Apple macOS – ‘stackshot’ Raw Frame Pointers - 体验盒子

作者： Google Security Research

日期： 2017-05-22

类别：

dos

平台：

macos

来源：https://www.exploit-db.com/exploits/42047/

1

2

3

4

5

6

7

8

9

10

11

12

13

14

15

16

17

18

19

20

21

22

23

24

25

26

27

28

29

Source: https://bugs.chromium.org/p/project-zero/issues/detail?id=1164

This is an issue that allows unentitled root to read kernel frame

pointers, which might be useful in combination with a kernel memory

corruption bug.

By design, the syscall stack_snapshot_with_config() permits unentitled

root to dump information about all user stacks and kernel stacks.

While a target thread, along with the rest of the system, is frozen,

machine_trace_thread64() dumps its kernel stack.

machine_trace_thread64() walks up the kernel stack using the chain of

saved RBPs. It dumps the unslid kernel text pointers together with

unobfuscated frame pointers.

The attached PoC dumps a stackshot into the file stackshot_data.bin

when executed as root. The stackshot contains data like this:

00000a70de 14 40 00 80 ff ff ffa0 be 08 77 80 ff ff ff|..@........w....|

00000a807b b8 30 00 80 ff ff ff20 bf 08 77 80 ff ff ff|{.0..... ..w....|

00000a909e a6 30 00 80 ff ff ff60 bf 08 77 80 ff ff ff|..0.....`..w....|

00000aa05d ac 33 00 80 ff ff ffb0 bf 08 77 80 ff ff ff|].3........w....|

The addresses on the left are unslid kernel text pointers; the

addresses on the right are valid kernel stack pointers.

Proof of Concept:

https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/42047.zip