New issue
Advanced search Search tips
Starred by 4 users

Issue metadata

Status: Fixed
Owner:
Closed: Dec 2017
Cc:



Sign in to add a comment
link

Issue 1377: MacOS/iOS multiple kernel UAFs due to incorrect IOKit object lifetime management in IOTimeSyncClockManagerUserClient

Reported by ianbeer@google.com, Oct 6 2017 Project Member

Issue description

IOTimeSyncClockManagerUserClient provides the userspace interface for the IOTimeSyncClockManager IOService.

IOTimeSyncClockManagerUserClient overrides the IOUserClient::clientClose method but it treats it like a destructor.
IOUserClient::clientClose is not a destructor and plays no role in the lifetime management of an IOKit object.

It is perfectly possible to call ::clientClose (via io_service_close) in one thread and call an external method in another
thread at the same time.

IOTimeSyncClockManagerUserClient::clientClose drops references on a bunch of OSArrays causing them to be free'd,
it also destroys the locks which are supposed to protect access to those arrays. This leads directly to multiple UaFs
if you also call external methods which manipulate those arrays in other threads.

For an exploit some care would be required to ensure correct interleaving such that the OSArray was destroyed and then
used *before* the lock which is supposed to be protecting the array is also destroyed, but it would be quite possible.

Tested on MacOS 10.13 (17A365) on MacBookAir5,2
 
timesync_uaf.c
2.6 KB View Download

Comment 1 by ianbeer@google.com, Oct 6 2017

Project Member
Labels: Id-675083680 Reported-2017-Oct-06

Comment 2 by ianbeer@google.com, Oct 6 2017

Project Member
Labels: Product-iOS
Summary: MacOS/iOS multiple kernel UAFs due to incorrect IOKit object lifetime management in IOTimeSyncClockManagerUserClient (was: MacOS multiple kernel UAFs due to incorrect IOKit object lifetime management in IOTimeSyncClockManagerUserClient)
(I believe this also affects iOS)

Comment 3 by ianbeer@google.com, Dec 11 2017

Project Member
Labels: -Restrict-View-Commit Fixed-2017-Dec-02 CVE-2017-13847
Status: Fixed (was: New)

Sign in to add a comment