ed0e1e4d44
1979 changes to exploits/shellcodes Couchdb 1.5.0 - 'uuids' Denial of Service Apache CouchDB 1.5.0 - 'uuids' Denial of Service Beyond Remote 2.2.5.3 - Denial of Service (PoC) udisks2 2.8.0 - Denial of Service (PoC) Termite 3.4 - Denial of Service (PoC) SoftX FTP Client 3.3 - Denial of Service (PoC) Silverstripe 2.3.5 - Cross-Site Request Forgery / Open redirection SilverStripe CMS 2.3.5 - Cross-Site Request Forgery / Open Redirection Silverstripe CMS 3.0.2 - Multiple Vulnerabilities SilverStripe CMS 3.0.2 - Multiple Vulnerabilities Silverstripe CMS 2.4 - File Renaming Security Bypass SilverStripe CMS 2.4 - File Renaming Security Bypass Silverstripe CMS 2.4.5 - Multiple Cross-Site Scripting Vulnerabilities SilverStripe CMS 2.4.5 - Multiple Cross-Site Scripting Vulnerabilities Silverstripe CMS 2.4.7 - 'install.php' PHP Code Injection SilverStripe CMS 2.4.7 - 'install.php' PHP Code Injection Silverstripe Pixlr Image Editor - 'upload.php' Arbitrary File Upload SilverStripe CMS Pixlr Image Editor - 'upload.php' Arbitrary File Upload Silverstripe CMS 2.4.x - 'BackURL' Open Redirection SilverStripe CMS 2.4.x - 'BackURL' Open Redirection Silverstripe CMS - 'MemberLoginForm.php' Information Disclosure SilverStripe CMS - 'MemberLoginForm.php' Information Disclosure Silverstripe CMS - Multiple HTML Injection Vulnerabilities SilverStripe CMS - Multiple HTML Injection Vulnerabilities Apache CouchDB 1.7.0 and 2.x before 2.1.1 - Remote Privilege Escalation Apache CouchDB 1.7.0 / 2.x < 2.1.1 - Remote Privilege Escalation Monstra CMS before 3.0.4 - Cross-Site Scripting Monstra CMS < 3.0.4 - Cross-Site Scripting (2) Monstra CMS < 3.0.4 - Cross-Site Scripting Monstra CMS < 3.0.4 - Cross-Site Scripting (1) Navigate CMS 2.8 - Cross-Site Scripting Collectric CMU 1.0 - 'lang' SQL injection Joomla! Component CW Article Attachments 1.0.6 - 'id' SQL Injection LG SuperSign EZ CMS 2.5 - Remote Code Execution MyBB Visual Editor 1.8.18 - Cross-Site Scripting Joomla! Component AMGallery 1.2.3 - 'filter_category_id' SQL Injection Joomla! Component Micro Deal Factory 2.4.0 - 'id' SQL Injection RICOH Aficio MP 301 Printer - Cross-Site Scripting Joomla! Component Auction Factory 4.5.5 - 'filter_order' SQL Injection RICOH MP C6003 Printer - Cross-Site Scripting Linux/ARM - Egghunter (PWN!) + execve(_/bin/sh__ NULL_ NULL) Shellcode (28 Bytes) Linux/ARM - sigaction() Based Egghunter (PWN!) + execve(_/bin/sh__ NULL_ NULL) Shellcode (52 Bytes)
96 lines
No EOL
3.3 KiB
Text
96 lines
No EOL
3.3 KiB
Text
Source: https://bugs.chromium.org/p/project-zero/issues/detail?id=1004
|
|
|
|
mach_voucher_extract_attr_recipe_trap is a mach trap which can be called from any context
|
|
|
|
Here's the code:
|
|
|
|
kern_return_t
|
|
mach_voucher_extract_attr_recipe_trap(struct mach_voucher_extract_attr_recipe_args *args)
|
|
{
|
|
ipc_voucher_t voucher = IV_NULL;
|
|
kern_return_t kr = KERN_SUCCESS;
