulnerability

Abstract

The application relates to the technical field of network security, and provides a method and system for checking an encapsulation security payload (ESP) same address overwrite privilege escalation vulnerability, which comprises the following steps: executing a user mode test program to construct a target data packet and send the target data packet to a kernel for decryption operation to obtain an operation return result; when a target function is called in the kernel decryption process, an extended Berkeley packet filter (eBPF) loaded into the kernel is used to capture a stack frame address of a corresponding running function stack and write the stack frame address into an eBPF mapping table (Maps); a user mode monitoring program reads the stack frame address in the eBPF Maps, finds a function symbol table of a compiled kernel, obtains a corresponding function name and stack mapping relationship, and combines the operation return result to obtain a vulnerability verification result. The application can quickly check whether a host system of a vulnerability scanning platform, a threat perception platform and a threat intelligence system has the ESP same address overwrite privilege escalation vulnerability, and can understand system risks before deployment.

Description

Technical Field

[0001] This invention relates to the field of network security technology, and in particular to a method and system for investigating privilege escalation vulnerabilities caused by co-address overwriting of encapsulated security payloads. Background Technology

[0002] Existing vulnerability scanning platforms, threat awareness platforms, and threat intelligence systems are typically deployed in a distributed manner on virtualized clusters based on open-source communities. Because these systems can only rely on existing technologies on a large scale and have blind trust in the host virtualized system, they lack independent verification capabilities for underlying protocols such as the physical layer and data link layer, including Internet Protocol Security (IPSec) protocol decryption and Authenticated Encryption with Associated Data (AEAD). As a result, their operational stability and data security are difficult to guarantee fundamentally.

[0003] Currently, virtualization systems, in order to reduce memory copy overhead when handling IPSec protocol decryption and AEAD calculations, have introduced an in-place decryption branch. This means directly reusing the receive buffer passed in by the user via the splice zero-copy mechanism as the decryption output target. Under this logic, the system directly maps the buffer associated with the user-space message iterator to a kernel-writable dst hash table (scatterlist), and links it to the page cache containing authentication labels. Then, it calls the corresponding core decryption function crypto_authenc_esn_decrypt of the IPSec protocol to directly perform decryption, signature verification, and sequence number processing operations on the target buffer.

[0004] However, the lack of rigorous verification of the memory mapping source and permissions leads to a serious in-place overwrite privilege escalation vulnerability in the encapsulated security payload. In in-place optimization mode, the code does not intercept the read-only file page passed in by splice zero-copy, and directly uses it as a writable dst buffer. When the crypto_authenc_esn_decrypt function is executed, it attempts to write serial number data out of bounds to the end of the dst buffer. Since dst actually points to the protected read-only file page cache, this out-of-bounds overwrite will corrupt the read-only file. Attackers can exploit this flaw to achieve superuser privilege escalation through simple user-level calls, thereby paralyzing or leaking data from the entire vulnerability scanning platform, threat awareness platform, and threat intelligence system. Summary of the Invention

[0005] This invention provides a method and system for investigating encapsulated security payload co-address overwrite privilege escalation vulnerabilities. It addresses the shortcomings of existing technologies that cannot quickly investigate whether a host virtualization system has encapsulated security payload co-address overwrite privilege escalation vulnerabilities before system deployment. This invention enables rapid investigation of host systems of vulnerability scanning platforms, threat awareness platforms, and threat intelligence systems to identify security payload co-address overwrite privilege escalation vulnerabilities before deployment, allowing for understanding system risks and preventing problems before they occur.

[0006] This invention provides a method for investigating a privilege escalation vulnerability involving encapsulated security payload co-address overwrite, comprising: executing a user-mode test program to construct a target data packet and send it to the kernel for decryption, obtaining the operation return result; when the kernel calls the target function during decryption, using the extended Berkeley Packet Filter (eBPF) loaded into the kernel, capturing the stack frame address of the corresponding running function stack, and writing the stack frame address into the eBPF mapping table Maps; reading the stack frame address in eBPF Maps through a user-mode monitoring program, and searching the function symbol table of the compiled kernel to obtain the corresponding function name and stack mapping relationship; the function symbol table of the compiled kernel is pre-obtained based on the debugging compilation of the target module of the kernel; and determining whether a vulnerability attack surface exists based on the operation return result and the obtained function name and stack mapping relationship, thereby obtaining the vulnerability verification result.

[0007] According to the present invention, a method for investigating a privilege escalation vulnerability involving encapsulated security payload co-address overwrite is provided. This method executes a user-mode test program to construct a target data packet and send it to the kernel for decryption, obtaining the operation return result. The method includes: creating an algorithm socket and setting the key and initialization vector IV of the algorithm socket; binding the algorithm socket to a preset authentication encryption algorithm; constructing a target data packet containing associated data, ciphertext, and authentication tags; and passing the target data packet to the algorithm socket to trigger the kernel to call the corresponding function to perform decryption and integrity verification operations on the target data packet, obtaining the operation return result.

[0008] According to the present invention, a method for investigating encapsulated security payload co-address overwrite privilege escalation vulnerabilities is provided, which constructs a target data packet containing associated data, ciphertext, and authentication tags, including: constructing invalid authentication tag data so that the kernel fails the authentication check when performing decryption verification; wherein, the invalid authentication tag data is used to trigger the kernel to return an invalid message error code, while retaining the memory operation traces during the decryption process; and concatenating the associated data, ciphertext, and invalid authentication tag data in a preset order to generate the target data packet.

