New issue
Advanced search Search tips
Starred by 4 users

Issue metadata

Status: Fixed
Owner:
Closed: Aug 2016
Cc:



Sign in to add a comment
link

Issue 831: OS X/iOS kernel use-after-free in IOSurface

Reported by ianbeer@google.com, May 25 2016 Project Member

Issue description

IOSurfaceRootUserClient stores a task struct pointer (passed in via IOServiceOpen) in the field at +0xf0 without taking a reference.

By killing the corrisponding task we can free this pointer leaving the user client with a dangling pointer. We can get this pointer used
by calling the create_surface_fast_path external method which will try to read and use the memory map off of the free'd task struct.

This bug could be leveraged for kernel memory corruption and is reachable from interesting sandboxes including safari and chrome.

build: clang -o surfaceroot_uaf surfaceroot_uaf.c -framework IOKit

You should set gzalloc_min=1024 gzalloc_max=2048 or similar to actually fault on the UaF - otherwise you might see some weird panics!

tested on OS X 10.11.5 (15F34) on MacBookAir5,2
 
surfaceroot_uaf.c
10.9 KB View Download

Comment 1 by ianbeer@google.com, May 25 2016

Project Member
Labels: Id-641549861

Comment 2 by ianbeer@google.com, Jun 2 2016

Project Member
exploit
surfacer00t.c
21.8 KB View Download

Comment 3 by ianbeer@google.com, Aug 24 2016

Project Member
Labels: -Severity-High Fixed-2016-July-18 Severity-HIgh CVE-2016-4625
Status: Fixed (was: New)
Apple advisory: https://support.apple.com/en-us/HT206903

Comment 4 by ianbeer@google.com, Oct 24 2016

Project Member
another PoC for "task_t considered harmful"
since 10.11.6 blocks us from creating userclients with other task's task ports
this time we create an IOSurface in the child and send back a send right to that
IOSurface to the parent (rather than sending the child's task port.)

The child then execs a suid-root binary which blocks on stderr and the parent
creates an IOSurface which maps any (writable?) page of the euid-0 process into theirs.
Overwrite a function pointer and win.

No race conditions because the task struct pointer is on the kernel heap, not the stack.
surfacer00t_10_11_6.c
21.5 KB View Download

Comment 5 by ianbeer@google.com, Oct 25 2016

Project Member
Labels: -Restrict-View-Commit

Sign in to add a comment