|
|
mach_msg_type_number_t sz = 0;
|
|
|
|
if (copyin(args->recipe_size, (void *)&sz, sizeof(sz))) <---------- (a)
|
|
return KERN_MEMORY_ERROR;
|
|
|
|
if (sz > MACH_VOUCHER_ATTR_MAX_RAW_RECIPE_ARRAY_SIZE)
|
|
return MIG_ARRAY_TOO_LARGE;
|
|
|
|
voucher = convert_port_name_to_voucher(args->voucher_name);
|
|
if (voucher == IV_NULL)
|
|
return MACH_SEND_INVALID_DEST;
|
|
|
|
mach_msg_type_number_t __assert_only max_sz = sz;
|
|
|
|
if (sz < MACH_VOUCHER_TRAP_STACK_LIMIT) {
|
|
/* keep small recipes on the stack for speed */
|
|
uint8_t krecipe[sz];
|
|
if (copyin(args->recipe, (void *)krecipe, sz)) {
|
|
kr = KERN_MEMORY_ERROR;
|
|
goto done;
|
|
}
|
|
kr = mach_voucher_extract_attr_recipe(voucher, args->key,
|
|
(mach_voucher_attr_raw_recipe_t)krecipe, &sz);
|
|
assert(sz <= max_sz);
|
|
|
|
if (kr == KERN_SUCCESS && sz > 0)
|
|
kr = copyout(krecipe, (void *)args->recipe, sz);
|
|
} else {
|
|
uint8_t *krecipe = kalloc((vm_size_t)sz); <---------- (b)
|
|
if (!krecipe) {
|
|
kr = KERN_RESOURCE_SHORTAGE;
|
|
goto done;
|
|
}
|
|
|
|
if (copyin(args->recipe, (void *)krecipe, args->recipe_size)) { <----------- (c)
|
|
kfree(krecipe, (vm_size_t)sz);
|
|
kr = KERN_MEMORY_ERROR;
|
|
goto done;
|
|
}
|
|
|
|
kr = mach_voucher_extract_attr_recipe(voucher, args->key,
|
|
(mach_voucher_attr_raw_recipe_t)krecipe, &sz);
|
|
assert(sz <= max_sz);
|
|
|
|
if (kr == KERN_SUCCESS && sz > 0)
|
|
kr = copyout(krecipe, (void *)args->recipe, sz);
|
|
kfree(krecipe, (vm_size_t)sz);
|
|
}
|
|
|
|
kr = copyout(&sz, args->recipe_size, sizeof(sz));
|
|
|
|
done:
|
|
ipc_voucher_release(voucher);
|
|
return kr;
|
|
}
|
|
|
|
|
|
Here's the argument structure (controlled from userspace)
|
|
|
|
struct mach_voucher_extract_attr_recipe_args {
|
|
PAD_ARG_(mach_port_name_t, voucher_name);
|
|
PAD_ARG_(mach_voucher_attr_key_t, key);
|
|
PAD_ARG_(mach_voucher_attr_raw_recipe_t, recipe);
|
|
PAD_ARG_(user_addr_t, recipe_size);
|
|
};
|
|
|
|
recipe and recipe_size are userspace pointers.
|
|
|
|
At point (a) four bytes are read from the userspace pointer recipe_size into sz.
|
|
|
|
At point (b) if sz was less than MACH_VOUCHER_ATTR_MAX_RAW_RECIPE_ARRAY_SIZE (5120) and greater than MACH_VOUCHER_TRAP_STACK_LIMIT (256)
|
|
sz is used to allocate a kernel heap buffer.
|
|
|
|
At point (c) copyin is called again to copy userspace memory into that buffer which was just allocated, but rather than passing sz (the
|
|
validate size which was allocated) args->recipe_size is passed as the size. This is the userspace pointer *to* the size, not the size!
|
|
|
|
This leads to a completely controlled kernel heap overflow.
|
|
|
|
Tested on MacOS Sierra 10.12.1 (16B2555)
|
|
|
|
Exploit for iOS 10.2 iPod Touch 6G 14C92 gets kernel arbitrary r/w
|
|
|
|
|
|
Proof of Concept:
|
|
https://github.com/offensive-security/exploitdb-bin-sploits/raw/master/bin-sploits/41163.zip |