[0009] According to the present invention, a method for investigating a co-address overwrite privilege escalation vulnerability of a security payload is provided. The method involves passing a target data packet to an algorithm socket to trigger a kernel call to the corresponding function, performing decryption and integrity verification operations on the target data packet, and obtaining an operation return result. The method includes: sending the target data packet to the request file descriptor corresponding to the algorithm socket via a message sending interface, and passing decryption operation parameters; detecting the execution status of the message sending interface; based on the execution status, if the message sending interface returns successfully or returns an invalid message error code, determining that the kernel has entered the in-place decryption branch and executed the in-place decryption SGL multiplexing logic, thus identifying a vulnerability attack surface as the operation return result; and based on the execution status, if the message sending interface returns an error code other than an invalid message error code, determining that the kernel decryption path is blocked, thus identifying no vulnerability attack surface as the operation return result.

[0010] According to the present invention, a method for investigating encapsulated security payload co-address overwrite privilege escalation vulnerabilities involves reading stack frame addresses from eBPF Maps using a user-mode monitoring program and searching the function symbol table of the compiled kernel to obtain the corresponding function names and stack mapping relationships. The method includes: reading stack frame addresses from eBPF Maps using a user-mode monitoring program; determining the address randomization offset during kernel loading and converting the read stack frame addresses into logical offset addresses using the address randomization offset; searching for matching function entries in the function symbol table of the compiled kernel based on the logical offset addresses, and generating a stack mapping relationship containing function names based on the matching function entries.

[0011] According to the present invention, a method for investigating encapsulated security payload co-address overwrite privilege escalation vulnerabilities determines whether a vulnerability attack surface exists based on the operation return result and the obtained function name and stack mapping relationship, and obtains a vulnerability verification result. The method includes: determining whether a target function is included based on the function name and stack mapping relationship; when the operation return result determines that a vulnerability attack surface exists, or when it determines that a target function is included, taking the existence of a vulnerability attack surface in the kernel as the vulnerability verification result; when the operation return result determines that no vulnerability attack surface exists and that no target function is included, taking the absence of a detected vulnerability attack surface as the vulnerability verification result.

[0012] According to the present invention, a method for investigating a co-address overwrite privilege escalation vulnerability of a security payload is provided. The method determines whether a target function is included based on the function name and stack mapping relationship, including: determining whether a target function is included based on the function name to obtain a first judgment result; determining whether a target function is included in the stack mapping relationship to obtain a second judgment result; determining that a target function is included when at least one of the first and second judgment results indicates that a target function is included; and determining that a target function is not included when both the first and second judgment results indicate that a target function is not included.

[0013] According to the present invention, a method for investigating a co-address overwrite privilege escalation vulnerability of a security payload is provided. Before searching the function symbol table of the compiled kernel, the method includes: obtaining the source code of the target module of the kernel; debugging and compiling the source code of the target module to obtain the binary file of the compiled kernel; and adding the function symbol table corresponding to the target module to the binary file of the compiled kernel to obtain the function symbol table of the compiled kernel.

[0014] According to the present invention, a method for investigating a privilege escalation vulnerability involving encapsulated security payload co-address overwrite is provided. When a target function is called during kernel decryption, the extended Berkeley Packet Filter (eBPF) loaded into the kernel is used to capture the stack frame address of the corresponding running function stack and write the stack frame address into the eBPF mapping table (Maps). The method includes: when a target function is called during kernel decryption, the extended Berkeley Packet Filter (eBPF) is used to read the current processor's stack register and obtain multiple return addresses on the function stack as stack frame addresses; wherein, the eBPF is pre-mounted to the entry or exit location of the target function in the kernel; and the stack frame address is written into the eBPF mapping table (Maps) for polling and reading by the user-mode monitoring program.

[0015] This invention also provides a system for investigating encapsulated security payload co-address overwrite privilege escalation vulnerabilities, comprising: a program execution module, which executes a user-mode test program to construct a target data packet and send it to the kernel for decryption, obtaining the operation return result; an address capture module, which, when the kernel calls the target function during decryption, uses the extended Berkeley Packet Filter (eBPF) loaded into the kernel to capture the stack frame address of the corresponding running function stack and writes the stack frame address into the eBPF mapping table Maps; a symbol resolution module, which reads the stack frame address in the eBPF Maps through a user-mode monitoring program and searches the function symbol table of the compiled kernel to obtain the corresponding function name and stack mapping relationship; the function symbol table of the compiled kernel is obtained in advance based on the debugging compilation of the target module of the kernel; and a result determination module, which determines whether there is a vulnerability attack surface based on the operation return result and the obtained function name and stack mapping relationship, obtaining the vulnerability verification result.

[0016] The present invention also provides an electronic device, including a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein when the processor executes the computer program, it implements the method for detecting encapsulated security payload co-address overwrite privilege escalation vulnerabilities as described above.

[0017] The present invention also provides a non-transitory computer-readable storage medium having a computer program stored thereon, which, when executed by a processor, implements the method for investigating encapsulated security payload co-address overwrite privilege escalation vulnerabilities as described above.

[0018] The present invention also provides a computer program product, including a computer program, which, when executed by a processor, implements the method for investigating encapsulated security payload co-address overwrite privilege escalation vulnerabilities as described above.

