XNU Kernel – Heap Overflow Due to Bad Bounds Checking in MPTCP

• Exploit Database
• 11 阅读

• 作者： Google Security Research
  日期： 2018-06-06
• 类别：

  • dos
  平台：

  • multiple
• 来源：https://www.exploit-db.com/exploits/44849/

• mptcp_usr_connectx is the handler for the connectx syscall for the AP_MULTIPATH socket family.
  
  The logic of this function fails to correctly handle source and destination sockaddrs which aren't
  AF_INET or AF_INET6:
  
  // verify sa_len for AF_INET:
  
  if (dst->sa_family == AF_INET &&
  dst->sa_len != sizeof(mpte->__mpte_dst_v4)) {
  mptcplog((LOG_ERR, "%s IPv4 dst len %u\n", __func__,
  dst->sa_len),
   MPTCP_SOCKET_DBG, MPTCP_LOGLVL_ERR);
  error = EINVAL;
  goto out;
  }
  
  // verify sa_len for AF_INET6:
  
  if (dst->sa_family == AF_INET6 &&
  dst->sa_len != sizeof(mpte->__mpte_dst_v6)) {
  mptcplog((LOG_ERR, "%s IPv6 dst len %u\n", __func__,
  dst->sa_len),
   MPTCP_SOCKET_DBG, MPTCP_LOGLVL_ERR);
  error = EINVAL;
  goto out;
  }
  
  // code doesn't bail if sa_family was neither AF_INET nor AF_INET6
  
  if (!(mpte->mpte_flags & MPTE_SVCTYPE_CHECKED)) {
  if (mptcp_entitlement_check(mp_so) < 0) {
  error = EPERM;
  goto out;
  }
  
  mpte->mpte_flags |= MPTE_SVCTYPE_CHECKED;
  }
  
  // memcpy with sa_len up to 255:
  
  if ((mp_so->so_state & (SS_ISCONNECTED|SS_ISCONNECTING)) == 0) {
  memcpy(&mpte->mpte_dst, dst, dst->sa_len);
  }
  
  This PoC triggers the issue to overwrite the mpte_itfinfo field leading to a controlled pointer
  being passed to kfree when the socket is closed.
  
  Please note that these lengths seem to be trusted in multiple places - I would strongly suggest auditing
  this code quite thoroughly, especially as mptcp can be reached from more places as of iOS 11.
  
  Note that the MPTCP code does seem to be quite buggy; trying to get a nice PoC working for this buffer overflow
  bug I accidentally triggered the following error path:
  
  error = socreate_internal(dom, so, SOCK_STREAM, IPPROTO_TCP, p,
  SOCF_ASYNC, PROC_NULL);
  mpte_lock(mpte);
  if (error) {
  mptcplog((LOG_ERR, "%s: subflow socreate mp_so 0x%llx unable to create subflow socket error %d\n",
  (u_int64_t)VM_KERNEL_ADDRPERM(mp_so), error),
   MPTCP_SOCKET_DBG, MPTCP_LOGLVL_ERR);
  
  proc_rele(p);
  
  mptcp_subflow_free(mpts);
  return (error);
  }
  
  note that first argument to mptcplog has one too few arguments. It's probably not so interesting from a security
  POV but is indicative of untested code (this error path has clearly never run as it will always kernel panic.) 
  
  This PoC is for MacOS but note that this code is reachable on iOS 11 from inside the app sandbox if you give yourself
  the multipath entitlement (which app store apps can now use.)
  
  Just run this PoC as root on MacOS for easy repro.
  
  
  Proof of Concept:
  https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/44849.zip