Apple macOS – ‘stackshot’ Raw Frame Pointers

• Exploit Database
• 34 阅读

• 作者： Google Security Research
  日期： 2017-05-22
• 类别：

  • dos
  平台：

  • macos
• 来源：https://www.exploit-db.com/exploits/42047/

• Source: https://bugs.chromium.org/p/project-zero/issues/detail?id=1164
  
  This is an issue that allows unentitled root to read kernel frame
  pointers, which might be useful in combination with a kernel memory
  corruption bug.
  
  By design, the syscall stack_snapshot_with_config() permits unentitled
  root to dump information about all user stacks and kernel stacks.
  While a target thread, along with the rest of the system, is frozen,
  machine_trace_thread64() dumps its kernel stack.
  machine_trace_thread64() walks up the kernel stack using the chain of
  saved RBPs. It dumps the unslid kernel text pointers together with
  unobfuscated frame pointers.
  
  The attached PoC dumps a stackshot into the file stackshot_data.bin
  when executed as root. The stackshot contains data like this:
  
  00000a70de 14 40 00 80 ff ff ffa0 be 08 77 80 ff ff ff|..@........w....|
  00000a807b b8 30 00 80 ff ff ff20 bf 08 77 80 ff ff ff|{.0..... ..w....|
  00000a909e a6 30 00 80 ff ff ff60 bf 08 77 80 ff ff ff|..0.....`..w....|
  00000aa05d ac 33 00 80 ff ff ffb0 bf 08 77 80 ff ff ff|].3........w....|
  
  The addresses on the left are unslid kernel text pointers; the
  addresses on the right are valid kernel stack pointers.
  
  
  Proof of Concept:
  https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/42047.zip