DirtyPipe漏洞分析及编程学习

DirtyPipe漏洞是一种与Linux内核中的管道(pipe)相关的安全漏洞。本文将详细分析DirtyPipe漏洞的原理,并提供相应的源代码作为示例。

DirtyPipe漏洞的原理是利用了Linux内核中的pipe文件系统调用的一个特性,即在内核中维护一个pipe_buf结构体,用于存储管道中的数据。在正常情况下,pipe_buf结构体的大小被限制在一页(通常为4KB)以内,但是通过一系列的操作,可以实现对pipe_buf结构体的扩展,从而导致内核堆栈溢出。

下面是一个示例的源代码,用于演示DirtyPipe漏洞的利用:

#include <stdio.h>
#include <stdlib.h>
#
Dirty Pipe脏管道提权漏洞复现(CVE-2022-0847) 攻击者通过 CVE-2022-0847 可覆盖重写任意可读文件中的数据,可将普通权限的用户提升到特权 root这个漏洞作者将其命名为了 Dirty Pipe(脏管道),一看到这名字讲道理就让人想到了 Dirty Cow(脏牛),这是因为该漏洞的原理比较类似于 Dirty Cow,但这个漏洞更容易被利用。 阅读详情

相关推荐

大白话图解 Linux 脏管道(Dirty Pipe) 漏洞(CVE-2022-0847)

大白话图解 Linux 脏管道(Dirty Pipe) 漏洞(CVE-2022-0847) 漏洞披露链接:https://dirtypipe.cm4all.com/ 背景 ​ 今天(2022年3月8日),开源社区爆出了Linux内核新的一级安全漏洞, Dirty Pipe Vulnerability. 漏洞点于Linux内核5.8版本引入,可以’通杀’后续多个版本内核,以及所有使用了相关Linux内核的下游厂商产品。当然,有必要说明的是,这里的通杀不是针对任意系统的远程命令执行,而是面向内

omgFuture的博客 1万+

DirtyPipe(脏管道)提权

DirtyPipe提权 CVE-2022-0847 漏洞详情 新管道缓冲区结构的“flags”成员在 Linux 内核中的 copy_page_to_iter_pipe 和 push_pipe 函数中缺乏正确初始化的方式存在缺陷,因此可能包含陈旧的值。非特权本地用户可通过利用此漏洞,可覆盖重写任意可读文件中的数据,从而可将普通权限的用户提升到特权 root。CVE-2022-0847 的漏洞原理类似于 CVE-2016-5195 脏牛漏洞(Dirty Cow),但它更容易被利用。漏洞作者将此漏洞命名为“Di

weixin_45794666的博客 7620

Linux内核权限提升漏洞

一、漏洞详情 近日,研究人员披露了一个Linux内核本地权限提升漏洞,发现在copy_page_to_iter_pipe和 push_pipe函数中,新分配的pipe_buffer结构体成员“flags”未被正确地初始化,可能包含旧值PIPE_BUF_FLAG_CAN_MERGE。攻击者可利用此漏洞向由只读文件支持的页面缓存中的页面写入数据,从而提升权限。该漏洞编号为CVE-2022-0847,因漏洞类型和“DirtyCow”(脏牛)类似,亦称为“DirtyPipe”。 *严正声明:本文仅限于技术讨论与分享

Android_wxf的博客 3706

Linux DirtyPipe权限提升漏洞(CVE-2022-0847)

3月7日,国外的安全研究员马克斯·凯勒曼发布博客,披露了一处存在于Linux 内核中的本地提权漏洞CVE-2022-0847。CVE-2022-0847是存在于Linux内核5.8及之后版本中的本地提权漏洞。攻击者通过利用此漏洞,可覆盖重写任意可读文件中的数据,从而可将普通权限的用户提升到特权root。CVE-2022-0847 的漏洞原理类似于CVE-2016-5195脏牛漏洞(Dirty Cow),但它更容易被利用。漏洞作者将此漏洞命名为“Dirty Pipe”。

