[TKADV2007-001] Mac OS X TIOCSETD IOCTL Kernel Memory Corruption
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
Advisory: Mac OS X TIOCSETD IOCTL Kernel=20
Memory Corruption Vulnerability
Advisory ID: TKADV2007-001
Revision: 1.0 =20
Release Date: 2007/11/15=20
Last Modified: 2007/11/15=20
Date Reported: 2007/03/19
Author: Tobias Klein (tk at trapkit.de)
Affected Software: Mac OS X xnu kernel <=3D version=20
8.10.1 (xnu-792.22.5~1)
Mac OS X v10.4 through v10.4.10,=20
Mac OS X Server v10.4 through v10.4.10
Remotely Exploitable: No
Locally Exploitable: Yes=20
Vendor URL: http://www.apple.com=20
Vendor Status: Vendor has released an updated version
CVE-ID: CVE-2007-4686 =20
Patch development time: 241 days
=20
=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D
Vulnerability details:=20
=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D
The xnu kernel of Mac OS X contains a vulnerability in the code that=20
handles TIOCSETD ioctl requests. Exploitation of this vulnerability=20
can result in:
1) local execution of arbitrary code at the kernel level (complete system=
=20
compromise), or
2) local denial of service attacks (system crash due to a kernel panic)
The issue can be triggered by sending a specially crafted ioctl request.
=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D
Technical description:
=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D
Kernel source file: bsd/kern/tty.c=20
(from http://www.opensource.apple.com/darwinsource/10.4.8.x86/xnu-792.13.8/=
)
822 int
823 ttioctl(register struct tty *tp,
824 u_long cmd, caddr_t data, int flag,
825 struct proc *p)
826 { =20
[...]
1085 bcopy(t->c_cc, tp->t_cc, sizeof(t->c_cc));
1086 splx(s);
1087 break;
1088 }
1089 case TIOCSETD: { /* set line discipline */
1090 register int t =3D *(int *)data; <--- (1)
1091 dev_t device =3D tp->t_dev;
1092=20
1093 if (t >=3D nlinesw) <--- (2)
1094 return (ENXIO);
1095 if (t !=3D tp->t_line) {
1096 s =3D spltty();
1097 (*linesw[tp->t_line].l_close)(tp, flag);
1098 error =3D (*linesw[t].l_open)(device, tp); <--- (3)
1099 if (error) {
1100 (void)(*linesw[tp->t_line].l_open)(device, tp)=
;
1101 splx(s);
1102 return (error);
1103 }
1104 tp->t_line =3D t;
1105 splx(s);
1106 }
1107 break;
1108 }
In line 1090 the user supplied "data" of the type caddr_t (char *) gets=20
stored in the variable "t" of the type signed int (see (1)). Then in line=
=20
1093 the value of "t" is compared with "nlinesw". As "data" is supplied=20
by the user it is possible to provide a string value >=3D 0x80000000. If so=
,=20
"t" gets a negative value due to the type conversion error (see (1)) and=20
the check in line 1093 will always be passed (see (2)). In line 1098 the us=
er=20
supplied value "t" is used to reference and call "l_open". This leads to fu=
ll=20
control of the kernel execution flow.
