9cea53a35b
35 changes to exploits/shellcodes MikroTik RouterBoard 6.39.2 / 6.40.5 DNS - Denial of Service MikroTik 6.40.5 ICMP - Denial of Service iOS/macOS - Kernel Double Free due to IOSurfaceRootUserClient not Respecting MIG Ownership Rules macOS XNU Kernel - Memory Disclosure due to bug in Kernel API for Detecting Kernel Memory Disclosures macOS - 'getrusage' Stack Leak Through struct Padding macOS - 'necp_get_socket_attributes' so_pcb Type Confusion LibTIFF pal2rgb 4.0.9 - Heap Buffer Overflow Entrepreneur Dating Script 2.0.1 - 'marital' / 'gender' / 'country' / 'profileid' SQL Injection Secure E-commerce Script 2.0.1 - 'searchcat' / 'searchmain' SQL Injection Laundry Booking Script 1.0 - 'list?city' SQL Injection Lawyer Search Script 1.1 - 'lawyer-list?city' SQL Injection Multivendor Penny Auction Clone Script 1.0 - SQL Injection Online Exam Test Application Script 1.6 - 'exams.php?sort' SQL Injection Opensource Classified Ads Script 3.2 - SQL Injection PHP Multivendor Ecommerce 1.0 - 'sid' / 'searchcat' / 'chid1' SQL Injection Professional Service Script 1.0 - 'service-list?city' SQL Injection Readymade PHP Classified Script 3.3 - 'subctid' / 'mctid' SQL Injection Readymade Video Sharing Script 3.2 - SQL Injection Responsive Realestate Script 3.2 - 'property-list?tbud' SQL Injection Multireligion Responsive Matrimonial 4.7.2 - 'succid' SQL Injection Responsive Events & Movie Ticket Booking Script 3.2.1 - 'findcity.php?q' SQL Injection Multiplex Movie Theater Booking Script 3.1.5 - 'moid' / 'eid' SQL Injection Single Theater Booking Script 3.2.1 - 'findcity.php?q' SQL Injection Advanced Real Estate Script 4.0.7 - SQL Injection Entrepreneur Bus Booking Script 3.0.4 - 'sourcebus' SQL Injection MLM Forex Market Plan Script 2.0.4 - 'newid' / 'eventid' SQL Injection MLM Forced Matrix 2.0.9 - 'newid' SQL Injection Car Rental Script 2.0.4 - 'val' SQL Injection Groupon Clone Script 3.01 - 'state_id' / 'search' SQL Injection Muslim Matrimonial Script 3.02 - 'succid' SQL Injection Advanced World Database 2.0.5 - SQL Injection Resume Clone Script 2.0.5 - SQL Injection Basic Job Site Script 2.0.5 - SQL Injection Vanguard 1.4 - Arbitrary File Upload Vanguard 1.4 - SQL Injection
36 lines
No EOL
1.8 KiB
Text
36 lines
No EOL
1.8 KiB
Text
I have previously detailed the lifetime management paradigms in MIG in the writeups for:
|
|
CVE-2016-7612 [https://bugs.chromium.org/p/project-zero/issues/detail?id=926]
|
|
and
|
|
CVE-2016-7633 [https://bugs.chromium.org/p/project-zero/issues/detail?id=954]
|
|
|
|
If a MIG method returns KERN_SUCCESS it means that the method took ownership of *all* the arguments passed to it.
|
|
If a MIG method returns an error code, then it took ownership of *none* of the arguments passed to it.
|
|
|
|
If an IOKit userclient external method takes an async wake mach port argument then the lifetime of the reference
|
|
on that mach port passed to the external method will be managed by MIG semantics. If the external method returns
|
|
an error then MIG will assume that the reference was not consumed by the external method and as such the MIG
|
|
generated coode will drop a reference on the port.
|
|
|
|
IOSurfaceRootUserClient external method 17 (s_set_surface_notify) will drop a reference on the wake_port
|
|
(via IOUserClient::releaseAsyncReference64) then return an error code if the client has previously registered
|
|
a port with the same callback function.
|
|
|
|
The external method's error return value propagates via the return value of is_io_connect_async_method back to the
|
|
MIG generated code which will drop a futher reference on the wake_port when only one was taken.
|
|
|
|
This bug is reachable from the iOS app sandbox as demonstrated by this PoC.
|
|
|
|
Tested on iOS 11.0.3 (11A432) on iPhone 6s (MKQL2CN/A)
|
|
Tested on MacOS 10.13 (17A365) on MacBookAir5,2
|
|
|
|
------------------------------------------------------
|
|
|
|
async_wake exploit attached.
|
|
|
|
Gets tfp0 on all 64-bit devices plus an initial PoC local kernel debugger.
|
|
|
|
See the README and kdbg.c for details.
|
|
|
|
|
|
Proof of Concept:
|
|
https://github.com/offensive-security/exploit-database-bin-sploits/raw/master/bin-sploits/43320.zip |