macOS 10.13 (17A365) - Kernel Memory Disclosure due to Lack of Bounds Checking in 'AppleIntelCapriController::getDisplayPipeCapability'

EDB-ID: 43780
Author: Google Security Research
Published: 2018-01-19
CVE: CVE-2017-13878
Type: Dos
Platform: macOS
Aliases: N/A
Advisory/Source: Link
Tags: N/A
Vulnerable App: N/A

 AppleIntelCapriController::getDisplayPipeCapability reads an attacker-controlled dword value from a userclient structure 
input buffer which it uses to index a small array of pointers to memory to copy back to userspace.

There is no bounds checking on the attacker supplied value allowing (with some heap grooming) the disclosure of arbitrary
kernel memory:

__text:000000000002ACE0 mov eax, [rbx] ; structure input buffer
__text:000000000002ACE2 mov rsi, [rdi+rax*8+0E48h] ; rax is controlled -> rsi read OOB
__text:000000000002ACEA cmp byte ptr [rsi+1DCh], 0 ; as long as this byte isn't NULL
__text:000000000002ACF1 jz short loc_2AD10
__text:000000000002ACF3 add rsi, 1E11h ; void * ; add this offset
__text:000000000002ACFA mov edx, 1D8h ; size_t
__text:000000000002ACFF mov rdi, r14 ; void *
__text:000000000002AD02 call _memcpy ; copy to structure output buffer, will be returned to userspace

Tested on MacOS 10.13 (17A365) on MacBookAir5,2
*/

// ianbeer
// build: clang -o capri_display_pipe capri_display_pipe.c -framework IOKit

#if 0
MacOS kernel memory disclosure due to lack of bounds checking in AppleIntelCapriController::getDisplayPipeCapability

AppleIntelCapriController::getDisplayPipeCapability reads an attacker-controlled dword value from a userclient structure
input buffer which it uses to index a small array of pointers to memory to copy back to userspace.

There is no bounds checking on the attacker supplied value allowing (with some heap grooming) the disclosure of arbitrary
kernel memory:

__text:000000000002ACE0 mov eax, [rbx] ; structure input buffer
__text:000000000002ACE2 mov rsi, [rdi+rax*8+0E48h] ; rax is controlled -> rsi read OOB
__text:000000000002ACEA cmp byte ptr [rsi+1DCh], 0 ; as long as this byte isn't NULL
__text:000000000002ACF1 jz short loc_2AD10
__text:000000000002ACF3 add rsi, 1E11h ; void * ; add this offset
__text:000000000002ACFA mov edx, 1D8h ; size_t
__text:000000000002ACFF mov rdi, r14 ; void *
__text:000000000002AD02 call _memcpy ; copy to structure output buffer, will be returned to userspace

Tested on MacOS 10.13 (17A365) on MacBookAir5,2
Related Posts

Comments