[0019] The present invention provides a method and system for investigating encapsulated security payload co-address overwrite privilege escalation vulnerabilities. This method constructs a target data packet by executing a user-mode test program and sends it to the kernel to trigger a decryption operation and obtain the operation's return result, thereby establishing an external observation basis for vulnerability verification. During this process, the stack frame address of the function stack is captured and written to the eBPF loaded into the kernel. Maps enables real-time tracking and data extraction of target function calls during kernel decryption. Next, a user-mode monitoring program reads stack frame addresses and searches the compiled kernel's function symbol table, resolving the captured addresses into specific function names and stack mappings, thus giving runtime data explicit semantics. Finally, the system combines the operation return results with the function names and stack mappings for judgment, allowing it to simultaneously confirm whether the target function has been called based on interface feedback and the internal function execution path status. This multi-verification mechanism, combining external triggering, internal stack monitoring, and symbol table resolution, quickly checks whether the host systems of vulnerability scanning platforms, threat awareness platforms, and threat intelligence systems have security payload co-address overwriting privilege escalation vulnerabilities. It more accurately reflects the execution status of the target code path, ensuring the accuracy of the final vulnerability verification results and enabling understanding of system risks before deployment, thus preventing problems before they occur. Attached Figure Description

[0020] To more clearly illustrate the technical solutions in this invention or the prior art, the drawings used in the description of the embodiments or the prior art will be briefly introduced below. Obviously, the drawings described below are some embodiments of this invention. For those skilled in the art, other drawings can be obtained from these drawings without creative effort.

[0021] Figure 1 This is one of the flowcharts illustrating the method for investigating the encapsulated security payload co-address overwrite privilege escalation vulnerability provided by the present invention; Figure 2 This is the second flowchart illustrating the method for investigating the encapsulated security payload co-address overwrite privilege escalation vulnerability provided by the present invention; Figure 3 This is a schematic diagram of the structure of the encapsulated security payload co-address overwrite privilege escalation vulnerability investigation system provided by the present invention; Figure 4 This is a schematic diagram of the structure of the electronic device provided by the present invention. Detailed Implementation

[0022] To make the objectives, technical solutions, and advantages of this invention clearer, the technical solutions of this invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some, not all, of the embodiments of this invention. All other embodiments obtained by those skilled in the art based on the embodiments of this invention without creative effort are within the scope of protection of this invention.

[0023] Figure 1 This is a flowchart illustrating the method for investigating the encapsulated security payload co-address overwrite privilege escalation vulnerability provided by the present invention, as shown below. Figure 1 As shown, the method includes the following: S11, execute the user-space test program to construct the target data packet and send it to the kernel for decryption, and obtain the operation return result; S12, when the target function is called during kernel decryption, the extended Berkeley packet filter (eBPF) loaded into the kernel is used to capture the stack frame address of the corresponding running function stack and write the stack frame address into the eBPF mapping table Maps. S13, the user-mode monitoring program reads the stack frame address in the eBPF Maps and looks up the function symbol table of the compiled kernel to obtain the corresponding function name and stack mapping relationship; the function symbol table of the compiled kernel is obtained in advance based on the debugging compilation of the kernel's target module; S14. Based on the operation return result and the obtained function name and stack mapping relationship, determine whether there is a vulnerability attack surface and obtain the vulnerability verification result.

[0024] It should be noted that the following will be combined with specific details. Figure 2 This invention describes a method for detecting encapsulated security payload co-address overwrite privilege escalation vulnerabilities.

[0025] Step S11: Execute the user-space test program to construct the target data packet and send it to the kernel for decryption, and obtain the operation return result.

[0026] In this embodiment, a user-space test program is executed to construct a target data packet and send it to the kernel for decryption, obtaining the operation return result. This includes: creating an algorithm socket and setting the key and initialization vector IV of the algorithm socket, and binding the algorithm socket to a preset authentication encryption algorithm; constructing a target data packet containing associated data, ciphertext, and authentication tags, and passing the target data packet to the algorithm socket to trigger the kernel to call the corresponding function to perform decryption and integrity verification operations on the target data packet, obtaining the operation return result.

[0027] It should be noted that by constructing a target data packet containing associated data, ciphertext, and authentication tags, and by setting a key, initialization vector IV, and binding a preset authentication encryption algorithm, a complete encryption / decryption request scenario can be simulated. This ensures that the data passed to the kernel has the complete parameters and context required for decryption and integrity verification, thus preventing the kernel logic from being interrupted before execution due to missing parameters or incorrect format, and ensuring that the decryption process can smoothly enter the core processing stage. Furthermore, by passing the target data packet to the algorithm socket, the kernel's interface mechanism is used to reliably trigger the call to the corresponding decryption function. This process transforms the externally constructed data input into the kernel's internal function call behavior, enabling the system to obtain operation return results reflecting the actual execution status of the target code path by performing decryption and integrity verification operations. This provides accurate triggering basis and real execution feedback for subsequent vulnerability investigation based on operation return results, improving the effectiveness of vulnerability investigation.

[0028] It should be added that the algorithm interface address family of the algorithm socket is AF_ALG, the raw socket type is SOCK_RAW, and the protocol number is 0, which is the default protocol. Specifically, creating an algorithm socket includes: using the algorithm interface address family AF_ALG, the raw socket type SOCK_RAW, and the default protocol to create the algorithm socket; if creation fails, for example, if the kernel has not compiled or loaded the authentication encryption algorithm interface (algif_aead) module with associated data, an operating system error (OSError) exception will be caught, the error will be printed, and False will be returned.

[0029] In addition, the preset authentication encryption algorithm can be bound according to actual design requirements. For example, Authenticated Encryption with Associated Data (AEAD) binds the created algorithm socket to the AEAD algorithm in the kernel. The bind call will find and prepare the algorithm instance; if the binding fails (e.g., the kernel does not support the algorithm), the algorithm socket will be closed and False will be returned.

[0030] In addition, when setting the key and initialization vector IV of the algorithm socket, since they are test data and do not necessarily have to be valid, you can set a 16-byte key with zero weight and a 12-byte initialization vector IV, and set the key and initialization vector IV to the algorithm socket by setting the socket option (setsockopt) for subsequent decryption operations.

