Bug Hunter Diary

As the debugger output shows, the EIP register now had a valueof 0x65656565. At this point I was able to control EIP, but exploiting thebug to achieve arbitrary code execution at the kernel level was still achallenge. Under OS X, including Leopard, the kernel isn’t mappedinto every user space process; it has its own virtual address space. It’stherefore impossible to return to a user space address using commonstrategies for Linux or Windows. I solved this problem by heap sprayingthe kernel with my privilege escalation payload and a reference tothis payload. I achieved this by exploiting a memory leak in the kernelof OS X. Then I calculated an appropriate TIOCSETD input value thatpointed to the payload reference. This value was then copied into EIPand . . . bingo!Providing you with a full working exploit would be against the law,but if you are interested, you can watch a short video I recorded thatshows the exploit in action on the book’s website. 47.3 Vulnerability RemediationWednesday, November 14, 2007After I informed Apple about the bug, Apple fixed it by adding anextra check for the user-supplied IOCTL data.Source code file xnu-792.24.17/bsd/kern/tty.c 5[..]1081 case TIOCSETD: { /* set line discipline */1082 register int t = *(int *)data;1083 dev_t device = tp->t_dev;10841085 if (t >= nlinesw || t < 0)1086 return (ENXIO);1087 if (t != tp->t_line) {1088 s = spltty();1089 (*linesw[tp->t_line].l_close)(tp, flag);1090 error = (*linesw[t].l_open)(device, tp);1091 if (error) {1092 (void)(*linesw[tp->t_line].l_open)(device, tp);1093 splx(s);1094 return (error);1095 }1096 tp->t_line = t;1097 splx(s);1098 }1099 break;1100 }[..]Line 1085 now checks whether the value of t is negative. If so, theuser-derived data will not be processed any further. This little changewas enough to successfully rectify the vulnerability.A Bug Older Than 4.4BSD 129