谢公子的博客 4390

SAP-FICO LSMW实战:批量导入财务凭证与固定资产主数据(AS91)的完整指南

本文详细介绍了SAP-FICO中LSMW工具在批量导入财务凭证与固定资产主数据(AS91)的完整流程与实战技巧。从基础概念、环境准备到财务凭证导入全流程,特别针对AS91历史资产导入的日期逻辑和关键字段映射提供了专项指南,并分享了常见错误排查与性能优化建议,帮助用户高效完成SAP数据迁移任务。

weixin_29230649的博客 507

TESSY创建单元测试或集成测试工程

我们以tessy5.1为例,给大家展示单元测试和集成测试工程的创建过程。

空气中的告白专栏 1686

SAP 银企直连实战:从零构建 DMEEX 格式树的配置与调试指南

本文详细介绍了SAP银企直连中DMEEX格式树的配置与调试方法,涵盖从基础认知到实战技巧的全流程。通过具体案例解析,帮助财务顾问快速掌握建设银行付款报文的格式树搭建、字段映射及调试优化,提升企业支付效率与准确性。

weixin_42526015的博客 567

闲置服务器之代理服务器篇

这台服务器是在阿里云免费白嫖的,天工开物计划,阿里给的300块无门槛优惠券,买了一台新加坡的境外服务器,288,刚刚抵扣完,因为是境外服务器,能够访问一些国内不能访问的网站,所以本文章仅从技术的角度来搭建代理服务器,使用时,请自觉遵守国家相关规定,如有任何违法行为,与本人无任何关系!!!。本文使用tinyproxy来搭建代理服务器。

m0_50281408的博客 2106

光斑大小控制【ZEMAX操作数】

在使用Zemax优化光学系统时,对成像的聚焦光斑大小进行限制,即弥散斑的大小; 一、RSCE(质心RMS光斑半径):二、RSCH(光线RMS光斑半径):

yh的博客 7872

安装Office程序时无法安装的解决方案

本文主要介绍了安装Office程序时无法安装的解决方案,希望能对安装Office的同学们有所帮助。 文章目录 1. 问题描述 2. 解决方案 2.1 前置步骤 2.2 方法一 2.3 方法二

weixin_43178406的博客 15万+

手把手教你玩转服务器芯片架构​专栏--​​3.5 实战案例:用SystemC搭建一个多核服务器芯片的NoC模型(含流量分配与延迟仿真)​

通过SystemC搭建多核NoC模型,可深入验证流量分配策略与延迟特性。实际工程中需结合FPGA原型验证(如Xilinx Alveo)进行时序收敛分析,并通过参数化设计适配不同服务器芯片需求。

MHD0815的博客 3048

【高级强化学习:算法、优化与泛化】第13章 扩散模型策略优化(Diffusion Policy Optimization)

\quad$ 计算均值 $\mu_t = \frac{1}{\sqrt{\alpha_t}} \left( x_t - \frac{1 - \alpha_t}{\sqrt{1 - \bar{\alpha}_t}} \tilde{\epsilon} \right)$.$\quad$ 组合得分估计: $\tilde{\epsilon} = \epsilon_{\text{unc}} + w \cdot (\epsilon_{\text{con}} - \epsilon_{\text{unc}})$.

u012133341的博客 339

SAP B1中文培訓教材_SDK

公司内部培训资料,对开发工具 ,DIAPI, UIAPI,Add-ON有详细解说

win10 跳过U8环境检测的IE WebControls.rar

win10 安装u8的时候 提示IE WebControls 不通过,这个工具可以欺骗u8的检查。 跳过U8环境检测的IE WebControls。提示导入失败后,重新检测通过。