[0031] Furthermore, a file descriptor is created in the algorithm socket to handle the actual decryption request.

[0032] In addition, the target data packet is passed to the algorithm socket through a splicing mechanism, so as to trigger the kernel to perform decryption operation by using the message sending interface.

[0033] Specifically, constructing a target data packet containing associated data, ciphertext, and authentication labels includes: constructing invalid authentication label data so that the kernel cannot pass the authentication check when performing decryption verification; wherein, the invalid authentication label data is used to trigger the kernel to return an invalid message error code, while retaining the memory operation traces during the decryption process; and concatenating the associated data, ciphertext, and invalid authentication label data in a preset order to generate the target data packet.

[0034] It should be noted that by constructing invalid authentication tag data, the kernel fails the authentication check due to data mismatch during decryption verification. This failure triggers the kernel to return an invalid message error code, providing a clear verification failure feedback signal for the troubleshooting process. Simultaneously, this invalid authentication tag data retains memory operation traces during the decryption process even when authentication fails, meaning that the memory read / write state during the decryption phase is not completely erased due to verification failure. Finally, by concatenating the associated data, ciphertext, and invalid authentication tag data in a preset order to generate the target data packet, it is ensured that the data packet structure can be correctly parsed by the kernel and executed to the verification stage. Furthermore, the characteristics of the invalid tag are utilized to simultaneously obtain error code feedback and memory operation traces, allowing the test to more comprehensively reflect the execution state of the decryption logic under specific abnormal inputs.

[0035] For example, the specific implementation process of constructing the target data packet includes: defining the associated data (AAD) as the byte string "TEST_AAD_DATA", i.e., aad = b"TEST_AAD_DATA"; defining the ciphertext data as a specific hexadecimal byte sequence, cipher = b"\x11\x22\x33\x44\x55\x66\x77\x88"; and defining the authentication tag as a byte string consisting of the hexadecimal value "0xaa" repeated 16 times, i.e., tag = b"\xaa". 16; The above-mentioned associated data, ciphertext data and authentication tag are concatenated in sequence to generate the target data packet for sending: packet = aad + cipher + tag.

[0036] Furthermore, the method also includes: a splicing pipe, which is used to splice the page buffered simulated input; writing the constructed target data packet to the write end of the pipe, and then closing the write end, so that the read end rpipe contains complete data that can be used for subsequent operations.

[0037] Additionally, the target data packet is passed to the algorithm socket to trigger the kernel to call the corresponding function, perform decryption and integrity verification operations on the target data packet, and obtain the operation return result, including: sending the target data packet to the request file descriptor corresponding to the algorithm socket through the message sending interface and passing the decryption operation parameters; detecting the execution status of the message sending interface; based on the execution status, if the message sending interface returns successfully or returns an invalid message error code, it is determined that the kernel has entered the in-place decryption branch and executed the in-place decryption SGL multiplexing logic, and the existence of a vulnerability attack surface is determined as the operation return result; based on the execution status, if the message sending interface returns an error code other than the invalid message error code, it is determined that the kernel decryption path is blocked, and the absence of a vulnerability attack surface is determined as the operation return result.

[0038] It should be noted that by sending the target data packet to the request file descriptor and passing decryption operation parameters through the message sending interface, the system call mechanism is used to accurately interact with the kernel, thereby triggering the execution of the corresponding processing function inside the kernel. Then, by detecting the execution status of the message sending interface, direct feedback reflecting the internal processing logic of the kernel is obtained. Based on this, fine-grained distinctions are made according to different types of execution status. When it is determined that the message sending interface has successfully returned or returned an invalid message error code, it is determined that the kernel has entered the in-place decryption branch and executed the in-place decryption SGL multiplexing logic, thus confirming the existence of a vulnerability attack surface. When it is determined that other error codes besides invalid message error codes are returned, it is determined that the decryption path is blocked, thus confirming that there is no vulnerability attack surface. Thus, through this differentiated judgment logic based on the interface execution status, the system can accurately identify the specific execution path inside the kernel, thereby effectively determining the existence of vulnerabilities and achieving precise vulnerability status investigation.

[0039] Additionally, during kernel decryption, the kernel calls functions such as AEAD message receiving (aead_recvmsg) in the source code file (crypto / algif_aead.c) of the AEAD module of the cryptographic subsystem / algorithm interface. If the vulnerability exists, the kernel will enter an incorrect in-place decryption path when processing the target data packet, causing the Scatter-Gather List (SGL) to be incorrectly reused; SGL represents a memory management structure used to describe non-contiguous blocks of memory.

[0040] Furthermore, after receiving the operation return result, the process includes: closing the pipe read end, request descriptor, and main socket, releasing resources, and returning the operation return result.

[0041] Step S12: When the target function is called during kernel decryption, the extended Berkeley packet filter (eBPF) loaded into the kernel is used to capture the stack frame address of the corresponding running function stack and write the stack frame address into the eBPF mapping table Maps.

[0042] In this embodiment, when the target function is called during kernel decryption, the extended Berkeley Packet Filter (eBPF) loaded into the kernel is used to capture the stack frame address of the corresponding running function stack and write the stack frame address into the eBPF mapping table (Maps). This includes: when the target function is called during kernel decryption, the extended Berkeley Packet Filter (eBPF) reads the current processor's stack register and obtains multiple return addresses on the function stack as stack frame addresses; wherein, the eBPF is pre-mounted to the entry or exit location of the target function in the kernel; and the stack frame address is written into the eBPF mapping table (Maps) for polling and reading by the user-mode monitoring program.

