iOS Kernel Heap Armageddon

_MALLOC() in iOS 5.x
void *_MALLOC(size_t size, int type, int flags)
{
struct _mhead *hdr;
size_t memsize = sizeof (*hdr) + size;
int overflow = memsize < size ? 1 : 0;
}
...
if (flags & M_NOWAIT) {
if (overflow)
return (NULL);
hdr = (void *)kalloc_noblock(memsize);
} else {
if (overflow)
panic("_MALLOC: overflow detected, size %llu", size);
hdr = (void *)kalloc(memsize);
...
}
...
hdr->mlen = memsize;
return (hdr->dat);
Stefan Esser • iOS Kernel Heap Armageddon • April 2012 •
integer overflow
detection
attacker can use
overflow to panic
kernel
M_WAIT
22