Monorail Project: project-zero ▼ Issues People Development process History Sign in
New issue
Advanced search Search tips
Note: Color blocks (like █ or █) mean that a user may not be available. Tooltip shows the reason.
Issue 126
Starred by 4 users
Status: Invalid
Owner:
█ cevans@google.com
Email to this user bounced
Closed: Nov 2014
Cc:
project-...@google.com



Sign in to add a comment
 OS X kASLR defeat due to kernel pointers in IOKit registry
Project Member Reported by ianbeer@google.com, Oct 15 2014 Back to list 
$ ioreg -lxf | grep 7fffffff
    | | | |   | |   "AAPL,iokit-ndrv" = <f07c3a8c7fffffff>
    | | | |   | | |   "AAPL,iokit-ndrv" = <f07c3a8c7fffffff>
    | | | |   | | |   "AAPL,iokit-ndrv" = <f07c3a8c7fffffff>
    | | | |   | | |   "AAPL,iokit-ndrv" = <f07c3a8c7fffffff>
    | | | |   | | |   "AAPL,iokit-ndrv" = <f07c3a8c7fffffff>
    | | | | |   "AAPL,iokit-ndrv" = <f07c3a8c7fffffff>

That's an IOKit vtable pointer. Read access to the IOKit registry isn't currently preventable by the OS X sandboxing mechanism so any process on OS X can read *all* the information in there.

PoC exploit attached which uses this kASLR defeat along with https://code.google.com/p/google-security-research/issues/detail?id=40 to get reliable kernel code execution.
key_exploit.c
11.1 KB Download
Project Member Comment 1 by ianbeer@google.com, Oct 15 2014
Labels: Reported-2014-Oct-14 Id-612597888
Project Member Comment 2 by ianbeer@google.com, Oct 31 2014 
I think this might have been fixed in Yosemite. Apple haven't replied to my bug report yet but I'l gonna ping them to see if this was silently fixed. If so I'll mark this bug as invalid and open it up (along with the exploit.)
Comment 3 by cevans@google.com, Nov 1 2014 
@ianbeer: I wonder what the right thing to do here is? Is Mavericks still supported? If so, I would expect this report to be subject to a 90-day deadline for Apple to fix this issue in their still-supported OS version.

Apple would then have 90 days to either:

- Patch Mavericks.
- Desupport Mavericks in support of Yosemite.
Project Member Comment 4 by ianbeer@google.com, Nov 8 2014
Labels: -Restrict-View-Commit
Status: Invalid
Apple confirmed that they did indeed fix this in 10.10.

Regarding supported versions of OS X, I don't think there is such a concept.

Mavericks did receive a security update when Yosemite was released but it only had patches for POODLE. It did not contain patches for any of the other externally reported bugs fixed in Yosemite, and clearly also didn't contain patches for the silently fixed bugs (such as this) either. I would argue that's equivalent to no longer supporting Mavericks. It's trivial to bindiff the patched drivers and find these bugs, therefore I'm marking this bug report as invalid and removing the view restriction.
► Sign in to add a comment