[0043] It should be noted that by pre-mounting eBPF to the entry or exit point of the kernel target function, the eBPF program can be triggered immediately when the kernel calls the target function during decryption, thus ensuring precise synchronization between monitoring behavior and target function execution. Furthermore, by using eBPF to read the current processor's stack registers, multiple return addresses on the function stack can be directly obtained as stack frame addresses, thereby accurately reconstructing the function call chain. Subsequently, by writing the stack frame addresses into the eBPF mapping table (Maps), a data sharing channel between kernel mode and user mode is established. Finally, in conjunction with the user-mode monitoring program's polling and reading of the eBPF mapping table (Maps), the stack frame addresses generated during kernel execution are transmitted to user mode in real time, thereby accurately and timely obtaining the context information of the kernel function's runtime, providing reliable data for subsequent analysis of whether the target function has been called.

[0044] Furthermore, eBPF Maps are created in advance in kernel space.

[0045] Step S13: The stack frame address in eBPF Maps is read by the user-mode monitoring program, and the function symbol table of the compiled kernel is searched to obtain the corresponding function name and stack mapping relationship; the function symbol table of the compiled kernel is obtained in advance based on the debugging compilation of the target module of the kernel.

[0046] In this embodiment, the stack frame addresses in the eBPF Maps are read by a user-mode monitoring program, and the corresponding function names and stack mapping relationships are obtained by searching the function symbol table of the compiled kernel. This includes: reading the stack frame addresses in the eBPF Maps by the user-mode monitoring program; determining the address randomization offset when the kernel is loaded, and converting the read stack frame addresses into logical offset addresses using the address randomization offset; searching for matching function entries in the function symbol table of the compiled kernel based on the logical offset addresses, and generating stack mapping relationships containing function names based on the matching function entries.

[0047] It should be noted that the kernel runtime capture data is obtained by reading the stack frame addresses in the eBPF Maps through the user-mode monitoring program. By determining the address randomization offset during kernel loading and converting the read stack frame addresses into logical offset addresses, the impact of dynamic changes caused by address randomization is effectively eliminated, allowing dynamic addresses at runtime to be transformed into stable, indexable logical addresses. Then, based on the logical offset addresses, matching function entries are searched in the function symbol table of the compiled kernel, ensuring accurate location of the corresponding functions in the static symbol information. Finally, based on the matching function entries, a stack mapping relationship containing function names is generated, transforming the originally abstract numerical addresses into function call information with clear semantics, thereby achieving accurate parsing of the kernel execution flow.

[0048] In one optional embodiment, before searching the function symbol table of the compiled kernel, the process includes: obtaining the source code of the target module of the kernel; debugging and compiling the source code of the target module to obtain the binary file of the compiled kernel; and adding the function symbol table corresponding to the target module to the binary file of the compiled kernel to obtain the function symbol table of the compiled kernel.

[0049] It should be noted that by obtaining the source code of the target module of the kernel, basic data is provided for generating debugging information. By debugging and compiling the source code of the target module, a compiled kernel binary file containing detailed debugging information is generated. Based on this, the function symbol table of the final compiled kernel is constructed by adding the function symbol table corresponding to the target module to this binary file. This ensures that the function symbol table contains function names and address mapping information that precisely correspond to the actual running kernel binary file. This provides complete and accurate data for subsequent steps to find matching function entries, ensuring the effectiveness of subsequent stack frame address resolution.

[0050] In addition, due to the security payload co-address overwrite privilege escalation vulnerability, the network protocol stack is vulnerable to the submission of several files such as crypto / authencesn.c, crypto / algif_aead.c, and fs / splice.c. Therefore, when verifying whether the system has the above defects, it is necessary to debug and compile the relevant kernel modules. Thus, the target module can be specified based on actual needs and prior experience, and no further restrictions are made here.

[0051] Furthermore, the compiled kernel coexists with the original kernel in memory space and runs as a mirror image, communicating through eBPF slots. The symbol table and stack mapping corresponding to its runtime stack are reflected in the function tables of the corresponding functions in the compiled kernel. Since the kernel is not a process, tracking the logical memory offsets of kernel modules needs to be reflected in the new kernel's function tables in the form of eBPF semaphores to confirm whether the relevant functions have been called.

[0052] In an optional embodiment, before obtaining the function symbol table of the compiled kernel, the process includes: installing dependent environments. Specifically, a separate Python environment is installed in the virtualization environment so as not to interfere with the original Python environment in the original system, thereby building a runnable Python environment that is independent of the original environment. This allows for the simulation of one process deeply penetrating another and inter-process communication. Since we do not know whether the original system has a security payload co-address overwrite privilege escalation vulnerability, it is necessary to create an independent payload process outside the original process, making its memory independent of the application process.

[0053] Step S14: Based on the operation return result and the obtained function name and stack mapping relationship, determine whether there is a vulnerability attack surface and obtain the vulnerability verification result.

[0054] In this embodiment, based on the operation return result and the obtained function name and stack mapping relationship, it is determined whether a vulnerability attack surface exists, and a vulnerability verification result is obtained. This includes: determining whether a target function is included based on the function name and stack mapping relationship; when it is determined that a vulnerability attack surface exists based on the operation return result, or when it is determined that a target function is included, the existence of a vulnerability attack surface in the kernel is taken as the vulnerability verification result; when it is determined that no vulnerability attack surface exists based on the operation return result, and when it is determined that no target function is included, the absence of a detected vulnerability attack surface is taken as the vulnerability verification result.

