New issue
Advanced search Search tips

Issue 831 link

Starred by 4 users

Issue metadata

Status: Fixed
Owner:
Closed: Aug 2016
Cc:



Sign in to add a comment

OS X/iOS kernel use-after-free in IOSurface

Project Member Reported by ianbeer@google.com, May 25 2016

Issue description

IOSurfaceRootUserClient stores a task struct pointer (passed in via IOServiceOpen) in the field at +0xf0 without taking a reference.

By killing the corrisponding task we can free this pointer leaving the user client with a dangling pointer. We can get this pointer used
by calling the create_surface_fast_path external method which will try to read and use the memory map off of the free'd task struct.

This bug could be leveraged for kernel memory corruption and is reachable from interesting sandboxes including safari and chrome.

build: clang -o surfaceroot_uaf surfaceroot_uaf.c -framework IOKit

You should set gzalloc_min=1024 gzalloc_max=2048 or similar to actually fault on the UaF - otherwise you might see some weird panics!

tested on OS X 10.11.5 (15F34) on MacBookAir5,2
 
surfaceroot_uaf.c
10.9 KB View Download
Project Member

Comment 1 by ianbeer@google.com, May 25 2016

Labels: Id-641549861
Project Member

Comment 2 by ianbeer@google.com, Jun 2 2016

exploit
surfacer00t.c
21.8 KB View Download
Project Member

Comment 3 by ianbeer@google.com, Aug 24 2016

Labels: -Severity-High Fixed-2016-July-18 Severity-HIgh CVE-2016-4625
Status: Fixed (was: New)
Apple advisory: https://support.apple.com/en-us/HT206903
Project Member

Comment 4 by ianbeer@google.com, Oct 24 2016

another PoC for "task_t considered harmful"
since 10.11.6 blocks us from creating userclients with other task's task ports
this time we create an IOSurface in the child and send back a send right to that
IOSurface to the parent (rather than sending the child's task port.)

The child then execs a suid-root binary which blocks on stderr and the parent
creates an IOSurface which maps any (writable?) page of the euid-0 process into theirs.
Overwrite a function pointer and win.

No race conditions because the task struct pointer is on the kernel heap, not the stack.
surfacer00t_10_11_6.c
21.5 KB View Download
Project Member

Comment 5 by ianbeer@google.com, Oct 25 2016

Labels: -Restrict-View-Commit

Sign in to add a comment