Corresponding assembler code snippet:
__text:00356C08 loc_356C08: =20
__text:00356C08 mov eax, [ebp+arg_8]
__text:00356C0B mov ebx, [eax] <--- (1)
__text:00356C0D mov edx, [ebp+arg_0] =20
__text:00356C10 mov edx, [edx+64h] =20
__text:00356C13 mov [ebp+var_58], edx =20
__text:00356C16 cmp ebx, ds:457880h <--- (2)
__text:00356C1C jl short loc_356C28
__text:00356C1E mov esi, 6 =20
__text:00356C23 jmp loc_356F70 =20
__text:00356C28 ; --------------------------------
__text:00356C28
__text:00356C28 loc_356C28: =20
__text:00356C28 mov ecx, [ebp+arg_0] =20
__text:00356C2B cmp ebx, [ecx+60h] =20
__text:00356C2E jz loc_356633 =20
__text:00356C34 call _spltty =20
__text:00356C39 mov edi, eax =20
__text:00356C3B mov esi, [ebp+arg_0] =20
__text:00356C3E mov eax, [esi+60h] =
=20
__text:00356C41 shl eax, 5 =20
__text:00356C44 mov edx, [ebp+arg_C] =20
__text:00356C47 mov [esp+0B8h+var_B4], edx =20
__text:00356C4B mov [esp+0B8h+var_B8], esi =20
__text:00356C4E call ds:off_4578A4[eax]
__text:00356C54 mov eax, ebx <--- (3)
__text:00356C56 shl eax, 5 <--- (4)
__text:00356C59 mov [esp+0B8h+var_B4], esi
__text:00356C5D mov ecx, [ebp+var_58]
__text:00356C60 mov [esp+0B8h+var_B8], ecx
__text:00356C63 call ds:_linesw[eax] <--- (5)
(1) The user supplied data is copied into EBX=20
(2) EBX is compared with nlinesw=20
(3) The user supplied data in EBX is copied into EAX
(4) Slightly modification of EAX
(5) The user supplied value in EAX is used as a reference in this call
=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D
Proof of Concept:
=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D
Due to the severity of this issue no proof of concept exploit code=20
will be released.
=3D=3D=3D=3D=3D=3D=3D=3D=3D=20
Solution:=20
=3D=3D=3D=3D=3D=3D=3D=3D=3D
Upgrade to Mac OS X (Server) v10.4.11 or apply the Security Update 2007-0=
08.
=20
http://www.apple.com/support/downloads/
=20
=3D=3D=3D=3D=3D=3D=3D=3D=20
History:=20
=3D=3D=3D=3D=3D=3D=3D=3D
2007/03/19 - Vendor notified
2007/03/19 - Automated reply from vendor
2007/03/26 - Vendor asks for more details
2007/04/01 - Provided vendor with more details
2007/04/04 - Status update from vendor
2007/04/06 - Vendor confirms the vulnerability
2007/05/11 - Status update request
2007/06/22 - Status update from vendor=20
2007/11/14 - Update released by the vendor=20
2007/11/15 - Full technical details released to general=20
public
=3D=3D=3D=3D=3D=3D=3D=3D=20
Credits:=20
=3D=3D=3D=3D=3D=3D=3D=3D
Vulnerability found and advisory written by Tobias Klein.
=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=20
References:=20
=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D
[1] http://docs.info.apple.com/article.html?artnum=3D307041
[2] http://www.trapkit.de/advisories/TKADV2007-001.txt
=3D=3D=3D=3D=3D=3D=3D=3D=20
Changes:=20
=3D=3D=3D=3D=3D=3D=3D=3D
Revision 0.1 - Initial draft release to the vendor
Revision 1.0 - Public release
=20
=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D
Disclaimer:
=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D
The information within this advisory may change without notice. Use
of this information constitutes acceptance for use in an AS IS
condition. There are no warranties, implied or express, with regard
to this information. In no event shall the author be liable for any
direct or indirect damages whatsoever arising out of or in connection
with the use or spread of this information. Any use of this
information is at the user's own risk.
=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=20
PGP Signature Key:=20
=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D
http://www.trapkit.de/advisories/tk-advisories-signature-key.asc
=20
Copyright 2007 Tobias Klein. All rights reserved.
-----BEGIN PGP SIGNATURE-----
Version: PGP 8.1
iQA/AwUBRzydRZF8YHACG4RBEQJHeQCePEAADwvFB/zfastphFcL+UAZkJ0An28f
TELICn1MGteOiFrhKudTyAtw
=3D+x0c
-----END PGP SIGNATURE-----