[0055] It should be noted that by determining whether the target function is included based on the function name and stack mapping relationship, the actual running state of the key function can be confirmed from the internal level of the code execution path. Then, the function call situation and operation return results are combined for comprehensive judgment, so that vulnerability verification no longer relies on data from a single dimension.

[0056] Specifically, when the operation return result determines that a vulnerability attack surface exists or that a target function is included, a vulnerability is determined to exist. This fully utilizes the complementarity between interface feedback and stack trace information. As long as either dimension shows vulnerability characteristics, it can be confirmed, avoiding false negatives due to the failure of a single detection method. At the same time, when the operation return result determines that no vulnerability attack surface exists and that a target function is not included, a vulnerability is determined not to be detected. This ensures that a security conclusion is drawn only when both interface feedback and internal stack information confirm no risk, thus guaranteeing the rigor and accuracy of vulnerability verification results.

[0057] Further, based on the function name and stack mapping relationship, it is determined whether the target function is included, including: determining whether the target function is included based on the function name to obtain a first judgment result; determining whether the target function is included in the stack mapping relationship to obtain a second judgment result; determining that the target function is included when at least one of the first judgment result and the second judgment result indicates that the target function is included; and determining that the target function is not included when both the first judgment result and the second judgment result indicate that the target function is not included.

[0058] It should be noted that by independently judging based on the function name and stack mapping relationship, a first judgment result and a second judgment result are obtained, thereby achieving multi-dimensional detection of the target function call. By utilizing the complementarity of this two-dimensional judgment method, the inclusion is determined when at least one of the two results indicates that the target function is included. This ensures that even if a single-dimensional feature (such as the function name) is difficult to identify for some reason, the other-dimensional feature (such as the stack mapping relationship) can still capture the target function call, thus guaranteeing the comprehensiveness of the detection. At the same time, by combining the first and second judgment results for the final judgment, the limitations of a single detection perspective can be effectively avoided, making the confirmation of whether the target function has been called more rigorous and reliable.

[0059] It should be added that the target function includes the encapsulated security payload decryption function and the in-place decryption processing function. The stack mapping relationship includes the system call interface function, the data sending function in the splicing module, and the in-place decryption function in the encryption algorithm interface module. The in-place decryption function is used to perform decryption operations at the same memory address. When the stack mapping relationship contains the in-place decryption function, it is confirmed that the encapsulated security payload co-address overwrite privilege escalation vulnerability logic is triggered.

[0060] In summary, this embodiment of the invention constructs a target data packet by executing a user-mode test program and sends it to the kernel to trigger a decryption operation and obtain the operation return result, thereby establishing an external observation basis for vulnerability verification. During this process, the stack frame address of the function stack is captured using eBPF loaded into the kernel and written to eBPF Maps, enabling real-time tracking and data extraction of the target function call during kernel decryption. Then, a user-mode monitoring program reads the stack frame address and searches the function symbol table of the compiled kernel, resolving the captured address into a specific function name and stack mapping relationship, thus giving the runtime data clear semantics. Finally, the operation return result is combined with the function name and stack mapping relationship for judgment, allowing the system to simultaneously confirm whether the target function has been called based on interface feedback results and the internal function execution path status. This multi-verification mechanism, combining external triggering, internal stack monitoring, and symbol table resolution, quickly checks whether the host system of vulnerability scanning platforms, threat awareness platforms, and threat intelligence systems has a security payload co-address overwrite privilege escalation vulnerability, more accurately reflecting the execution status of the target code path, ensuring the accuracy of the final vulnerability verification result, and enabling understanding of system risks before deployment to prevent problems before they occur.

[0061] The following describes the system for investigating the encapsulated secure payload co-address overwrite privilege escalation vulnerability provided by the present invention. The system for investigating the encapsulated secure payload co-address overwrite privilege escalation vulnerability described below can be referred to in correspondence with the method for investigating the encapsulated secure payload co-address overwrite privilege escalation vulnerability described above.

[0062] Figure 3 This diagram illustrates the structure of a system for investigating co-address overwrite privilege escalation vulnerabilities in encapsulated security payloads. The system includes: The program execution module 31 executes the user-mode test program to construct the target data packet and send it to the kernel for decryption, and obtain the operation return result; Address capture module 32, when the target function is called during kernel decryption, uses the extended Berkeley packet filter eBPF loaded into the kernel to capture the stack frame address of the corresponding running function stack and writes the stack frame address into the eBPF mapping table Maps; The symbol resolution module 33 reads the stack frame addresses in the eBPF Maps through the user-mode monitoring program, and searches the function symbol table of the compiled kernel to obtain the corresponding function names and stack mapping relationships; the function symbol table of the compiled kernel is obtained in advance based on the debugging compilation of the target modules of the kernel; The result determination module 34 determines whether a vulnerability attack surface exists based on the operation return result and the obtained function name and stack mapping relationship, and obtains the vulnerability verification result.

[0063] It should be noted that the specific principles of the embodiments of the present invention are the same as those of the method embodiments described above. For details, please refer to the method embodiments above. More detailed explanations will not be repeated here.

[0064] Figure 4 An example is a schematic diagram of the physical structure of an electronic device, such as... Figure 4 As shown, the electronic device may include: a processor 410, a communications interface 420, a memory 430, and a communications bus 440, wherein the processor 410, the communications interface 420, and the memory 430 communicate with each other through the communications bus 440. Processor 410 can call logical instructions in memory 430 to execute a method for investigating encapsulated security payload co-address overwrite privilege escalation vulnerabilities. This method includes: executing a user-mode test program to construct a target data packet and send it to the kernel for decryption, obtaining the operation return result; when the kernel calls the target function during decryption, using the extended Berkeley packet filter (eBPF) loaded into the kernel, capturing the stack frame address of the corresponding running function stack, and writing the stack frame address into the eBPF mapping table (Maps); reading the stack frame address in the eBPF Maps through a user-mode monitoring program, and searching the function symbol table of the compiled kernel to obtain the corresponding function name and stack mapping relationship; the function symbol table of the compiled kernel is pre-obtained based on debugging and compiling the target module of the kernel; and determining whether a vulnerability attack surface exists based on the operation return result and the obtained function name and stack mapping relationship, obtaining the vulnerability verification result.