深度学习工具包 DeepLearningToolbox

深度学习工具包Deprecation notice.-----This toolbox is outdated and no longer maintained.There are much better tools available for deep learning than this toolbox, e.g. [Theano](http://deeplearning.net/software/theano/), [torch](http://torch.ch/) or [tensorflow](http://www.tensorflow.org/)I would suggest you use one of the tools mentioned above rather than use this toolbox.Best, Rasmus.DeepLearnToolbox================A Matlab toolbox for Deep Learning.Deep Learning is a new subfield of machine learning that focuses on learning deep hierarchical models of data.It is inspired by the human brain's apparent deep (layered, hierarchical) architecture.A good overview of the theory of Deep Learning theory is[Learning Deep Architectures for AI](http://www.iro.umontreal.ca/~bengioy/papers/ftml_book.pdf)For a more informal introduction, see the following videos by Geoffrey Hinton and Andrew Ng.* [The Next Generation of Neural Networks](http://www.youtube.com/watch?v=AyzOUbkUf3M) (Hinton, 2007)* [Recent Developments in Deep Learning](http://www.youtube.com/watch?v=VdIURAu1-aU) (Hinton, 2010)* [Unsupervised Feature Learning and Deep Learning](http://www.youtube.com/watch?v=ZmNOAtZIgIk) (Ng, 2011)If you use this toolbox in your research please cite [Prediction as a candidate for learning deep hierarchical models of data](http://www2.imm.dtu.dk/pubdb/views/publication_details.php?id=6284)```@MASTERSTHESIS\{IMM2012-06284, author = "R. B. Palm", title = "Prediction as a candidate for learning deep hierarchical models of data", year = "2012",}```Contact: rasmusbergpalm at gmail dot comDirectories included in the toolbox-----------------------------------`NN/` - A library for Feedforward Backpropagation Neural Networks`CNN/` - A library for Convolutional Neural Networks`DBN/` - A library for Deep Belief Networks`SAE/` - A library for Stacked Auto-Encoders`CAE/` - A library for Convolutional Auto-Encoders`util/` - Utility functions used by the libraries`data/` - Data used by the examples`tests/` - unit tests to verify toolbox is workingFor references on each library check REFS.mdSetup-----1. Download.2. addpath(genpath('DeepLearnToolbox'));Example: Deep Belief Network---------------------```matlabfunction test_example_DBNload mnist_uint8;train_x = double(train_x) / 255;test_x = double(test_x) / 255;train_y = double(train_y);test_y = double(test_y);%% ex1 train a 100 hidden unit RBM and visualize its weightsrand('state',0)dbn.sizes = [100];opts.numepochs = 1;opts.batchsize = 100;opts.momentum = 0;opts.alpha = 1;dbn = dbnsetup(dbn, train_x, opts);dbn = dbntrain(dbn, train_x, opts);figure; visualize(dbn.rbm{1}.W'); % Visualize the RBM weights%% ex2 train a 100-100 hidden unit DBN and use its weights to initialize a NNrand('state',0)%train dbndbn.sizes = [100 100];opts.numepochs = 1;opts.batchsize = 100;opts.momentum = 0;opts.alpha = 1;dbn = dbnsetup(dbn, train_x, opts);dbn = dbntrain(dbn, train_x, opts);%unfold dbn to nnnn = dbnunfoldtonn(dbn, 10);nn.activation_function = 'sigm';%train nnopts.numepochs = 1;opts.batchsize = 100;nn = nntrain(nn, train_x, train_y, opts);[er, bad] = nntest(nn, test_x, test_y);assert(er < 0.10, 'Too big error');```Example: Stacked Auto-Encoders---------------------```matlabfunction test_example_SAEload mnist_uint8;train_x = double(train_x)/255;test_x = double(test_x)/255;train_y = double(train_y);test_y = double(test_y);%% ex1 train a 100 hidden unit SDAE and use it to initialize a FFNN% Setup and train a stacked denoising autoencoder (SDAE)rand('state',0)sae = saesetup([784 100]);sae.ae{1}.activation_function = 'sigm';sae.ae{1}.learningRate = 1;sae.ae{1}.inputZeroMaskedFraction = 0.5;opts.numepochs = 1;opts.batchsize = 100;sae = saetrain(sae, train_x, opts);visualize(sae.ae{1}.W{1}(:,2:end)')% Use the SDAE to initialize a FFNNnn = nnsetup([784 100 10]);nn.activation_function = 'sigm';nn.learningRate = 1;nn.W{1} = sae.ae{1}.W{1};% Train the FFNNopts.numepochs = 1;opts.batchsize = 100;nn = nntrain(nn, train_x, train_y, opts);[er, bad] = nntest(nn, test_x, test_y);assert(er < 0.16, 'Too big error');```Example: Convolutional Neural Nets---------------------```matlabfunction test_example_CNNload mnist_uint8;train_x = double(reshape(train_x',28,28,60000))/255;test_x = double(reshape(test_x',28,28,10000))/255;train_y = double(train_y');test_y = double(test_y');%% ex1 Train a 6c-2s-12c-2s Convolutional neural network %will run 1 epoch in about 200 second and get around 11% error. %With 100 epochs you'll get around 1.2% errorrand('state',0)cnn.layers = { struct('type', 'i') %input layer struct('type', 'c', 'outputmaps', 6, 'kernelsize', 5) %convolution layer struct('type', 's', 'scale', 2) %sub sampling layer struct('type', 'c', 'outputmaps', 12, 'kernelsize', 5) %convolution layer struct('type', 's', 'scale', 2) %subsampling layer};cnn = cnnsetup(cnn, train_x, train_y);opts.alpha = 1;opts.batchsize = 50;opts.numepochs = 1;cnn = cnntrain(cnn, train_x, train_y, opts);[er, bad] = cnntest(cnn, test_x, test_y);%plot mean squared errorfigure; plot(cnn.rL);assert(er<0.12, 'Too big error');```Example: Neural Networks---------------------```matlabfunction test_example_NNload mnist_uint8;train_x = double(train_x) / 255;test_x = double(test_x) / 255;train_y = double(train_y);test_y = double(test_y);% normalize[train_x, mu, sigma] = zscore(train_x);test_x = normalize(test_x, mu, sigma);%% ex1 vanilla neural netrand('state',0)nn = nnsetup([784 100 10]);opts.numepochs = 1; % Number of full sweeps through dataopts.batchsize = 100; % Take a mean gradient step over this many samples[nn, L] = nntrain(nn, train_x, train_y, opts);[er, bad] = nntest(nn, test_x, test_y);assert(er < 0.08, 'Too big error');%% ex2 neural net with L2 weight decayrand('state',0)nn = nnsetup([784 100 10]);nn.weightPenaltyL2 = 1e-4; % L2 weight decayopts.numepochs = 1; % Number of full sweeps through dataopts.batchsize = 100; % Take a mean gradient step over this many samplesnn = nntrain(nn, train_x, train_y, opts);[er, bad] = nntest(nn, test_x, test_y);assert(er < 0.1, 'Too big error');%% ex3 neural net with dropoutrand('state',0)nn = nnsetup([784 100 10]);nn.dropoutFraction = 0.5; % Dropout fraction opts.numepochs = 1; % Number of full sweeps through dataopts.batchsize = 100; % Take a mean gradient step over this many samplesnn = nntrain(nn, train_x, train_y, opts);[er, bad] = nntest(nn, test_x, test_y);assert(er < 0.1, 'Too big error');%% ex4 neural net with sigmoid activation functionrand('state',0)nn = nnsetup([784 100 10]);nn.activation_function = 'sigm'; % Sigmoid activation functionnn.learningRate = 1; % Sigm require a lower learning rateopts.numepochs = 1; % Number of full sweeps through dataopts.batchsize = 100; % Take a mean gradient step over this many samplesnn = nntrain(nn, train_x, train_y, opts);[er, bad] = nntest(nn, test_x, test_y);assert(er < 0.1, 'Too big error');%% ex5 plotting functionalityrand('state',0)nn = nnsetup([784 20 10]);opts.numepochs = 5; % Number of full sweeps through datann.output = 'softmax'; % use softmax outputopts.batchsize = 1000; % Take a mean gradient step over this many samplesopts.plot = 1; % enable plottingnn = nntrain(nn, train_x, train_y, opts);[er, bad] = nntest(nn, test_x, test_y);assert(er < 0.1, 'Too big error');%% ex6 neural net with sigmoid activation and plotting of validation and training error% split training data into training and validation datavx = train_x(1:10000,:);tx = train_x(10001:end,:);vy = train_y(1:10000,:);ty = train_y(10001:end,:);rand('state',0)nn = nnsetup([784 20 10]); nn.output = 'softmax'; % use softmax outputopts.numepochs = 5; % Number of full sweeps through dataopts.batchsize = 1000; % Take a mean gradient step over this many samplesopts.plot = 1; % enable plottingnn = nntrain(nn, tx, ty, opts, vx, vy); % nntrain takes validation set as last two arguments (optionally)[er, bad] = nntest(nn, test_x, test_y);assert(er < 0.1, 'Too big error');```[![Bitdeli Badge](https://d2weczhvl823v0.cloudfront.net/rasmusbergpalm/deeplearntoolbox/trend.png)](https://bitdeli.com/free "Bitdeli Badge")

文档:亲测可用解决vnc灰屏,黑屏,鼠标大黑叉情况

主要解决vnc-viewer灰屏,黑屏,鼠标大黑叉等现象,详细见文档。

上一篇: 基于Grafana的全栈可观察性示例:编程学习
下一篇: 诸葛亮——编程界的智者与谋略家
普通网友
博客等级 码龄3年 58粉丝 0原创
评论
成就一亿技术人!
拼手气红包6.0元
还能输入1000个字符  | 博主筛选后可见
 
 条评论被折叠 查看
添加红包

请填写红包祝福语或标题

个

红包个数最小为10个

元

红包金额最低5元

当前余额3.43元 前往充值 >
需支付:10.00元
成就一亿技术人!
领取后你会自动成为博主和红包主的粉丝 规则
hope_wisdom
发出的红包
实付元
使用余额支付
点击重新获取
扫码支付
钱包余额 0

抵扣说明:

1.余额是钱包充值的虚拟货币,按照1:1的比例进行支付金额的抵扣。
2.余额无法直接购买下载,可以购买VIP、付费专栏及课程。

余额充值