Bug Hunter Diary

7.1 Vulnerability DiscoveryFirst I downloaded the latest source code release of the XNU kernel, 1and then I searched for a vulnerability in the following way:• Step 1: List the IOCTLs of the kernel.• Step 2: Identify the input data.• Step 3: Trace the input data.These steps will be detailed in the followingsections.← I used an Intel Macwith OS X 10.4.8and kernel versionxnu-792.15.4.obj~4/RELEASE_I386 as aplatform throughoutthis chapter.osx$ pwd/Users/tk/xnu-792.13.8Step 1: List the IOCTLs of the KernelTo generate a list of the IOCTLs of the kernel, I simply searchedthe kernel source code for the usual IOCTL macros. Every IOCTLis assigned its own number, which is usually created by a macro.Depending on the IOCTL type, the XNU kernel of OS X definesthe following macros: _IOR, _IOW, and _IOWR.osx$ grep -rnw -e _IOR -e _IOW -e _IOWR *[..]xnu-792.13.8/bsd/net/bpf.h:161:#define BIOCGRSIGxnu-792.13.8/bsd/net/bpf.h:162:#define BIOCSRSIGxnu-792.13.8/bsd/net/bpf.h:163:#define BIOCGHDRCMPLTxnu-792.13.8/bsd/net/bpf.h:164:#define BIOCSHDRCMPLTxnu-792.13.8/bsd/net/bpf.h:165:#define BIOCGSEESENTxnu-792.13.8/bsd/net/bpf.h:166:#define BIOCSSEESENT[..]_IOR('B',114, u_int)_IOW('B',115, u_int)_IOR('B',116, u_int)_IOW('B',117, u_int)_IOR('B',118, u_int)_IOW('B',119, u_int)I now had a list of IOCTLs supported by the XNU kernel. To findthe source files that implement the IOCTLs, I searched the whole kernelsource for each IOCTL name from the list. Here’s an example ofthe BIOCGRSIG IOCTL:osx$ grep --include=*.c -rn BIOCGRSIG *xnu-792.13.8/bsd/net/bpf.c:1143:case BIOCGRSIG:Step 2: Identify the Input DataTo identify the user-supplied input data of an IOCTL request, I took alook at some of the kernel functions that process the requests. I discoveredthat such functions typically expect an argument called cmd oftype u_long and a second argument called data of type caddr_t.114 Chapter 7