[0065] Furthermore, the logical instructions in the aforementioned memory 430 can be implemented as software functional units and, when sold or used as independent products, can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of the present invention, or the part that contributes to the prior art, or a part of the technical solution, can be embodied in the form of a software product. This computer software product is stored in a storage medium and includes several instructions to cause a computer device (which may be a personal computer, server, or network device, etc.) to execute all or part of the steps of the methods described in the various embodiments of the present invention. The aforementioned storage medium includes various media capable of storing program code, such as USB flash drives, portable hard drives, read-only memory (ROM), random access memory (RAM), magnetic disks, or optical disks.

[0066] On the other hand, the present invention also provides a computer program product, which includes a computer program that can be stored on a non-transitory computer-readable storage medium. When the computer program is executed by a processor, the computer can execute the encapsulated security payload co-address overwrite privilege escalation vulnerability investigation method provided by the above methods. The method includes: executing a user-mode test program to construct a target data packet and send it to the kernel for decryption, and obtaining the operation return result; when the kernel calls the target function during decryption, using the extended Berkeley packet filter (eBPF) loaded into the kernel, capturing the stack frame address of the corresponding running function stack, and writing the stack frame address into the eBPF mapping table (Maps); reading the stack frame address in the eBPF Maps through a user-mode monitoring program, and searching the function symbol table of the compiled kernel to obtain the corresponding function name and stack mapping relationship; the function symbol table of the compiled kernel is obtained in advance based on the debugging compilation of the target module of the kernel; and determining whether there is a vulnerability attack surface based on the operation return result and the obtained function name and stack mapping relationship, and obtaining the vulnerability verification result.

[0067] In another aspect, the present invention also provides a non-transitory computer-readable storage medium storing a computer program thereon. When executed by a processor, this computer program implements a method for investigating encapsulated security payload co-address overwrite privilege escalation vulnerabilities provided by the methods described above. This method includes: executing a user-mode test program to construct a target data packet and send it to the kernel for decryption, obtaining the operation return result; when the kernel calls the target function during decryption, using the extended Berkeley packet filter (eBPF) loaded into the kernel, capturing the stack frame address of the corresponding running function stack, and writing the stack frame address into the eBPF mapping table (Maps); reading the stack frame address in the eBPF Maps through a user-mode monitoring program, and searching the function symbol table of the compiled kernel to obtain the corresponding function name and stack mapping relationship; the function symbol table of the compiled kernel is obtained in advance based on the debugging compilation of the target module of the kernel; and determining whether there is a vulnerability attack surface based on the operation return result and the obtained function name and stack mapping relationship, obtaining the vulnerability verification result.

[0068] The device embodiments described above are merely illustrative. The units described as separate components may or may not be physically separate. The components shown as units may or may not be physical units; that is, they may be located in one place or distributed across multiple network units. Some or all of the modules can be selected to achieve the purpose of this embodiment according to actual needs. Those skilled in the art can understand and implement this without any creative effort.

[0069] Through the above description of the embodiments, those skilled in the art can clearly understand that each embodiment can be implemented by means of software plus necessary general-purpose hardware platforms, and of course, it can also be implemented by hardware. Based on this understanding, the above technical solutions, in essence or the part that contributes to the prior art, can be embodied in the form of a software product. This computer software product can be stored in a computer-readable storage medium, such as ROM / RAM, magnetic disk, optical disk, etc., and includes several instructions to cause a computer device (which may be a personal computer, server, or network device, etc.) to execute the methods described in the various embodiments or some parts of the embodiments.

[0070] Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of the present invention, and not to limit them; although the present invention has been described in detail with reference to the foregoing embodiments, those skilled in the art should understand that modifications can still be made to the technical solutions described in the foregoing embodiments, or equivalent substitutions can be made to some of the technical features; and these modifications or substitutions do not cause the essence of the corresponding technical solutions to deviate from the spirit and scope of the technical solutions of the embodiments of the present invention.

Claims

1. A method for investigating co-address overwrite privilege escalation vulnerabilities in encapsulated security payloads, characterized in that, include: Execute the user-space test program to construct the target data packet and send it to the kernel for decryption, and obtain the operation return result; When the target function is called during the kernel decryption process, the extended Berkeley Packet Filter (eBPF) loaded into the kernel is used to capture the stack frame address of the corresponding running function stack and write the stack frame address into the eBPF mapping table Maps. The stack frame addresses in the eBPF Maps are read by the user-mode monitoring program, and the corresponding function names and stack mapping relationships are obtained by looking up the function symbol table of the compiled kernel. The function symbol table of the compiled kernel is obtained in advance based on the debugging compilation of the target module of the kernel. Based on the operation return results and the obtained function names and stack mapping relationships, it is determined whether there is a vulnerability attack surface, and the vulnerability verification result is obtained.

2. The method for investigating encapsulated security payload co-address overwrite privilege escalation vulnerabilities according to claim 1, characterized in that, Execute the user-space test program to construct the target data packet and send it to the kernel for decryption, obtaining the operation return result, including: Create an algorithm socket and set the key and initialization vector IV of the algorithm socket, and bind the algorithm socket to a preset authentication encryption algorithm; A target data packet containing associated data, ciphertext, and authentication tags is constructed and passed to the algorithm socket to trigger the kernel to call the corresponding function to perform decryption and integrity verification operations on the target data packet, and obtain the operation return result.

3. The method for investigating encapsulated security payload co-address overwrite privilege escalation vulnerabilities according to claim 2, characterized in that, Construct a target data packet containing associated data, ciphertext, and authentication tags, including: Invalid authentication label data is constructed so that the kernel fails the authentication check when performing decryption verification; wherein, the invalid authentication label data is used to trigger the kernel to return an invalid message error code, while retaining the memory operation traces during the decryption process; The associated data, the encrypted data, and the invalid authentication tag data are concatenated in a preset order to generate a target data packet.

4. The method for investigating encapsulated security payload co-address overwrite privilege escalation vulnerabilities according to claim 3, characterized in that, The target data packet is passed to the algorithm socket to trigger the kernel to call the corresponding function, perform decryption and integrity verification operations on the target data packet, and obtain the operation return result, including: The target data packet is sent to the request file descriptor corresponding to the algorithm socket through the message sending interface, and the decryption operation parameters are passed. Detect the execution status of the message sending interface; Based on the execution status, if the message sending interface returns successfully or returns an invalid message error code, it is determined that the kernel has entered the in-place decryption branch and executed the in-place decryption SGL multiplexing logic, and the existence of a vulnerability attack surface is determined as the operation return result. Based on the execution status, if the message sending interface returns an error code other than the invalid message error code, it is determined that the kernel decryption path is blocked, and no vulnerability attack surface is determined as the operation return result.

5. The method for investigating encapsulated security payload co-address overwrite privilege escalation vulnerabilities according to claim 1, characterized in that, The user-mode monitoring program reads the stack frame addresses in the eBPF Maps and searches the function symbol table of the compiled kernel to obtain the corresponding function names and stack mapping relationships, including: The stack frame address in the eBPF Maps is read by the user-space monitoring program; Determine the address randomization offset when the kernel is loaded, and use the address randomization offset to convert the read stack frame address into a logical offset address; Based on the logical offset address, the matching function entry in the function symbol table of the compiled kernel is found, and a stack mapping relationship containing the function name is generated based on the matching function entry.

6. The method for investigating encapsulated security payload co-address overwrite privilege escalation vulnerabilities according to claim 1, characterized in that, Based on the operation's return result and the obtained function names and stack mapping relationships, determine whether a vulnerability attack surface exists, and obtain vulnerability verification results, including: Based on the function name and stack mapping relationship, determine whether the target function is included; When it is determined that a vulnerability attack surface exists based on the operation return result, or when it is determined that the target function is included, the existence of a vulnerability attack surface in the kernel is taken as the vulnerability verification result. If, based on the results returned by the operation, it is determined that there is no vulnerability attack surface and that the target function is not included, then the absence of a detected vulnerability attack surface is taken as the vulnerability verification result.

7. The method for investigating encapsulated security payload co-address overwrite privilege escalation vulnerabilities according to claim 6, characterized in that, Based on the function name and stack mapping, determine whether the target function is included, including: Based on the function name, determine whether the target function is included, and obtain the first judgment result; Determine whether the stack mapping relationship contains the target function to obtain a second judgment result; If at least one of the first and second judgment results indicates that the objective function is included, then the objective function is determined to be included. If both the first and second judgment results indicate that the objective function is not included, then the objective function is determined to be not included.

8. The method for investigating encapsulated security payload co-address overwrite privilege escalation vulnerabilities according to claim 1, characterized in that, Before searching the function symbol table of the compiled kernel, the following is included: Obtain the source code of the target module in the kernel; The source code of the target module is debugged and compiled to obtain the compiled kernel binary file; The function symbol table corresponding to the target module is added to the binary file of the compiled kernel to obtain the function symbol table of the compiled kernel.

9. The method for investigating encapsulated security payload co-address overwrite privilege escalation vulnerabilities according to claim 1, characterized in that, When the target function is called during the kernel decryption process, the extended Berkeley Packet Filter (eBPF) loaded into the kernel is used to capture the stack frame address of the corresponding running function stack, and the stack frame address is written into the eBPF mapping table Maps, including: When the target function is called during the kernel decryption process, the current processor's stack register is read by the extended Berkeley Packet Filter (eBPF) to obtain multiple return addresses on the function stack as stack frame addresses; wherein, the eBPF is pre-mounted to the entry or exit location of the target function in the kernel; The stack frame address is written into the eBPF mapping table Maps for the user-mode monitoring program to poll and read.

10. A system for investigating co-address overwrite privilege escalation vulnerabilities in encapsulated security payloads, characterized in that, include: The program execution module executes the user-space test program to construct the target data packet and send it to the kernel for decryption, and obtains the operation return result; The address capture module, when the target function is called during the kernel decryption process, uses the extended Berkeley packet filter (eBPF) loaded into the kernel to capture the stack frame address of the corresponding running function stack and writes the stack frame address into the eBPF mapping table Maps. The symbol resolution module reads the stack frame addresses in the eBPF Maps through the user-mode monitoring program, and searches the function symbol table of the compiled kernel to obtain the corresponding function names and stack mapping relationships; the function symbol table of the compiled kernel is obtained in advance based on the debugging compilation of the target module of the kernel; The result determination module determines whether a vulnerability attack surface exists based on the operation return result and the obtained function name and stack mapping relationship, and obtains the vulnerability verification result.

Images